Define how long without use makes an account dormant, run a scheduled query for accounts past that threshold, disable them through a ticketed process, and keep the query output and tickets. The proof is the repeated routine, not a one-off cleanup before the audit.
What the standards leave to you
NIST SP 800-53 account management asks organizations to review accounts for compliance with their account management requirements at an organization-defined frequency. The related enhancement on disabling accounts lists triggers such as expired accounts, inactive accounts past an organization-defined threshold, accounts no longer associated with a user, and accounts that violate policy. The key phrase is organization-defined. The framework does not say 30 or 90 days. You choose, write it down, and then do it.
Step 1: define dormant
Pick a number and state what counts as activity. Be specific, because systems differ.
| Account type | Activity signal | Example threshold you might choose |
|---|---|---|
| Employee SSO | Last successful sign in | 60 or 90 days |
| Cloud IAM user | Last console sign in or last key use | Match SSO policy |
| Service account | Last authentication or last token use | Longer, with a named owner |
| Contractor | Contract end date, not only login | End date plus a short grace period |
These are examples. Your risk and your business set the real numbers.
Step 2: run the query on a schedule
Most identity providers and cloud platforms expose last activity through reports or APIs. Write the query once, run it monthly or weekly, and save the output with the run date. A short script that exports to CSV and uploads to your evidence store is enough.
Step 3: act and record
- For each flagged account, confirm with the manager or owner that it is no longer needed.
- Disable first, delete later. Disabling is reversible and still satisfies the intent.
- Create or update a ticket per batch, listing account names, last activity date and action taken.
- For accounts you keep, record the reason and an expiry date for the exception.
Step 4: show the loop closed
An auditor will usually sample some accounts. Be ready to show, for a sampled account, the last activity date, the monthly report that flagged it, and the ticket that disabled it. For an account that was not disabled, show the exception.
Pitfalls
- Service accounts and break-glass accounts look dormant by design. Document them with owners and a different review cadence.
- Some systems do not record last login reliably. Say so, and use a compensating check such as a periodic manual review.
- Reports that only show current state cannot prove past action. Keep each run.
Quick check
What is the right inactivity threshold?
NIST leaves it organization-defined. Choose one based on your risk, write it in your policy, and be consistent.
Should dormant accounts be deleted or disabled?
Disable first. Delete after a retention window your policy defines, once you are sure nothing depends on the account.
How many monthly reports do I need to keep?
Keep every run inside the audit period, since sampling can land on any month.
Safeguard offers agent identity and asset discovery plus compliance and evidence automation, which help show which identities exist and who owns them. A free scan is available.
Sources
Last reviewed: 19 October 2026.
