Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Identity And Access Management
  4. >Identity And Access Management - Objective 1
  5. >C2M2-ACCESS-1C
C2M2-ACCESS-1CActive

Identities are deprovisioned, at least in an ad hoc manner, when no longer required

Statement

Identities are deprovisioned, at least in an ad hoc manner, when no longer required

Location

Domain
Identity and Access Management
Objective
Identity and Access Management - Objective 1

Practice Details

Identifier
C2M2-ACCESS-1C
Domain
Identity and Access Management
Objective
Objective 1
Maturity Level
MIL-1

Help Text

When a person, object, or entity ceases to exist in the organization, the associated identity and all of its access privileges and restrictions should be eliminated. The failure to deprovision an identity can result in significant operational risk to an organization because it may provide an identity to which an unauthorized (and perhaps unknown) person, object, or entity can associate. If this occurs and its access privileges have not been terminated, the identity can be stolen along with all of the existing privileges.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ACCESS-1a, ACCESS-1c, ACCESS-1e, ACCESS-1f, ACCESS-1j.

AESCSF
AESCSF-ACCESS-1cequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Identity and Access Management - Objective 1
Identity and Access Management - Objective 110 controls
C2M2-ACCESS-1AIdentities are provisioned, at least in an ad hoc manner, for personnel and other entities such as services and devices that require access to assets (note that this does not preclude shared identities)C2M2-ACCESS-1BCredentials (such as passwords, smartcards, certificates, and keys) are issued for personnel and other entities that require access to assets, at least in an ad hoc mannerC2M2-ACCESS-1CIdentities are deprovisioned, at least in an ad hoc manner, when no longer requiredC2M2-ACCESS-1DPassword strength and reuse restrictions are defined and enforcedC2M2-ACCESS-1EIdentity repositories are reviewed and updated periodically and according to defined triggers, such as system changes and changes to organizational structureC2M2-ACCESS-1FIdentities are deprovisioned within organization-defined time thresholds when no longer requiredC2M2-ACCESS-1GThe use of privileged credentials is limited to processes for which they are requiredC2M2-ACCESS-1HStronger credentials, multifactor authentication, or single use credentials are required for higher risk access (such as privileged accounts, service accounts, shared accounts, and remote access)C2M2-ACCESS-1IMultifactor authentication is required for all access, where feasibleC2M2-ACCESS-1JIdentities are disabled after a defined period of inactivity, where feasible