Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Identity And Access Management
  4. >Identity And Access Management - Objective 1
  5. >C2M2-ACCESS-1F
C2M2-ACCESS-1FActive

Identities are deprovisioned within organization-defined time thresholds when no longer required

Statement

Identities are deprovisioned within organization-defined time thresholds when no longer required

Location

Domain
Identity and Access Management
Objective
Identity and Access Management - Objective 1

Practice Details

Identifier
C2M2-ACCESS-1F
Domain
Identity and Access Management
Objective
Objective 1
Maturity Level
MIL-2

Help Text

Deprovisioning should occur as a result of the staff change or termination process. The organization should define a time-based requirement within which the deprovisioning should be done. For example, upon a termination, deprovisioning should occur immediately; for staff transitions to new positions, the time frame might be longer. For timely deprovisioning to be possible, there must be a process for human resources departments to feed termination information to those who are responsible for maintaining the organization’s identity repositories. Deprovisioning may also be the result of corrective actions taken after a review to remedy situations where the time thresholds were not met.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ACCESS-1a, ACCESS-1c, ACCESS-1e, ACCESS-1f, ACCESS-1j.

AESCSF
AESCSF-ACCESS-1fequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Identity and Access Management - Objective 1
Identity and Access Management - Objective 110 controls
C2M2-ACCESS-1AIdentities are provisioned, at least in an ad hoc manner, for personnel and other entities such as services and devices that require access to assets (note that this does not preclude shared identities)C2M2-ACCESS-1BCredentials (such as passwords, smartcards, certificates, and keys) are issued for personnel and other entities that require access to assets, at least in an ad hoc mannerC2M2-ACCESS-1CIdentities are deprovisioned, at least in an ad hoc manner, when no longer requiredC2M2-ACCESS-1DPassword strength and reuse restrictions are defined and enforcedC2M2-ACCESS-1EIdentity repositories are reviewed and updated periodically and according to defined triggers, such as system changes and changes to organizational structureC2M2-ACCESS-1FIdentities are deprovisioned within organization-defined time thresholds when no longer requiredC2M2-ACCESS-1GThe use of privileged credentials is limited to processes for which they are requiredC2M2-ACCESS-1HStronger credentials, multifactor authentication, or single use credentials are required for higher risk access (such as privileged accounts, service accounts, shared accounts, and remote access)C2M2-ACCESS-1IMultifactor authentication is required for all access, where feasibleC2M2-ACCESS-1JIdentities are disabled after a defined period of inactivity, where feasible