Which timing requirement applies to removing or disabling inactive user accounts?

Which timing requirement applies to removing or disabling inactive user accounts?

• A. Remove inactive accounts within 180 days.
• B. Remove/disable inactive user accounts within 90 days.
• C. Disable accounts after 365 days.
• D. Do nothing.

Answer: (B)

Prompt deprovisioning of inactive user accounts is essential to minimize access risk. PCI DSS requires that accounts that are inactive be removed or disabled within 90 days, so unused credentials can’t be exploited. This 90-day timing strikes a balance between security and operational practicality, keeping access tightly controlled while avoiding excessive administrative burden. Longer windows, like 180 or 365 days, leave a larger window for misuse, and doing nothing maintains unnecessary risk. So, removing or disabling inactive accounts within 90 days is the best practice.

Prompt deprovisioning of inactive user accounts is essential to minimize access risk. PCI DSS requires that accounts that are inactive be removed or disabled within 90 days, so unused credentials can’t be exploited. This 90-day timing strikes a balance between security and operational practicality, keeping access tightly controlled while avoiding excessive administrative burden. Longer windows, like 180 or 365 days, leave a larger window for misuse, and doing nothing maintains unnecessary risk. So, removing or disabling inactive accounts within 90 days is the best practice.