OpenControls Logo

STIG Viewer

STIGViewer Support

The Enterprise Voice, Video, and Messaging Session Manager must automatically disable user accounts after a 35-day period of account inactivity.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-259987SRG-NET-000004-VVSM-00101SV-259987r956074_ruleCCI-000017medium
Description
Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Enterprise Voice, Video, and Messaging Session Managers must track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be misused, hijacked, or data compromised. DOD has determined that 35 days is the appropriate time period of inactivity for Inactive accounts. Therefore, systems with a per user paradigm of management would apply.
STIGDate
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide2026-05-23

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-15.3Disable Inactive Accounts
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (41) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00

+31 more (top 10 by confidence shown)

CCI1 mapping
CCI-000017
1.00

Details

Check Text (C-259987r956074_chk)

Verify the Enterprise Voice, Video, and Messaging Session Manager automatically disables Voice Video Endpoint user access after a 35-day period of account inactivity. This requirement refers to users rather than endpoints. If the Enterprise Voice, Video, and Messaging Session Manager does not automatically disable Voice Video Endpoint user access after a 35-day period of account inactivity, this is a finding.

Fix Text (F-63625r956074_fix)

Configure the Enterprise Voice, Video, and Messaging Session Manager to automatically disable Voice Video Endpoint user access after a 35-day period of account inactivity.