Control 3.5.5

★What This Means in Plain English

When an employee leaves and their account is disabled, that username should not be reassigned to a new employee for a defined period. This prevents confusion in audit logs and access records.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Active Directory policy prohibiting reuse of usernames for a minimum of two years after account deletion
• Unique employee ID numbers linked to accounts that are never recycled
• Terminated user accounts disabled immediately and retained in a disabled state for the retention period
• ComplianceArmor tracking account lifecycle from creation through deletion
• Naming convention including unique elements preventing accidental reuse

🔎Assessment Guidance

Assessors will review the identifier reuse policy, verify that disabled accounts are retained for the defined period, check that usernames are not reassigned to new users prematurely, and review account lifecycle documentation.

⚠Common Implementation Gaps

• No policy on identifier reuse periods
• Usernames reassigned immediately when employees leave
• Terminated accounts deleted immediately rather than retained
• No tracking of account lifecycle events
• Generic identifiers (admin1, user1) reused across individuals

⇄Cross-Framework Mapping