# NIST 800-171 3.5.5 Prevent reuse of identifiers for a defined period.

- Source: https://support.icompaas.com/support/solutions/articles/62000229293-nist-800-171-3-5-5-prevent-reuse-of-identifiers-for-a-defined-period-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Identifiers are provided for users, processes acting on behalf of users, or devices (3.5.). Preventing reuse of identifiers implies preventing the assignment of previously used individual, group, role, or device identifiers to different individuals, groups, roles, or devices. 

  

**Priority**: High   

  

**Category**: Centralized Controls Management 

  

**Services Associated with AWS:**   

-   AWS Identity and Access Management (IAM)

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific
-   secure baseline configurations
-   Technical: screenshot of configuration settings  

  

Possible Technology Considerations : 

-   Identity & Access Management (IAM)
-   Secure Baseline Configurations (SBC) 

  

**What needs to be answered :**  

Are user accounts or identifiers monitored for inactivity? Are user or device identifiers disabled after a period of inactivity (30 days)?

-   Disable Inactive Identifiers  
    Description: This check ensures that identifiers (e.g., user accounts, service accounts, device identifiers) are disabled after a defined period of inactivity. Inactive identifiers refer to accounts or identifiers that have not been used for a specified period of time. Disabling inactive identifiers helps mitigate the risk of unauthorized access and potential misuse of dormant accounts. Organizations should establish policies and procedures to identify and monitor inactive identifiers and implement controls to automatically disable these identifiers after a defined period of inactivity. The defined period of inactivity should be based on the organization's risk tolerance and security requirements. By disabling inactive identifiers, organizations can reduce the attack surface and enhance the overall security posture of their systems. 

  

**More Details:**   

User accounts monitored for inactivity and reviewed for deactivation of removal after significant idle period.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.