[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F5":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","5","Control 5","Account Management",581,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to manage the full life cycle of user, administrator and service accounts, from creation through to removal. It includes keeping an inventory of accounts, using unique credentials and disabling accounts that are no longer needed.\n\n**In practice.** Good practice is an account inventory tied to the HR joiner, mover and leaver process so that access is created and revoked automatically. Administrative work is done from separate privileged accounts, passwords are unique and stored in a vault, and dormant accounts are disabled after a defined period of inactivity. Auditors expect account listings, leaver reconciliation reports, evidence of periodic reviews and documentation of service account ownership.\n\n**Common gaps.** Service accounts and shared accounts are frequently unowned, never rotated and over privileged. Leaver processes often miss contractors and accounts in SaaS applications that are not connected to central identity.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccount-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},622,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"self-hosted-ai-agents-demand-rigorous-credential-and-configuration-controls","Self-Hosted AI Agents Demand Rigorous Credential and Configuration Controls","2026-11-12T19:21:17.711+00:00",{"slug":24,"title":25,"published_at":26},"stealc-takedown-exposes-millions-of-stolen-credentials-from-everyday-users","StealC Takedown Exposes Millions of Stolen Credentials From Everyday Users","2026-11-12T17:21:32.836+00:00",{"slug":28,"title":29,"published_at":30},"apify-breach-highlights-credential-and-token-security-risks","Apify Breach Highlights Credential and Token Security Risks","2026-11-12T15:21:18.914+00:00",{"slug":32,"title":33,"published_at":34},"legacy-acquisition-system-exposes-maersk-to-data-theft-and-extortion","Legacy Acquisition System Exposes Maersk to Data Theft and Extortion","2026-11-12T11:20:57.065+00:00",{"slug":36,"title":37,"published_at":38},"stolen-cicd-credentials-enable-mass-github-repository-compromise","Stolen CI\u002FCD Credentials Enable Mass GitHub Repository Compromise","2026-11-12T10:21:13.379+00:00",{"slug":40,"title":41,"published_at":42},"ai-agent-offboarding-the-credential-and-audit-trail-problem","AI Agent Offboarding: The Credential and Audit Trail Problem","2026-11-12T07:20:37.561+00:00",{"slug":44,"title":45,"published_at":46},"citrus-ransomware-exploits-stolen-credentials-and-group-policy-to-cripple-enterprise-defenses","Citrus Ransomware Exploits Stolen Credentials and Group Policy to Cripple Enterprise Defenses","2026-11-12T07:20:19+00:00",{"slug":48,"title":49,"published_at":50},"stale-third-party-iam-trust-relationships-exploited-to-drain-aws-s3-buckets","Stale Third-Party IAM Trust Relationships Exploited to Drain AWS S3 Buckets","2026-11-10T14:22:43.853+00:00",{"slug":52,"title":53,"published_at":54},"stale-third-party-iam-roles-enable-qubole-supply-chain-data-theft","Stale Third-Party IAM Roles Enable Qubole Supply Chain Data Theft","2026-11-10T14:22:21.421+00:00",{"slug":56,"title":57,"published_at":58},"compromised-third-party-iam-credentials-enable-cross-account-aws-secret-theft","Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft","2026-11-09T20:20:24.804+00:00",{"slug":60,"title":61,"published_at":62},"quboles-trusted-aws-credentials-weaponized-to-breach-customer-accounts","Qubole's Trusted AWS Credentials Weaponized to Breach Customer Accounts","2026-11-09T19:22:07.901+00:00",{"slug":64,"title":65,"published_at":66},"qubole-iam-credential-abuse-exposes-customer-aws-environments-via-cross-account-trust","Qubole IAM Credential Abuse Exposes Customer AWS Environments via Cross-Account Trust","2026-11-09T16:21:48.8+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",267,{"slug":74,"name":75,"problem":76,"stories":77},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",186,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",137,{"slug":84,"name":85,"problem":86,"stories":87},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",111,{"slug":89,"name":90,"problem":91,"stories":92},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",109,{"slug":94,"name":95,"problem":96,"stories":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",94,[99,104,110,115,120,125,130,135],{"family":100,"item":101,"code":102,"title":8,"together":103},"nist-800-53","ac-2","AC-2",465,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",329,{"family":5,"item":111,"code":112,"title":113,"together":114},"6","Control 6","Access Control Management",314,{"family":100,"item":116,"code":117,"title":118,"together":119},"ac-6","AC-6","Least Privilege",264,{"family":121,"item":122,"code":123,"title":123,"together":124},"itil","overview","ITIL",203,{"family":5,"item":126,"code":127,"title":128,"together":129},"8","Control 8","Audit Log Management",185,{"family":100,"item":131,"code":132,"title":133,"together":134},"ia-5","IA-5","Authenticator Management",152,{"family":100,"item":136,"code":137,"title":138,"together":139},"si-2","SI-2","Flaw Remediation",144]