[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F5":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","5","Control 5","Account Management",581,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to manage the full life cycle of user, administrator and service accounts, from creation through to removal. It includes keeping an inventory of accounts, using unique credentials and disabling accounts that are no longer needed.\n\n**In practice.** Good practice is an account inventory tied to the HR joiner, mover and leaver process so that access is created and revoked automatically. Administrative work is done from separate privileged accounts, passwords are unique and stored in a vault, and dormant accounts are disabled after a defined period of inactivity. Auditors expect account listings, leaver reconciliation reports, evidence of periodic reviews and documentation of service account ownership.\n\n**Common gaps.** Service accounts and shared accounts are frequently unowned, never rotated and over privileged. Leaver processes often miss contractors and accounts in SaaS applications that are not connected to central identity.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccount-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":23,"title":24,"published_at":25},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":27,"title":28,"published_at":29},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":31,"title":32,"published_at":33},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":35,"title":36,"published_at":37},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":39,"title":40,"published_at":41},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":43,"title":44,"published_at":45},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":47,"title":48,"published_at":49},"ghostaction-credential-theft-hits-1900-github-accounts-and-30000-repos","GhostAction Credential Theft Hits 1,900 GitHub Accounts and 30,000+ Repos","2026-10-15T10:20:51.258+00:00",{"slug":51,"title":52,"published_at":53},"pan-os-zero-day-enables-root-level-rce-on-firewalls","PAN-OS Zero-Day Enables Root-Level RCE on Firewalls","2026-10-15T08:20:33.588+00:00",{"slug":55,"title":56,"published_at":57},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",{"slug":59,"title":60,"published_at":61},"north-korean-it-workers-infiltrate-us-companies-via-laptop-farms-and-stolen-identities","North Korean IT Workers Infiltrate US Companies via Laptop Farms and Stolen Identities","2026-10-14T20:20:23.163+00:00",{"slug":63,"title":64,"published_at":65},"unauthorised-ai-agent-actions-expose-gaps-in-governance-and-oversight","Unauthorised AI Agent Actions Expose Gaps in Governance and Oversight","2026-10-14T18:22:00.668+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",251,{"slug":73,"name":74,"problem":75,"stories":76},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",168,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",126,{"slug":83,"name":84,"problem":85,"stories":86},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",107,{"slug":88,"name":89,"problem":90,"stories":91},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",98,{"slug":93,"name":94,"problem":95,"stories":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",94,[98,103,109,114,119,124,129,134],{"family":99,"item":100,"code":101,"title":8,"together":102},"nist-800-53","ac-2","AC-2",461,{"family":104,"item":105,"code":106,"title":107,"together":108},"gdpr","32","Article 32","Security of processing",314,{"family":5,"item":110,"code":111,"title":112,"together":113},"6","Control 6","Access Control Management",310,{"family":99,"item":115,"code":116,"title":117,"together":118},"ac-6","AC-6","Least Privilege",262,{"family":120,"item":121,"code":122,"title":122,"together":123},"itil","overview","ITIL",203,{"family":5,"item":125,"code":126,"title":127,"together":128},"8","Control 8","Audit Log Management",173,{"family":99,"item":130,"code":131,"title":132,"together":133},"ia-5","IA-5","Authenticator Management",150,{"family":5,"item":135,"code":136,"title":137,"together":138},"7","Control 7","Continuous Vulnerability Management",127]