CIS Controls Account Management Capability Group

Unique passwords and minimum password lengths, which directly reduce the effectiveness of brute-force attacks by increasing the number of possible password combinations and limiting the reuse of compromised credentials across systems. This makes online password guessing and offline password cracking more difficult and reduces the success of credential-stuffing attacks.

Enforced minimum password length increases the search space and reduces the effectiveness of password guessing.

Longer passwords materially increase the effort required to recover plaintext passwords from captured hashes or related material.

Unique, non-common passwords reduce success of spraying common passwords across many accounts.

Unique passwords reduce adversary use of default or vendor-provided account credentials.

Domain accounts can span users, admins, and services; unique passwords reduce domain credential reuse and lateral reuse risk.

Unique local passwords reduce reuse of one compromised local account credential across multiple endpoints or servers.

Unique passwords reduce credential reuse across systems and accounts, limiting adversary use of one compromised password to pivot through valid accounts.

Disabling dormant accounts removes stale accounts that may still have breached or reused credentials, reducing credential-stuffing success against abandoned identities.

Disabling inactive cloud/SaaS accounts removes abandoned identities usable for access, persistence, or privilege abuse.

Disabling inactive local accounts reduces stale local credential abuse, dependent on endpoint/server coverage.

Dormant domain accounts can retain broad access; disabling them removes stale domain credentials from the attack surface.

Disabling stale accounts removes valid authentication paths available to adversaries.

Separating privileged accounts from daily-use accounts limits the privilege available if a primary account is compromised.

Dedicated domain admin accounts reduce the chance that routine domain account compromise yields domain-level privileges.

Restricting local admin rights to dedicated accounts reduces local privilege availability in routine user sessions.

Dedicated cloud admin accounts reduce privileged cloud exposure during normal user activity, though cloud-specific PAM controls are not required by the safeguard.

The safeguard limits which accounts can legitimately elevate, reducing the opportunity to abuse elevation paths from compromised routine accounts.

If routine accounts lack admin rights, UAC bypass from normal browsing/email sessions is less useful to an adversary.

Dedicated admin accounts reduce privileged sudo exposure during routine activity, though sudo policy hardening is outside the safeguard.

If dedicated administrator accounts include cloud privileged-access workflows or separate privileged cloud identities, the safeguard can reduce abuse of temporary elevated cloud access.

Disabling stale accounts removes valid authentication paths available to adversaries.

This directly counters password overlap from breached credentials reused across personal, third-party, and enterprise accounts.

Unique passwords reduce cloud/SaaS credential overlap and lateral reuse risk