Skip to main content

Pro audit program · v1.0

Service Account Hygiene

Service accounts get over-privileged and never rotated — quick health check on inventory, scoping and credential rotation.

  • General target area
  • NIST CSF framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Service accounts get over-privileged and never rotated — quick health check on inventory, scoping and credential rotation.

Risks addressed

  • Critical Over-privileged service account abused for lateral movement
  • High Stale service accounts not deprovisioned when systems retire
  • Critical Service account credentials hardcoded in scripts / repos

Controls (6)

  1. Inventory of all service accounts

    High

    This control requires organizations to maintain a comprehensive, current inventory of all service accounts—non-human identities used by applications, scripts, scheduled tasks, and services to authenticate and execute operations. The inventory must include attributes such as account name, purpose, associated systems/applications,…

    How to test + evidence

    Testing procedure: Request the service-account register; reconcile with IdP groups and CMDB.

    Evidence to collect: Service-account inventory CSV.

  2. Least-privilege scoping for each service account

    Critical

    This control ensures that each service account is granted only the minimum permissions necessary to perform its designated function, avoiding over-privileged accounts that could be exploited. Service accounts are non-human identities used by applications, systems, or automation processes, and unlike…

    How to test + evidence

    Testing procedure: Sample 5 accounts; verify each has only the rights it actually needs.

    Evidence to collect: Role assignment dump.

  3. Credentials vaulted (no hardcoded secrets)

    Critical

    This control ensures that authentication credentials, API keys, tokens, passwords, certificates, and other secrets are not embedded directly in source code, configuration files, container images, or scripts. Instead, secrets must be stored in dedicated vaulting solutions (e.g., HashiCorp Vault, AWS…

    How to test + evidence

    Testing procedure: Search repositories + config stores for service-account secrets. Confirm PAM coverage.

    Evidence to collect: Secret-scan report + PAM coverage.

  4. Automatic rotation enabled

    High

    Automatic rotation enabled ensures that cryptographic keys, secrets, passwords, API tokens, and certificates are replaced on a scheduled basis without manual intervention. This control leverages automated processes—often integrated with secret management platforms, cloud key management services (KMS), or privileged access…

    How to test + evidence

    Testing procedure: Verify passwords / keys rotate on a documented cadence.

    Evidence to collect: PAM rotation log.

  5. No interactive logon to service accounts

    High

    This control prevents service accounts from being used for interactive logon sessions such as Remote Desktop Protocol (RDP), console login, or Remote PowerShell. Service accounts are designed to run automated processes and applications without human interaction. By blocking interactive logon…

    How to test + evidence

    Testing procedure: GPO / IdP policy blocks interactive logon for service accounts.

    Evidence to collect: Policy export.

  6. Disable / decommission stale accounts

    Medium

    This control requires organizations to identify and disable or decommission user, service, and system accounts that have been inactive for a defined period or are associated with terminated personnel, completed projects, or retired systems. Automation typically scans authentication logs to…

    How to test + evidence

    Testing procedure: Accounts inactive for >90 days are flagged and disabled.

    Evidence to collect: Inactivity report.