IA.2.080 — Prevent reuse of identifiers

What IA.2.080 means in plain English

Once a user account is deleted or disabled, you must never give that same username or employee ID to a new person. If John Smith (jsmith) leaves, the next employee cannot be assigned "jsmith" even if their name is Jane Smith. This prevents audit logs from being ambiguous — every action recorded under an ID should permanently link back to one specific person. For your 8-person team, this is straightforward: keep a simple spreadsheet of all usernames ever assigned, even for people who have left, and check it before creating new accounts.

The assessment question

“Is there a documented process ensuring that identifiers (usernames, employee IDs, device names) are never reassigned to a different user or device after being retired?”

How to implement IA.2.080

1. Create and maintain a "Username Registry" spreadsheet listing every username ever assigned, the person it was assigned to, their start date, and end date if applicable.
2. When creating new accounts, consult the registry and verify the proposed username has never been previously assigned.
3. Configure Azure AD to retain disabled account records — do not permanently delete accounts for at least 90 days so audit trails remain intact.
4. Establish a naming convention that includes a numeric suffix (jsmith1, jsmith2) to handle natural name collisions without reuse.
5. Include identifier non-reuse as a checklist item in your employee offboarding procedure.

Evidence your assessor will ask for

• Username registry spreadsheet showing historical assignments with dates
• Account creation procedure document referencing registry check step
• Azure AD deleted users list showing deactivated accounts retained for audit
• Offboarding checklist with identifier retirement step included

More Identification & Authentication controls