4. Control Weakness over Removal of Users Inactive for Greater Than 60 Days (NCUA-IT-18-03). We noted weaknesses with the NCUA GSS control over the removal of users inactive for greater than 60 days where the NCUA management did not provide evidence justifying the retention of forty-nine Active Directory user accounts that were identified to be disabled and inactive for greater than 60 days. Due to management oversight, the NCUA management did not enforce and ensure that the information system manager reviews system accounts on a periodic basis to identify and delete accounts that have been inactive for greater than 60 days.