| If the organization has a policy, consistently enforced, forbidding the creation of emergency or temporary accounts, this is not a finding. |
Check DBMS settings, OS settings, and/or enterprise-level authentication/access mechanisms settings to determine if emergency accounts are being automatically terminated by the system after an organization-defined time period. Check also for custom code (scheduled jobs, procedures, triggers, etc.) for achieving this.
If emergency accounts are not being terminated after an organization-defined time period, this is a finding.