AC-12 · Session Termination

Control Description

Automatically terminate a user session after {{ insert: param, ac-12_odp }}.

Impact Baselines
Security baselines where this control applies
Not in any baseline
Control Properties
SP800-53
system
Control Statement
The control requirements

Automatically terminate a user session after {{ insert: param, ac-12_odp }}.

Supplemental Guidance

Session termination addresses the termination of user-initiated logical sessions (in contrast to [SC-10](#sc-10) , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.

Related NIST Controls
Other NIST 800-53 controls related to this one