+AC-02(05) Inactivity Logout

AC-02(05) Inactivity Logout

Control

Require that users log out when [Assignement: time period of expected inactivity or description of when to log out].

Discussion

Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [AC-11](#ac-11).

Assessment Objective

users are required to log out when [Assignement: time period of expected inactivity or description of when to log out].

Assessment Method

Examine

Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation security violation reports system audit records system security plan other relevant documents or records

Interview

Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities users that must comply with inactivity logout policy

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by AC-02(05) Inactivity Logout – Assessment Procedure
is blocked by Session Lock