Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- CFG-04.5_A01 conditions requiring a user session to terminate are defined.
Assessment rigor: 1
Origin: 171A_3.1.11[a] - CFG-04.5_A02 conditions or trigger events that require session disconnect are defined.
Assessment rigor: 1
Origin: 171A_3.1.11[b] 171A_R3_A.03.01.11.ODP[01] 53A_R5_AC-12_ODP - CFG-04.5_A03 a user session is automatically terminated after any of the defined conditions occur.
Assessment rigor: 1
Origin: 53A_R5_AC-12 171A_3.1.11[b] - CFG-04.5_A04 the time period of expected inactivity requiring users to log out of the system is defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.01.01.ODP[05] - CFG-04.5_A05 circumstances requiring users to log out of the system are defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.01.01.ODP[06] - CFG-04.5_A06 users are required to log out of the system after <A.03.01.01.ODP[05]: time period> of expected inactivity or when the following circumstances occur: <A.03.01.01.ODP[06]: circumstances>.
Defined parameters: SDP values: [05] - at most 24 hours [06] - the work period ends, for privileged users at a minimum
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.01.01.h - CFG-04.5_A07 session connections are terminated when nonlocal maintenance is completed.
Assessment rigor: 2
Origin: 171A_R3_A.03.07.05.c[01] - CFG-04.5_A08 a user session is terminated automatically after <A.03.01.11.ODP[01]: conditions or trigger events>.
Defined parameters: a specified duration (maximum of 24 hours) of inactivity, misbehavior (end the session due to an attempted policy violation), and maintenance (terminate sessions to prevent issues with an upgrade or service outage)
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.01.11
Linkitetyt tehtävät
| Linkin tyyppi | Tehtävä |
|---|---|
| blocks | Session Termination |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.