03.01.11 Session Termination

Statement

Terminate a user session automatically after {{ insert: param, A.03.01.11.ODP.01 }}.

Guidance

This requirement addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., disconnecting from the network) in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.09)03.13.09. A logical session is initiated whenever a user (or processes acting on behalf of a user) accesses a system. Logical sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination ends all system processes associated with a user’s logical session except those processes that are created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic session termination can include organization-defined periods of user inactivity, time-of-day restrictions on system use, and targeted responses to certain types of incidents.

Assessment objective

a user session is terminated automatically after {{ insert: param, A.03.01.11.ODP.01 }}.

Assessment method

• access control policy and procedures procedures for session termination system design documentation system configuration settings list of conditions or trigger events requiring session disconnect system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• automated mechanisms for implementing user session termination

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final