Back to Control Explorer



Control Acronym



Access Control

CMMC Level


800-171 Control #


CMMC Description

Terminate (automatically) user sessions after a defined condition.

CMMC Clarification

This practice may require security policy development if it does not exist. Configure the system to end user sessions based on the organization's policy. Policy guidance for session termination usually includes circumstances, events, or specific triggers that require automatically terminating the session or logging off the user. If there is no automatic control of user sessions, an attacker can take advantage of an unattended session. Example 1 You are the system administrator for your organization and were given the task to implement the termination of all user sessions after 1 hour of inactivity. As the session timeout approaches, the system prompts users with a warning banner asking if they want to continue the session. When the session timeout does occur, the login page pops-up and the users must login to start a new session. Example 2 You are logged into a corporate database containing CUI, but you are not authorized to view CUI. You have submitted a series of complex queries that violate policy, as they appear to be an attempt to extract CUI you are not authorized to view. Your session is terminated as a result of what appears to be a large query set attack, a violation of corporate policy. You must reestablish the session before you can submit additional legitimate queries.

800-171 Description

Terminate (automatically) a user session after a defined condition.

800-171 Discussion

This requirement addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., disconnecting from the network). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination terminates all processes associated with a user’s logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events requiring automatic session termination can include organization-defined periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on system use.

Other Source Discussion


CIS Control References

CIS Controls v7.1 16.7, 16.11

NIST 800-53 Control Ref.

NIST SP 800-53 Rev 4 AC-12

CMMC Derived

NIST CSF Control References

NIST 800-171 References

NIST SP 800-171 Rev 1 3.1.11

Applicable FAR Clause

NIST CSF Control Reference

CERT RMM Reference

Modification of NIST 800-171B Reference

NIST 800-171B Reference

UK NCSCCyber Reference

AS ACSC Reference


Assessment Sub-Criteria 1

AC.3.019.[a] conditions requiring a user session to terminate are defined; and

Assessment Sub-Criteria 2

AC.3.019.[b] a user session is automatically terminated after any of the defined conditions occur.

Assessment Sub-Criteria 3

Assessment Sub-Criteria 4

Assessment Sub-Criteria 5

Assessment Sub-Criteria 6

Assessment Sub-Criteria 7

Assessment Sub-Criteria 8

Assessment Sub-Criteria 9

Assessment Sub-Criteria 10

Assessment Sub-Criteria 11

Assessment Sub-Criteria 12

Assessment Sub-Criteria 13

Assessment Sub-Criteria 14

Assessment Sub-Criteria 15