AC-12(1)

Requirement

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].

Discussion

Information resources to which users gain access via authentication include local workstations, databases, and password-protected websites or web-based services.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing session termination; user logout messages; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: System session termination mechanisms; logout capabilities for user-initiated communications sessions].

ID	Assessment Objectives
AC-12(01)	a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to <AC-12(01)_ODP information resources>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!