AC-12(2)

Requirement

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Discussion

Logout messages for web access can be displayed after authenticated sessions have been terminated. However, for certain types of sessions, including file transfer protocol (FTP) sessions, systems typically send logout messages as final messages prior to terminating sessions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing session termination; user logout messages; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: System session termination mechanisms; display of logout messages].

ID	Assessment Objectives
AC-12(02)	an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!