SC-23(1)

Requirement

Invalidate session identifiers upon user logout or other session termination.

Discussion

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing session authenticity; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing session identifier invalidation upon session termination].

ID	Assessment Objectives
SC-23(01)	session identifiers are invalidated upon user logout or other session termination.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!