AC.L2-3.1.11  

Reference: CMMC 2.11

Family: AC

Level Introduced: 2

Title: Session Termination

Practice:
Terminate (automatically) user sessions after a defined condition.

CMMC Clarification:
This practice may require security policy development if it does not exist. Configure the system to end user sessions based on the organization's policy. Policy guidance for session termination usually includes circumstances, events, or specific triggers that require automatically terminating the session or logging off the user. If there is no automatic control of user sessions, an attacker can take advantage of an unattended session.

Example 1
You are the system administrator for your organization and were given the task to implement the termination of all user sessions after 1 hour of inactivity. As the session timeout approaches, the system prompts users with a warning banner asking if they want to continue the session. When the session timeout does occur, the login page pops-up and the users must login to start a new session.

Example 2
You are logged into a corporate database containing CUI, but you are not authorized to view CUI. You have submitted a series of complex queries that violate policy, as they appear to be an attempt to extract CUI you are not authorized to view. Your session is terminated as a result of what appears to be a large query set attack, a violation of corporate policy. You must reestablish the session before you can submit additional legitimate queries.

Source: CMMC v2.0