AC-10 Concurrent Session Control
Guidance: nonePolicy clause: draftWhat these mean
ac10ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| High | System | None |
Related controls: SC-23
Control statement
Section titled “Control statement”Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account types] to [Assignment: organization-defined number].
NIST discussion
Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for AC-10
Determine if the number of concurrent sessions for each [Assignment: organization-defined account and/or account types] is limited to [Assignment: organization-defined number].
Examine: Access control policy; procedures addressing concurrent session control; system design documentation; system configuration settings and associated documentation; security plan; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: Mechanisms implementing access control policy for concurrent session control.
Policy statement
- The System owner shall ensure the system limits the number of concurrent sessions for Fill in: accounts and/or account types for which to limit the number of concurrent sessions Typical: privileged accounts to Fill in: the number of concurrent sessions to be allowed for each account and/or account type Typical: one. (AC-10)
From the Access Control Policy template (draft). Highlighted fields are values your organization sets.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.