AC-12 Session Termination
Guidance: draftPolicy clause: draftWhat these mean
ac12ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Moderate, High | System | 3 (0 in a baseline) |
Related controls: MA-4, SC-10, SC-23
Control statement
Section titled “Control statement”Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events].
NIST discussion
Session termination addresses the termination of user-initiated logical sessions (in contrast to SC-10 , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.
Control enhancements
Section titled “Control enhancements”AC-12(1) User-initiated Logouts
Section titled “AC-12(1) User-initiated Logouts”Baselines: Not in a baseline
Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].
Discussion and assessment objectives for AC-12(1)
Information resources to which users gain access via authentication include local workstations, databases, and password-protected websites or web-based services.
Determine if a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].
Examine: Access control policy; procedures addressing session termination; user logout messages; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: System session termination mechanisms; logout capabilities for user-initiated communications sessions.
AC-12(2) Termination Message
Section titled “AC-12(2) Termination Message”Baselines: Not in a baseline
Display an explicit logout message to users indicating the termination of authenticated communications sessions.
Discussion and assessment objectives for AC-12(2)
Logout messages for web access can be displayed after authenticated sessions have been terminated. However, for certain types of sessions, including file transfer protocol (FTP) sessions, systems typically send logout messages as final messages prior to terminating sessions.
Determine if an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.
Examine: Access control policy; procedures addressing session termination; user logout messages; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: System session termination mechanisms; display of logout messages.
AC-12(3) Timeout Warning Message
Section titled “AC-12(3) Timeout Warning Message”Baselines: Not in a baseline
Display an explicit message to users indicating that the session will end in [Assignment: organization-defined time].
Discussion and assessment objectives for AC-12(3)
To increase usability, notify users of pending session termination and prompt users to continue the session. The pending session termination time period is based on the parameters defined in the AC-12 base control.
Determine if an explicit message to users is displayed indicating that the session will end in [Assignment: organization-defined time].
Examine: Access control policy; procedures addressing session termination; time until end of session messages; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: System session termination mechanisms; display of end of session time.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for AC-12
Determine if a user session is automatically terminated after [Assignment: organization-defined conditions or trigger events].
Examine: Access control policy; procedures addressing session termination; system design documentation; system configuration settings and associated documentation; list of conditions or trigger events requiring session disconnect; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: Automated mechanisms implementing user session termination.
Policy statement
- The System owner shall ensure the system automatically terminates a user session after Fill in: conditions or trigger events requiring session disconnect Typical: 30 minutes of inactivity for remote and web sessions, or at the end of the maximum session lifetime. (AC-12)
From the Access Control Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”AC-12 ends a user’s logical session automatically when a condition you set is met: a period of inactivity, a maximum session length, a time of day, or a response to an incident. It differs from two neighbors. AC-11 device lock pauses a session and keeps it open; AC-12 ends it, and the user must sign in again. SC-10 network disconnect ends the network connection; a logical session can end while the connection stays up, and the reverse.
Common implementations. Inactivity and maximum session lifetime settings at the identity provider and in each web application, so both the single sign-on session and the application’s own session end. Idle and session limits on the VPN or zero trust access service and on remote desktop and virtual desktop gateways. Idle timeouts on administrator shells and database consoles. Applications that invalidate the session identifier when the session ends, as SC-23(1) describes (in no baseline, but a common way to support SC-23 session authenticity). The Identification and Authentication policy makes a session timeout one of the triggers for re-authentication under IA-11.
NIST SP 800-63B-4 (July 2025, final as of September 2026) gives session limits by authentication assurance level. At AAL2, the overall timeout should be no more than 24 hours and the inactivity timeout no more than 1 hour (Sec. 2.2.3). At AAL3, the overall timeout shall be no more than 12 hours, and the inactivity timeout should be no more than 15 minutes (Sec. 2.3.3). The typical 30-minute inactivity value below fits AAL2; an application that requires AAL3 needs the shorter limit.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Conditions or trigger events that end a session | 30 minutes of inactivity for remote and web sessions, or the end of the maximum session lifetime |
The same 30 minutes is the typical network disconnect period in the System and Communications Protection policy (SC-10), so the session and the connection end together.
Evidence assessors ask for.
- Session settings from the identity provider, the remote access service and each application: inactivity timeout and maximum session lifetime
- A demonstration: the assessor leaves a session idle past the limit and confirms the next action requires signing in again
- Idle timeout settings on administrator shells, consoles and remote desktop sessions
- The system security plan entry stating the conditions that end a session
Inheritance. Identity provider and remote access session limits are usually common controls. Each application still owns its own session handling: a short identity provider session does not end an application session that the application keeps alive with its own cookie. AC-12 is almost always a hybrid control.
Common findings.
- Web applications with sessions that never expire, or that refresh their own tokens indefinitely.
- Timeouts set at the identity provider but not in the application, or the reverse.
- Remote desktop or virtual desktop sessions left disconnected but running for days.
- Administrator shells and database consoles with no idle timeout.
Enhancements in the Moderate baseline. None. AC-12’s enhancements, AC-12(1) to AC-12(3), are in no baseline.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.