id: "AC-02(05)" title: "Inactivity Logout" family: "AC" family_name: "Access Control" sort_id: "ac-02.05" priority: "P1" implementation_level: "system" parent: "AC-02" enhancement: True
Statement
Require that users log out when {{ insert: param, ac-02.05_odp }}.
Guidance
Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by AC-11.
Assessment Objective
users are required to log out when {{ insert: param, ac-02.05_odp }}.
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
security violation reports
system audit records
system security plan
other relevant documents or records
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
users that must comply with inactivity logout policy