id: "AC-12(02)" title: "Termination Message" family: "AC" family_name: "Access Control" sort_id: "ac-12.02" priority: "P1" implementation_level: "system" parent: "AC-12" enhancement: True
Statement
Display an explicit logout message to users indicating the termination of authenticated communications sessions.
Guidance
Logout messages for web access can be displayed after authenticated sessions have been terminated. However, for certain types of sessions, including file transfer protocol (FTP) sessions, systems typically send logout messages as final messages prior to terminating sessions.
Assessment Objective
an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.
Access control policy
procedures addressing session termination
user logout messages
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developers
System session termination mechanisms
display of logout messages