id: "AC-12(02)" title: "Termination Message" family: "AC" family_name: "Access Control" sort_id: "ac-12.02" priority: "P1" implementation_level: "system" parent: "AC-12" enhancement: True


Statement

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Guidance

Logout messages for web access can be displayed after authenticated sessions have been terminated. However, for certain types of sessions, including file transfer protocol (FTP) sessions, systems typically send logout messages as final messages prior to terminating sessions.

Assessment Objective

an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.

Access control policy

procedures addressing session termination

user logout messages

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developers

System session termination mechanisms

display of logout messages