Skip to content
ControlVerdict
Sign in
AC.L2-3.1.11CMMC Level 2Level 2

Session Termination

Submit your own example

Practice statement

Terminate (automatically) a user session after a defined condition.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.11.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    conditions requiring a user session to terminate are defined; and

    1 example covers this

  2. [b]

    a user session is automatically terminated after any of the defined conditions occur.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AC.L2-3.1.11Session Termination
    Terminate (automatically) a user session after a defined condition.

    • [a]

      conditions requiring a user session to terminate are defined; and

    • [b]

      a user session is automatically terminated after any of the defined conditions occur.

    Idle and max session lifetimes on VPN and SSO

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Session Termination objectives.

    VPN. Idle disconnect ≤12 hours; absolute session lifetime forces re-auth. Concurrent sessions limited to one unless ticketed.

    SSO. IdP session lifetime for enclave apps is shorter than corporate baseline; sign-out on browser close where supported. Privileged roles already use short PIM activations.

    Maintenance. Monthly review of VPN accounts idle >45 days (disable). Quarterly test that an abandoned VPN session cannot be resumed without re-auth.

    Accepted gap. One CAD SaaS ignores IdP session length. Compensating control: Conditional Access re-eval on every sensitive action + device compliance.

    What the evidence looks like

    • VPN idle/max session configuration
    • IdP session lifetime settings for enclave apps
    • Test ticket for abandoned session re-auth
    • CAD SaaS exception with CA compensating control

    Environment

    Full-tunnel VPN for lab; SSO for SaaS CUI apps.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.