Concurrent Session Control AC-10

Access Control · High baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-10 (Concurrent Session Control) is about capping how many sessions a single account — or type of account — can have open at the same time. You pick a number, for example three interactive logins per user, and the system enforces it, so one account cannot be signed in from a dozen places at once. AC-10 appears only in the High baseline, where limiting simultaneous sessions helps contain a shared or stolen credential.

What good looks like

Pick a number. The control requires an organization-defined limit — decide how many concurrent sessions each account, or account type, may hold.
Enforce it in the login path, not just on paper — the operating system itself should refuse the session that goes over the limit.
Set tighter limits for privileged accounts than for everyday ones, matching the risk each account carries.
Count every way in — console, SSH (Secure Shell), and service logins all draw from the same cap.
Write down the number and the reason for it, and review it when roles, tooling, or workloads change.

Framework mapping

NIST CSF 2.0 — PR.AA-05 — Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

How to move it toward Implemented

Choose a limit that fits your environment — for example, 10 concurrent sessions per account — and record it in your account procedure.
Enforce it with PAM (Pluggable Authentication Modules): add a line like * hard maxlogins 10 to /etc/security/limits.conf (or a drop-in file under /etc/security/limits.d/), then confirm pam_limits.so is loaded in the session stack (/etc/pam.d/common-session on Debian or Ubuntu, or /etc/pam.d/system-auth on Red Hat Enterprise Linux).
Test the limit: open more than the allowed number of sessions for one account, confirm the extra login is refused, and save that terminal output.
Attach the config and test output as hardening evidence on the asset, naming AC-10 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.