Session Termination AC-12

Access Control · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-12 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-12 (Session Termination) is about automatically ending a user session after conditions you define — things like a stretch of inactivity, a maximum session length, or a time-of-day cutoff. It is different from locking the screen (AC-11, which only hides an active session): termination actually closes the session, so an abandoned or hijacked connection cannot simply be picked back up. AC-12 enters at the Moderate baseline.

What good looks like

Write down the trigger events that should end a session — for example, an idle period, a maximum session length, or a time-of-day cutoff — so the rule is deliberate, not accidental.
Terminate idle sessions automatically, don’t just lock them — a terminated session cannot be resumed by someone who wanders up to an unattended keyboard.
Cover both local shells and remote logins over SSH (Secure Shell — the encrypted way you connect to the server), since a forgotten SSH session is a common way in.
When a session ends, make sure it is fully closed — the connection is dropped and any privileges released, not merely blanked.
Where it fits, give people a clear logout capability and, if useful, a short warning before timeout (enhancements AC-12(1) and AC-12(3)).

Framework mapping

NIST CSF 2.0 — PR.AA-03 — Users, services, and hardware are authenticated
CIS Controls v8 — Control 4 — Configure Automatic Session Locking on Enterprise Assets (Safeguard 4.3)

How to move it toward Implemented

Set an SSH idle timeout: in /etc/ssh/sshd_config set ClientAliveInterval 300 and ClientAliveCountMax 0, then reload with sudo systemctl reload sshd (on Debian/Ubuntu the service is ssh) — this ends an idle SSH session after five minutes.
Auto-logout idle local shells: create /etc/profile.d/tmout.sh containing readonly TMOUT=600; export TMOUT (TMOUT is the shell’s idle-timeout variable, in seconds) — an idle shell then ends after ten minutes.
Verify both settings: run sudo sshd -T | grep -i clientalive to confirm the SSH values, and open a fresh login shell and run echo $TMOUT to confirm the shell timeout.
Attach the sshd_config change and the tmout.sh file, together with that verification output, as hardening evidence on the asset, naming AC-12 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.