AC.L2-3.1.11
Session Termination
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.11 in the reference catalog with its NIST cross-references
Official requirement
Terminate (automatically) a user session after a defined condition.
Assessment objectives
a. conditions requiring a user session to terminate are defined; and
b. a user session is automatically terminated after any of the defined conditions occur.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
End sessions automatically when the organization-defined conditions occur.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage systems containing CUI for your organization and configure the system to terminate all user sessions after 1 hour of inactivity [a]. As the session timeout approaches, the system prompts users with a warning banner asking if they want to continue the session. When the session timeout does occur, the login page pops up, and the users mu st log in to start a new session [b]. Example 2 A user is logged into a corporate database containing CUI but is not authorized to view CUI. The user has submitted a series of queries that unintentionally violate policy, as they attempt to extract CUI that the user is not authorized to view [a]. The session terminates with a warning as a result of a violation of corporate policy [b]. The user must reestablish the session before being able to submit additional legitimate queries.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing session termination; system design documentation; system security plan; system configuration settings and associated documentation; list of conditions or trigger events requiring session disconnect; system audit logs and records; other relevant documents or records
Common mistakes
Treating screen locking as session termination.