AC.L2-3.1.11[a] — Access Control (Session Termination)Domain: Access Control (AC) | Practice: AC.L2-3.1.11 | Objective ID: 3.1.11[a] | Source: NIST SP 800-171 Rev. 2 / CMMC 2.0 Level 2 | Assessment Objective: Conditions requiring a user session to terminate are defined. |
Executive Summary (For Leadership and the Board)
CMMC objective AC.L2-3.1.11[a] sits inside the Access Control domain (AC.L2-3.1.11 — Session Termination) and reads: Conditions requiring a user session to terminate are defined.. Define the conditions under which sessions must be automatically terminated (e.g., after a maximum session duration, upon administrative action, network disconnection, or security event). For organizations that handle Controlled Unclassified Information (CUI), this objective is part of the foundation that every downstream control depends on.