AC-09 Previous Logon Notification
Access Control
Description
Notify the user, upon successful logon to the system, of the date and time of the last logon.
Supplemental Guidance
Previous logon notification is applicable to system access via human user interfaces and access to systems that occurs in other types of architectures. Information about the last successful logon allows the user to recognize if the date and time provided is not consistent with the user’s last access.
Enhancements (4)
What NIST adds to this control. Select one to read its statement.
AC-09(01) Unsuccessful Logons
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
AC-09(02) Successful and Unsuccessful Logons
Notify the user, upon successful logon, of the number of [Selection (one): successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].
AC-09(03) Notification of Account Changes
Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters of the user’s account] during [Assignment: organization-defined time period].
AC-09(04) Additional Logon Information
Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information].
Patterns that use this control (2)
Grouped by the emphasis each pattern gives it.