# AC-12 Session Termination

NIST SP 800-53 control. Family: AC Access Control. Function: preventative. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].
Guidance: Session termination addresses the termination of user-initiated logical sessions (in contrast to SC-10, which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.

## Enhancements (3)
- AC-12(01) User-initiated Logouts
- AC-12(02) Termination Message
- AC-12(03) Timeout Warning Message
Each enhancement's statement: /api/v1/controls/AC-12?fields=enhancements

## Patterns that use it (10)
- Critical (1): SP-032 Modern Authentication
- Important (7): SP-001 Client Module; SP-002 Server Module; SP-008 Public Web Server Pattern; SP-029 Zero Trust Architecture; SP-030 API Security; SP-033 Passkey Authentication; SP-037 Privileged User Management
- Standard (2): SP-016 DMZ Module; SP-019 Secure Ad-Hoc File Exchange Pattern

## Clauses by framework (42 frameworks)
- iso_27002_2022: 5.15
- cobit_2019: DSS05
- nist_csf_2: PR.AA-03
- nis2: Art. 21(2)(i)
- mas_trm: 9
- bsi_grundschutz: ORP.4
- anssi: Hygiene.12, SecNumCloud.10.6
- osfi_b13: B-13.3.2
- finma_circular: IV.B.d(59), IV.C(61)
- gdpr: Art.32(1)(b)
- dora: Art.9(4)(c)
- bio2: 5.15
- rbi_csf: Annex1.8
- fisc: FISC.T2
- hkma_tme1: TME1.8.4
- mlps_2: 8.1.3.2, 8.1.4.10
- swift_cscf: SWIFT.2.6
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bog_cisd: CISD-VIII
- bom_ctrm: 3.3
- cbe_csf: CTO-1
- cbn_csf: Part3.2
- sa_js2: JS2-7.1
- bot_cyber: Ch2.2
- eba_ict: 3.4.2
- ecb_croe: CROE.2.3.1
- hipaa_sr: §164.312(a)(2)(iii)
- iosco_cyber: PROT-1
- sebi_cscrf: PR.AA
- cmmc_2: AC
- ieee_1686: 5.8
- common_criteria: CC Part 2 — FRU/FTA/FTP
- fda_21_cfr_11: §11.10(d), §11.200(a)(1)(i)
- hitrust_csf: 01.c
- iso_27799: 9.4
- lloyds_ms: MS8.3
- solvency_ii: EIOPA-ICT-4.4
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/AC-12
- Clauses only: /api/v1/controls/AC-12?fields=mappings
- Page for people: /controls/ac-12/