AC-10 Concurrent Session Control. Limit the number of concurrent sessions for each [organization-defined] to [organization-defined]
Concurrent Session Control. Limit the number of concurrent sessions for each [organization-defined] to [organization-defined].
4
artefacts
1
held by a system
2
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- System configuration setting that enforces the session count limit, exported from the identity or application platform · Identity provider / directory
periodic reviewEvidence produced at each review
- Log or screenshot of an attempted session beyond the limit being refused or the oldest session terminated · Identity provider / directory
- Record of who approved the limit and on what basis, such as licence model or account sensitivity · Identity provider / directory
governing documentDocuments that govern the control
- Defined limit on concurrent sessions per account type, and the account types it applies to · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Limit written into the security plan but never configured in the platform that issues sessions
- Enforcement applied to interactive logon only while API tokens and service sessions are uncounted
- Privileged accounts left unlimited on the argument that administrators need flexibility
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC-9 Previous Logon Notification. Notify the user, upon successful logon to the system, of the date and time of the last logon · AC-11 Device lock