AC-9 Previous Logon Notification. Notify the user, upon successful logon to the system, of the date and time of the last logon
Previous Logon Notification. Notify the user, upon successful logon to the system, of the date and time of the last logon.
4
artefacts
1
held by a system
2
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration enabling display of last logon date and time on successful logon · Identity provider / directory
periodic reviewEvidence produced at each review
- Screenshot of the notification a user actually sees at logon · Identity provider / directory
- Evidence the notification is presented on each access path where the control is claimed · Identity provider / directory
governing documentDocuments that govern the control
- Procedure telling users what to do when the previous logon shown is not theirs, and where that report goes · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Data is captured in logs but never surfaced to the user, which is the point of the control
- Notification shown at console logon only while federated and single sign on paths show nothing
- No reporting route defined, so a user who spots an unfamiliar logon has nowhere to raise it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC-8 System Use Notification. Display [organization-defined] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that: · AC-10 Concurrent Session Control. Limit the number of concurrent sessions for each [organization-defined] to [organization-defined]