3.1.11 — End the Session
What It Says
Section titled “What It Says”Terminate (automatically) a user session after a defined condition.
What It Actually Means
Section titled “What It Actually Means”Define conditions that end a session completely:
- Inactivity — no activity for 1 hour (common threshold)
- Time of day — all sessions terminate at end of business day
- Policy violation — session killed for suspicious behavior
- Maintenance — sessions ended for system updates
Give users a warning before termination so they can save their work. When the session ends, they’re back at the login screen and must fully re-authenticate.
The difference from 3.1.10: a locked session can be resumed with just a password. A terminated session requires a full new login, including MFA.
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Are termination conditions defined? | Documented triggers — inactivity, time limit, policy violation |
| 2 | Do sessions terminate automatically? | The system enforces it, not the user |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: Access control policy, session termination procedures, system configuration, list of termination triggers, audit logs
People they’ll talk to: Sysadmins, information security staff, system developers
Live demos they’ll ask for: “Leave a session idle and show me it terminates after the defined period.”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”These are the actual questions. Have answers ready.
- “What conditions trigger automatic session termination?”
- “Are procedures documented for configuring automatic termination?”
- “Show me that sessions actually terminate after the defined conditions.”
Where Companies Trip Up
Section titled “Where Companies Trip Up”No session termination. Sessions stay active until users manually log off. Some users never log off.
Workstations but not cloud. M365 sessions staying active for days because browser tokens don’t expire.
No warning. Sessions terminated without warning — users lose unsaved work and bypass the control by finding workarounds.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.1.10 — Lock the Screen | Lock pauses; this kills the session |
| 3.13.9 — Kill Idle Network Connections | Terminating network connections after inactivity |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: AC.L2-3.1.11 | SPRS Weight: 1 point | POA&M Eligible: Yes