CMMCpedia
Work with me

Requirements / Access Control (AC)

AC.L2-3.1.11

Session Termination

Official Source Material

SPRS score value
1 point.
POA&M eligibility
Eligible at a conditional assessment.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Terminate (automatically) a user session after a defined condition.

Determine if:

  1. [a] conditions requiring a user session to terminate are defined; and
  2. [b] a user session is automatically terminated after any of the defined conditions occur.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Define termination conditions you can actually execute.

Objective [a] leaves the conditions to you: user logoff, account disablement, a scheduled restart, a policy violation, a time-of-day cutoff. NIST SP 800-171 Revision 2 mandates no inactivity timeout for this requirement. Choose conditions your systems genuinely enforce and write them in the system security plan, because [b] is assessed against your own definition.

Simple definitions are defensible.

One complete answer defines two conditions: sessions end when the user logs off and when the account is disabled. A weekly forced restart is another: it terminates every session on a schedule and doubles as update hygiene. The trap is not modesty. It is defining a condition, such as a nightly logoff script, that turns out not to run everywhere you claimed.

This is the logical session, not the network connection.

SC.L2-3.13.9 handles terminating network connections. A VPN client disconnecting after twelve hours is a network event. This requirement is about ending the user's logical session, the thing that logoff, disablement, and restart end. Keeping the two straight avoids answering the wrong requirement with the right evidence.

Do not punish users with aggressive idle logoffs.

A short idle logoff on ordinary workstations disrupts work without a compliance payoff, since the requirement names no timeout. Save tight idle termination for virtual desktops (VDI), shared machines, and high-exposure systems where it earns its cost.

Edge cases

  • NIST SP 800-171 Revision 3 makes the inactivity trigger an organization-defined parameter, and DoD's parameter selections cap it at 24 hours for this requirement. Assessments under Revision 2 do not apply it, but where adopting an inactivity condition costs you nothing, choosing one inside that bound saves rework later.

Over-engineering

  • A session management gateway bought for a handful of users. The sign-out and timeout settings in your operating system and your cloud applications carry [b].
  • A termination condition for every event you can imagine. Define the few conditions you can enforce and show, such as sign-out, idle timeout, and a disabled account.