AC-10 says to limit the number of concurrent sessions for each account type, and to define the number yourself. NIST leaves the value open. You choose it and document why.
800-53 binds federal systems and, through contract, other organizations. Everyone else can use it as a reference when a customer asks how you handle shared or stolen credentials.
What it means in practice
The guidance says you can set limits globally, by account type, by account, or any mix. A common example is capping administrators at one session. It also notes a boundary: the control covers sessions per account, not one person using several accounts.
Evidence to collect
- The documented limit, by account type.
- The configuration that enforces it, such as an identity provider or application setting.
- A test showing the next session is refused or the oldest one ends.
Common gaps
- A policy number that nothing enforces.
- Limits on end users but none on admin or service accounts.
- People holding several accounts to get around the cap.
How to implement it
Start with privileged accounts, where the risk is highest. Set the limit, test it, and write the value down. Review it with your regular account review.
Quick check
Does AC-10 stop one person using two accounts?
No. The guidance says it addresses sessions per account, not several accounts held by a single user.
Sources
- NIST SP 800-53 Rev 5, AC-10: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-10
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
