NIST 800-53 AC-12 Session Termination and Timeouts

AC-12 asks that user sessions end automatically after conditions you define. It is the control behind idle timeouts in web apps and admin consoles.

800-53 binds federal systems and, through contract, some others. As a reference, it is a handy yardstick for session handling in any product.

What it means in practice

The guidance separates this from SC-10, which handles network disconnects. AC-12 is about logical sessions: the period from when a user, or a process acting for them, accesses a system. Ending the session ends all processes tied to it, except those the user deliberately set to keep running.

Trigger events named in the guidance include periods of inactivity, targeted responses to certain incidents, and time of day limits on use.

Three enhancements add to this: AC-12.1 User initiated Logouts, AC-12.2 Termination Message and AC-12.3 Timeout Warning Message.

Evidence to collect

• The timeout values by system, with the reason for each.
• Configuration from the identity provider and the applications.
• A test result showing a session ending after the idle period.
• Evidence of a working logout button that invalidates the session server side.

Common gaps

• Tokens that stay valid after logout.
• Long lived sessions on admin tools.
• Timeouts only on the front end, with the server still accepting the token.

How to implement it

Set idle and absolute timeouts on the server. Make logout revoke the session, not just clear a cookie. Shorter values for privileged consoles are easy to justify. If users lose work, add a warning before expiry, which is what AC-12.3 describes.

Quick check

Sources

• NIST SP 800-53 Rev 5, AC-12: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-12
• NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json