AC-9 is one sentence long. Notify the user, upon successful logon, of the date and time of the last logon. The point, as the guidance puts it, is that the person can notice when the time shown does not match their own last access.
800-53 binds federal systems and, by contract, some suppliers. For other teams it is a reference you can borrow from, and this is one of the cheaper controls to meet.
What it means in practice
After a user signs in, the interface says something like "Last sign in: 14 October, 09:12 UTC". If that was not you, you report it. That is the whole mechanism.
The guidance covers human interfaces and other architectures where access occurs. The enhancements go further: AC-9.1 Unsuccessful Logons, AC-9.2 Successful and Unsuccessful Logons, AC-9.3 Notification of Account Changes, and AC-9.4 Additional Logon Information.
Evidence to collect
- A screenshot or recording of the post logon message in the production interface.
- The setting or code path that produces it.
- For privileged systems, the same evidence for administrator consoles.
Common gaps
- The data is recorded in logs but never shown to the user.
- The message exists for the web app but not for the admin console or SSH.
How to implement it
Store the last successful sign in per account, and render it on the first screen after login. If you can add failed attempt counts, that covers AC-9.1 as well.
Quick check
Does AC-9 require showing failed attempts?
Not in the base control. Failed attempts are the subject of enhancement AC-9.1.
Sources
- NIST SP 800-53 Rev 5, AC-9: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-9
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
