AC-10 Concurrent Session Control
All changes in this version
Title
Concurrent Session Control
Control
Limit the number of concurrent sessions for each [Assignment: account and/or account types] to [Assignment: number].
Discussion
Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts.
Parameters
ac-10_odp.01: account and/or account types
ac-10_odp.02: number
Related controls
sc-23
Assessment objective
AC-10 the number of concurrent sessions for each [Assignment: account and/or account types] is limited to [Assignment: number].
STIG rules that implement this control 6
Application Security and Development V6R5
- APSC-DV-000010 CAT II The application must provide a capability to limit the number of logon sessions per user.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-412020 CAT III Ubuntu 22.04 LTS must limit the number of concurrent sessions to ten for all accounts and/or account types.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-200000 CAT III Ubuntu 24.04 LTS must limit the number of concurrent sessions to 10 for all accounts and/or account types.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-000010 CAT II The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600475 CAT III RHEL 10 must limit the number of concurrent sessions to 10 for all accounts and/or account types.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-412040 CAT III RHEL 9 must limit the number of concurrent sessions to ten for all accounts and/or account types.