HOME

AC-10

AC-10 H M
Description

The information system limits the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number].

FedRAMP
  • H AC-10-2 [three (3) sessions for privileged access and two (2) sessions for non-privileged access]
  • M AC-10-2 [three (3) sessions for privileged access and two (2) sessions for non-privileged access]
DISA Cloud Computing SRG

all account types and/or accounts

Not appropriate for DoD to define for all CSP's infrastructure or service offerings

Source:
DoD RMF TAG

Supplemental Guidance

Organizations may define the maximum number of concurrent sessions for information system accounts globally, by account type (e.g., privileged user, non-privileged user, domain, specific application), by account, or a combination. For example, organizations may limit the number of concurrent sessions for system administrators or individuals working in particularly sensitive domains or mission-critical applications. This control addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts.

Control Enhancements: None.

References: None.