Navigate

AC-9

AC-9: Previous Logon (access) Notification

The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).

Supplemental

This control is applicable to logons to information systems via human user interfaces and logons to systems that occur in other types of architectures (e.g., service-oriented architectures).

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Int-A, Int-B, Int-C

CSF Categories
PR.AC-7

Related Controls

The controls below (if any) were marked by NIST as being related to AC-9.

Control	Description
AC-7	The information system: a: Enforces a limit of [organization-defined number] consecutive invalid logon attempts by a user during a [organization-defined time period]; and b: Automatically [] when the maximum number of unsuccessful attempts is exceeded.
PL-4	The organization: a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; c: Reviews and updates the rules of behavior [organization-defined frequency]; and d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.

Control

Description

AC-7

The information system:

a: Enforces a limit of [organization-defined number] consecutive invalid logon attempts by a user during a [organization-defined time period]; and

b: Automatically [] when the maximum number of unsuccessful attempts is exceeded.

PL-4

The organization:

a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

c: Reviews and updates the rules of behavior [organization-defined frequency]; and

d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.

Enhancements

The controls below (if any) add on to the requirements of AC-9.

Control	Description
AC-9(1)	The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
AC-9(2)	The information system notifies the user of the number of [] during [organization-defined time period].
AC-9(3)	The information system notifies the user of changes to [organization-defined security-related characteristics/parameters of the user’s account] during [organization-defined time period].
AC-9(4)	The information system notifies the user, upon successful logon (access), of the following additional information: [organization-defined information to be included in addition to the date and time of the last logon (access)].

Related CCIs

The CCIs below are tied to AC-9.

CCI	Definition
CCI-000052	Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).