SC-23(1)

SC-23(1): Invalidate Session Identifiers at Logout

Invalidate session identifiers upon user logout or other session termination.

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.

Overlays
DAF Baseline

CSF Categories
None

The controls below (if any) were marked by NIST as being related to SC-23(1).

Control	Description
No controls

The controls below (if any) add on to the requirements of SC-23(1).

Control	Description
No controls

The CCIs below are tied to SC-23(1).

CCI	Definition
CCI-001185	Invalidate session identifiers upon user logout or other session termination.