SC-23(1)

SC-23(1): Invalidate Session Identifiers at Logout

The information system invalidates session identifiers upon user logout or other session termination.

This control enhancement curtails the ability of adversaries from capturing and continuing to employ previously valid session IDs.

Overlays
None

CSF Categories
None

The controls below (if any) were marked by NIST as being related to SC-23(1).

Control	Description
No controls

The controls below (if any) add on to the requirements of SC-23(1).

Control	Description
No controls

The CCIs below are tied to SC-23(1).

CCI	Definition
CCI-001185	Invalidate session identifiers upon user logout or other session termination.