AC.2.011 — Terminate Sessions After Defined Conditions

CMMC Level 2SPRS if unmet: -1LOW priority~4h to implement

Terminate (automatically) a user session after a defined condition.

What AC.2.011 means in plain English

Your systems should automatically end a user's session after a defined period of inactivity — not just lock the screen, but actually log them out or disconnect the session. This is especially important for remote access (like VPN or Remote Desktop) where a forgotten connected session could stay open indefinitely and be exploited.

The assessment question

“Are remote access sessions (VPN, Remote Desktop, web portals) automatically terminated after a defined period of inactivity, and is there a documented policy specifying these timeout conditions?”

How to implement AC.2.011

For Remote Desktop Protocol (RDP) connections: open Group Policy editor (gpedit.msc) > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits. Set "Set time limit for disconnected sessions" to 1 hour and "End session when time limits are reached" to Enabled.
For Microsoft 365 web sessions: in Microsoft Entra ID Conditional Access, configure a session policy that signs out users after a defined period of inactivity (requires Microsoft Entra ID P1 license).
For VPN sessions, check your VPN provider's admin console for idle-session timeout settings. Most commercial VPNs (Cisco AnyConnect, OpenVPN, etc.) have configurable idle timeouts — set to 30 minutes.
For web application portals, configure session timeout in the application settings. Most modern web applications have idle session timeout in their settings or admin panel.
Document the defined conditions: create a one-page policy stating the specific timeout values for each system type (workstation lock: 10 minutes, RDP disconnect: 1 hour, VPN idle: 30 minutes, web portal: 30 minutes).

Evidence your assessor will ask for

Group Policy screenshot showing RDP session timeout configured
VPN admin console screenshot showing idle session timeout value
Microsoft Entra Conditional Access session policy screenshot (if applicable)
Written policy document specifying session termination conditions for each system

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.011 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control