AC-9 Previous Logon Notification
Review AC-9
1. Set its parameters
No parameters to set for AC-9.
2. Record its status
Notify the user, upon successful logon to the system, of the date and time of the last logon.
Discussion
Previous logon notification is applicable to system access via human user interfaces and access to systems that occurs in other types of architectures. Information about the last successful logon allows the user to recognize if the date and time provided is not consistent with the user’s last access.
Enhancements
Review AC-9(1)
1. Set its parameters
No parameters to set for AC-9(1).
2. Record its status
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Discussion
Information about the number of unsuccessful logon attempts since the last successful logon allows the user to recognize if the number of unsuccessful logon attempts is consistent with the user’s actual logon attempts.
Review AC-9(2)
1. Set its parameters
No parameters to set for AC-9(2).
2. Record its status
Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].
Discussion
Information about the number of successful and unsuccessful logon attempts within a specified time period allows the user to recognize if the number and type of logon attempts are consistent with the user’s actual logon attempts.
Review AC-9(3)
1. Set its parameters
No parameters to set for AC-9(3).
2. Record its status
Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters] during [Assignment: organization-defined time period].
Discussion
Information about changes to security-related account characteristics within a specified time period allows users to recognize if changes were made without their knowledge.
Review AC-9(4)
1. Set its parameters
No parameters to set for AC-9(4).
2. Record its status
Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information].
Discussion
Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
* does not fully satisfy the intent of this control (per NIST's mapping notes).