Session Management
What is Session Management?
The process of handling user sessions securely, including session creation, token generation, timeout enforcement, and proper session termination.
Terms that appear alongside session management
Each of these is named in at least one of the same controls as session management. The number is how many controls name both.
- authentication 11 shared controls
- access control 6 shared controls
- nist 6 shared controls
- least privilege 5 shared controls
- separation of duties 4 shared controls
- authorization 4 shared controls
- owasp 3 shared controls
- multi factor authentication 3 shared controls
Frameworks that govern session management
What the standards actually require on session management
Requirements naming session management across 6 standards, quoted from the control text.
System and network session management: at every level, inactive sessions are terminated after a defined period of inactivity.
mtcs-singapore::14.7 · System and network session management →Per OWASP ASVS V3: implement secure session management. Requirements include (a) generate cryptographically random session tokens of sufficient entropy + (b) protect tokens against session fixation + replay + theft + (c) implement secure cookie attributes (Sec...
OWASPASVS-3 · Session Management (V3) →Session management controls. Implements CyFun PR.AC-7 / PR.PT-4: sessions are authenticated and managed to protect confidentiality and integrity.
BE-CF-11 · Session management controls →Protect interactions with the service using session management that meets at least the current state of the art and withstands known attacks, and invalidate a session once detected as inactive using a timeout configurable by the provider or, where technically...
C5-PSS-06 · Session Management →Operate cross-cutting controls per NIST SP 800-63-4. Identity service operational audit per Volume B Chapter 10: continuous audit of authentication events + identity proofing decisions + federation assertions + administrative actions with retention aligned to...
NISTSP63R4-8 · Operational Audit, Session Management, Recovery, and Cross-cutting Controls →The plan must require consistent criteria for the security boundaries that scope nonlocal access controls, management of every nonlocal access method and of access approvals, handling of consecutive authentication failures per the risk strategy, manual and aut...
api-1164::PR.AC-3 · PR.AC-3 Nonlocal access managed: boundaries, approvals, failed logons, session control, emergency access and log retention →Questions people ask about session management
What is Session Management?
Why is Session Management important for compliance?
Which compliance frameworks address Session Management?
Where can I learn more about Session Management?
See how Session Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.