Application Security and Development Security Technical Implementation Guide

The Application Security and Development Security Technical Implementation Guide (V6 R5) has 286 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

286STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R5

CurrentPublished Wed Sep 30 2026

The application must generate audit records showing starting and ending time for user access to the system.

Application Security and Development Security Technical Implementation Guide

Assessment Title

Rule Text

The application must generate audit records showing starting and ending time for user access to the system.

Description

Discussion Text

Knowing when a user’s application session began and when it ended is critical information that aids in forensic analysis.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222464

Rule

SV-222464r961830_rule

Severity

medium

Rule Version

APSC-DV-000850

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review and monitor the application logs.

Initiate a user session and observe if the log includes a time stamp showing the start of the session.

Terminate the user session and observe if the log includes a time stamp showing the end of the session.

If the start and the end time of the session are not recorded in the logs, this is a finding.

Implementation Procedure

Fix Text

Configure the application or application server to record the start and end time of user session activity.

STIG check 77 of 286 in the Application Security and Development STIG checklist

← Previous · V-222463The application must generate audit records for privileged activities or other system-level access.Next · V-222465 →The application must generate audit records when successful/unsuccessful accesses to objects occur.