Control statement
Notify the user, upon successful logon to the system, of the date and time of the last logon.
Discussion
Previous logon notification is applicable to system access via human user interfaces and access to systems that occurs in other types of architectures. Information about the last successful logon allows the user to recognize if the date and time provided is not consistent with the user’s last access.
From control text to operational evidence
Use Previous Logon Notification as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- access approvals and entitlement records
- role and group configuration exports
- periodic access review results
- authentication and authorization logs
Common failure patterns
- standing privileges that outlive business need
- shared or orphaned accounts
- access rules implemented differently across systems
- approvals that cannot be traced to actual permissions
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
the user is notified, upon successful logon to the system, of the date and time of the last logon.
Examine
- Access control policy
- procedures addressing previous logon notification
- system design documentation
- system configuration settings and associated documentation
- system notification messages
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for previous logon notification
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AC-9(1) — Unsuccessful Logons
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Official discussion
Information about the number of unsuccessful logon attempts since the last successful logon allows the user to recognize if the number of unsuccessful logon attempts is consistent with the user’s actual logon attempts.
Assessment objectives and methods
the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Examine
- Access control policy
- procedures addressing previous logon notification
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for previous logon notification
AC-9(2) — Successful and Unsuccessful Logons
Notify the user, upon successful logon, of the number of [Organization-defined: ac-09.02_odp.01] during [Organization-defined: time period].
Official discussion
Information about the number of successful and unsuccessful logon attempts within a specified time period allows the user to recognize if the number and type of logon attempts are consistent with the user’s actual logon attempts.
Organization-defined parameters (2)
Assessment objectives and methods
the user is notified, upon successful logon, of the number of [Organization-defined: ac-09.02_odp.01] during [Organization-defined: time period].
Examine
- Access control policy
- procedures addressing previous logon notification
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for previous logon notification
AC-9(3) — Notification of Account Changes
Notify the user, upon successful logon, of changes to [Organization-defined: security-related characteristics or parameters] during [Organization-defined: time period].
Official discussion
Information about changes to security-related account characteristics within a specified time period allows users to recognize if changes were made without their knowledge.
Organization-defined parameters (2)
Assessment objectives and methods
the user is notified, upon successful logon, of changes to [Organization-defined: security-related characteristics or parameters] during [Organization-defined: time period].
Examine
- Access control policy
- procedures addressing previous logon notification
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for previous logon notification
AC-9(4) — Additional Logon Information
Notify the user, upon successful logon, of the following additional information: [Organization-defined: additional information].
Official discussion
Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
Organization-defined parameters (1)
Assessment objectives and methods
the user is notified, upon successful logon, of [Organization-defined: additional information].
Examine
- Access control policy
- procedures addressing previous logon notification
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for previous logon notification
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.