The application must generate audit records showing starting and ending time for user access to the system.

Knowing when a user’s application session began and when it ended is critical information that aids in forensic analysis.

Review and monitor the application logs.

Initiate a user session and observe if the log includes a time stamp showing the start of the session.

Terminate the user session and observe if the log includes a time stamp showing the end of the session.

If the start and the end time of the session are not recorded in the logs, this is a finding.

Configure the application or application server to record the start and end time of user session activity.