| name | AC-9(4)_additional-logon-information |
| description | Notify the user, upon successful logon, of the following additional information: [organization-defined]. |
| category | authorization |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","ac-9-4","ac","enhancement"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | [] |
| prerequisites | ["AC-9"] |
| severity_boost | {} |
AC-9(4) Additional Logon Information
Enhancement of: AC-9
High-Level Description
Family: Access Control (AC)
Framework: NIST SP 800-53 Rev 5
Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for AC-9(4) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Check IAM policies and access controls | cloud_audit_iam_policies |
| hackbrowser-mcp | Test web application access controls | browser_auth_test |
Remediation Guide
Control Statement
Notify the user, upon successful logon, of the following additional information: [organization-defined].
Implementation Guidance
Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
