Review system documentation to obtain the organization's definition of circumstances requiring automatic session termination. If the documentation explicitly states that such termination is not required or is prohibited, this is not a finding. Determine the situations where a user must reauthenticate. Check if the mechanisms that handle such situations use the following SQL: To make a single user reauthenticate, an existing connection must be present: To search for a specific user: SELECT * FROM information_schema.PROCESSLIST where user ='<name> and host like '%'; To review all connections: SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST; Note the ID(s) (processlist_id) of the connection(s) for the user that must reauthenticate. To make a user reauthenticate, run the following for each ID returned above (as they can have multiple connections). KILL CONNECTION processslist_id; If the provided SQL does not force reauthentication, this is a finding.