Checks

Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Maximum Okta global session idle time to 15 minutes or less.

Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Threshold override: okta_max_session_idle_minutes. Aligns with DISA STIG V-273186.

Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Maximum Okta global session lifetime to 18 hours or less.

Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Threshold override: okta_max_session_lifetime_minutes (minutes). Aligns with DISA STIG V-273203.

Every active Okta Global Session Policy must apply the IF User's IP is condition, mapped to a Network Zone, on its Priority 1 active rule.

Unlike the idle / lifetime / cookie STIGs, this control does not exclude the built-in Default Rule. Okta evaluates policies by group assignment. Aligns with DISA STIG V-279691.

Okta must off-load audit records to a central log server. At least one Log Stream (AWS EventBridge, Splunk Cloud, etc.) must be configured and ACTIVE in the tenant. Alternatively, an external SIEM pulling the System Log API can satisfy the requirement, but that pull-based path is verified manually.

An Okta Workflows Automation must disable inactive user accounts. The automation must be ACTIVE, on an ACTIVE schedule, evaluate User Inactivity = 35 days (or less), apply to a group covering every user, and trigger Suspended / Deactivated / Deprovisioned. Threshold override: okta_user_inactivity_max_days. N/A when user sourcing is delegated to Active Directory or LDAP.