V-222437 is a low severity rule in the Application Security and Development (ASD) STIG. It asks the application to show users when their account last logged on successfully. The goal is simple. If someone else used the account, the user can notice and report it.
The rule does not set a display time. A message at logon, such as a banner or a toast, can satisfy the check as written. Confirm the approach with your assessor before you mark the rule Not a Finding.
What the rule says
- Rule: V-222437, SV-222437r987626_rule, STIG ID APSC-DV-000580.
- Benchmark: ASD STIG Version 6, Release 5, published 2026-08-25.
- Requirement: The application must display the time and date of the user's last successful logon.
- Fix text: Design and configure the application to display the date and time when the user was last successfully granted access.
- Related IDs: CCI-000052 and the legacy ID V-69355.
How an assessor checks it
The check text describes a short test.
- Log on as a test user and use the application.
- Note the date and time you were granted access.
- Log out.
- Log on again as the same user.
- Look for the previous logon date and time in the user interface.
If the date and time are not displayed in the user interface, it is a finding. If the application has no user interface, the rule is not applicable.
Choosing a display style
- Persistent field. A "Last logon" line in a header or profile menu is the easiest to verify. The user can see it any time.
- Notice at logon. A toast or dialog meets the wording of the check if it appears right after logon and shows the correct previous date and time. If it disappears quickly, the assessor may miss it. Consider a dialog the user must dismiss, or keep the value in a profile page as well.
- Show the previous session. Show the last successful logon before the current one, not the current logon time.
Document your decision
Write down how the application meets the rule in the checklist comments. Include a screenshot of the notice. This helps the next review go faster.