Requirement:

The asset owner shall have policies and procedures related to limiting the number of concurrent sessions per interface for any given human user, software process or device.

Guidance: