387a49cb__Critical_Security_Control__16__Description
[ID #] CSC 16-13 [Category] Configuration/Hygiene [Description] 
Profile each user's typical account usage by determining normal time-of-day access and access duration. Reports should be generated that indicate users who have logged in during unusual hours or have exceeded their normal login duration. This includes flagging the use of the user's credentials from a computer other than computers on which the user generally works.
SANS Institute - Critical Security Control: 16
Description