Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

Access expiration policy

Updated: September 8, 2026

Want to summarize with AI?

Enforce access expiration policies to ensure only legitimate users retain CV SRA access by managing user validity and enhancing security.

The access expiration policy is a security measure that manages the validity period of user access to CV SRA.

By default, the maximal access duration for each user role is unlimited.
Specific expiration times (60, 90, or 180 days) can be set for user roles other than SRA System Admin.
SRA System Admins have permanent, unlimited access.

Default expiration settings and user role management

The access expiration policy enhances security by ensuring that only authorized users retain access to CV SRA, and allows administrators to configure access duration for different user roles.

Change the default maximum access duration from Configuration > Policies. Changes are processed during the nightly system check. If the current expiration is shorter than the new setting, no change is made. If the current expiration is longer than the new setting, it is reduced to the new value.

For example, a user with the SRA Operator role can be assigned an access expiration of 90 days, after which their access will be revoked unless renewed. In contrast, a user with the SRA System Admin role will retain access indefinitely.

Administrator-initiated extensions

Administrators can extend a user's access without waiting for an extension request. From Cyber Vision Secure Remote Access > Access Management > Users, select a user, choose Edit Expiration, and select Reset to maximum or Set access expiration date.

If a user is blocked for a reason other than access expiration, you can select Unblock user while extending access. If the user is blocked because access expired, unblocking resets the expiration to the default policy value before you set a specific date.

Modify the default policy

Change the maximum access duration for user roles to meet security requirements.

CV SRA lets you limit the length of time different user roles retain access by adjusting the expiration policy.

Before you begin

Ensure you have administrator privileges in CV SRA.

Procedure

Choose Configuration > Policies.

Note

The Policies page displays the default access expiration policies for different user roles.
On the Policies page, click Edit .
In the Edit Maximum Access Expiration dialog box, locate the field for the user role whose policy you want to modify.
Select a value from the drop-down list, and click Save .

The new settings do not apply immediately to existing users. Changes are processed during the nightly system check based on the following logic:


If...	Then...
The current expiration time is shorter than the new setting	No changes are made.
The current expiration time is longer than the new setting	The expiration will be reduced to match the new value.

Notification schedules

The notification schedule defines when users are alerted about upcoming access expiration and outlines the process for handling extension requests.

Users receive email notifications at specific intervals before their access expires.
Notifications are sent 7 days, 3 days, and 1 day prior to expiration.
System or Access Admins can review and approve or reject extension requests based on justification.

Request an access extension for an CV SRA session

Request additional time for your remote session access beyond the current expiration date.

Use this task if your remote session access is about to expire and you have a business need to extend it. The request must be approved by administrators in your organization.

Before you begin

Ensure you have access to CV SRA and are logged in.

Procedure

Log in to CV SRA.
Navigate to the Remote Sessions page.
- If your access is nearing its revocation date, a banner is displayed.
Click Request an access expiration extension .
Enter your business justification in the provided text box.
Click Request .

Your request is sent to all administrators in your organization. If approved, your remote session access will be extended.

What to do next

Monitor your email or notifications for administrator approval or further action, if required.

Manage access extension requests

Use this procedure to review and manage user requests for additional access time in your system.

Administrators can view and manage all pending access extension requests in the Access Management interface.

Before you begin

Ensure you have administrator access.

Procedure

From the left service panel, select SRA > Access Management.
On the Access Management page, click Pending Requests > Access expiration requests .
Select the request you wish to review, and then click Approve in the Action column.
In the Approve Request dialog box, choose one of these options:
- Reset to maximum - This option resets the expiration value to the default value defined in the Policy tab.
- Set access expiration date - Choose this to pick a specific expiration date from the calendar.
Click Save .

An email notification is sent to users, informing them of your decision. The requests will be moved to the Request History > Access extension requests tab for auditing.

Extend access expiration without user requests

Enable SRA administrators to directly extend user access periods, even when a user has not submitted an extension request.

Use this procedure when you need to proactively extend a user’s access in CV SRA, bypassing the typical requirement for a user-initiated request.

Before you begin

Ensure you have the necessary privileges to modify user access in CV SRA.

Procedure

From the left service panel, select SRA > Access Management.
On the Access Management page, click the Users tab.
In the user table, select one or more users whose access you want to extend.
In the User details section, click Edit Expiration.
In the Edit Access Expiration dialog box, choose one of the following options:
- Reset to maximum : Resets the expiration date to the default value set in the Policy tab.
- Set access expiration date : Select a specific expiration date from the calendar.
Click Save to apply your changes.

(Optional) If users are currently blocked:


If...	Then...
The block is for reasons other than access expiration	Click Unblock user when extending access.
The block is due to expired access	You cannot immediately set a new expiration date. When you unblock the user, access expiration resets automatically to the default value in the Policy tab. You can then set a custom expiration date as needed.

The selected users’ access expiration is extended according to your chosen option, and access status is updated immediately.

What to do next

As needed, review access and policy settings for the updated users to confirm successful extension.

Best practices for expiration policy management

Regularly review and update expiration policies so they align with current security requirements and organizational needs.

Document all manual extensions of expiration periods, including the reasons for each extension, to maintain clear audit trails.

Communicate all changes to expiration policies and notification schedules to users, ensuring stakeholders are informed and aware of policy updates.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.