The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.

If a user is not explicitly notified that their application session has been terminated, they cannot be certain that their session did not remain open. Applications with a user access interface must provide an explicit logoff message to the user upon successful termination of the user session.