Session Termination

Define termination conditions you can actually execute.

Objective [a] leaves the conditions to you: user logoff, account disablement, a scheduled restart, a policy violation, a time-of-day cutoff. NIST SP 800-171 Revision 2 mandates no inactivity timeout for this requirement. Choose conditions your systems genuinely enforce and write them in the system security plan, because [b] is assessed against your own definition.

Simple definitions are defensible.

One complete answer defines two conditions: sessions end when the user logs off and when the account is disabled. A weekly forced restart is another: it terminates every session on a schedule and doubles as update hygiene. The trap is not modesty. It is defining a condition, such as a nightly logoff script, that turns out not to run everywhere you claimed.

This is the logical session, not the network connection.

SC.L2-3.13.9 handles terminating network connections. A VPN client disconnecting after twelve hours is a network event. This requirement is about ending the user's logical session, the thing that logoff, disablement, and restart end. Keeping the two straight avoids answering the wrong requirement with the right evidence.

Do not punish users with aggressive idle logoffs.

A short idle logoff on ordinary workstations disrupts work without a compliance payoff, since the requirement names no timeout. Save tight idle termination for virtual desktops (VDI), shared machines, and high-exposure systems where it earns its cost.