Connections Termination

Official Source Material

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

Determine if:

[a] a period of inactivity to terminate network connections associated with communications sessions is defined;
[b] network connections associated with communications sessions are terminated at the end of the sessions; and
[c] network connections associated with communications sessions are terminated after the defined period of inactivity.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This is network session termination. User sessions belong to AC.L2-3.1.11.

The objectives here are about connections: TCP sessions, VPN (virtual private network) tunnels, remote access links. Locking screens and ending user sessions is a different requirement. Keep the two separate in your system security plan, the document that describes how your system meets each requirement, so each points at its own mechanism.

Define the inactivity period, then show the configuration that enforces it.

Objective [a] is a number you choose and write down. [c] is the timeout configured to match. The idle connection timeout on your firewall and the session timeout on your VPN are the ordinary mechanisms. A vendor default counts once you document it as your defined period.

Termination at session end is mostly protocol behavior. Your job is the catch-all.

Connections close when a user disconnects or an application finishes, which covers [b]. The inactivity timeout under [c] is the backstop for sessions that never end cleanly, including the dangling connections browsers leave behind. Defining which network sessions require managed termination is within your power, and remote access sessions are the ones that matter.

Edge cases

Work-from-home devices with no always-on tunnel have no corporate network session to terminate until they connect. Define the managed sessions as the VPN and remote access connections, and let the VPN's timeout carry the requirement.