System and Communications Protection 3.13.9 (3.13.9)
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
Get Full GuidanceWhat Is This CMMC Control?
This control requires organizations to automatically terminate network connections when communication sessions end or after a defined period of user inactivity. This applies to both internal and external network connections and can be implemented at the operating system level (TCP/IP connections) or application level (application sessions). The goal is to prevent unauthorized access through abandoned or idle sessions and reduce the attack surface by closing unused network pathways.
Control Intent
Prevent unauthorized access and reduce security risks by ensuring that network connections do not remain open indefinitely when not actively in use, thereby limiting opportunities for session hijacking, unauthorized access through abandoned sessions, and unnecessary exposure of network resources.
Who This Control Applies To
- •All systems that establish network connections for user sessions, including workstations, servers, and network devices
- •Web applications and cloud services that maintain user sessions
- •Remote access solutions including VPN, RDP, SSH, and terminal services
- •Database management systems and application servers
- •Network infrastructure devices such as firewalls, routers, and switches with administrative interfaces
- •Wireless access points and controllers
- •Multi-user systems where multiple users may access the same resources
- •Any system or application that maintains stateful connections with users or other systems
Not Applicable When
- •Systems that only process stateless transactions with no persistent sessions (each transaction is independent and self-contained)
- •Embedded systems or IoT devices that do not support user sessions or interactive access
- •Systems that are completely isolated with no network connectivity whatsoever
- •Automated system-to-system communications that require persistent connections for operational purposes, though compensating controls should be documented
- •Batch processing systems that do not involve interactive user sessions
Key Objectives
- 1Automatically terminate network connections when communication sessions conclude to prevent unauthorized reuse of authenticated sessions.
- 2Enforce session timeouts after defined periods of inactivity to protect against abandoned sessions and reduce attack surface.
- 3Apply session termination controls consistently across both internal and external network connections to maintain uniform security posture.
- 4Implement session termination at appropriate technical layers (operating system or application level) based on the nature of the connection and system architecture.
Sample Self-Assessment Questions (Partial)
Does your organization have defined time periods for automatic session termination due to inactivity?
Are session timeout settings configured for all user-facing applications and systems?
Implementation Approaches (High-Level)
Operating System Level Session Timeouts
Configure session timeout and idle disconnect settings at the operating system level for interactive user sessions, terminal services, and remote access connections.
Web Application Session Management
Implement session timeout controls within web applications to automatically invalidate user sessions after a period of inactivity, terminating both the application session and underlying HTTP/HTTPS connections.
Network Infrastructure Session Controls
Configure network devices, firewalls, and security appliances to terminate idle connections and enforce connection timeouts at the network layer.
Database Connection Management
Configure database management systems and application connection pools to terminate idle database connections and enforce maximum connection lifetimes.
Remote Access and VPN Session Controls
Enforce session timeouts and idle disconnection for remote access solutions including VPN, Remote Desktop Protocol (RDP), SSH, and virtual desktop infrastructure (VDI).
Cloud Service Provider Session Management
Configure session timeout and idle disconnect settings for cloud-based services, SaaS applications, and cloud infrastructure platforms.
Evidence & Assessment Notes
Expected Evidence
Organizations should maintain documentation and evidence demonstrating compliance with this control. This may include policy documentation, configuration records, audit logs, access reviews, and other relevant artifacts that show how the control is implemented and maintained.
Plan of Action & Milestones (POA&M)
If session timeout controls are not currently implemented, prioritize systems with the highest risk exposure: internet-facing applications, remote access solutions, and systems processing CUI For systems that cannot support automatic session termination due to technical limitations, document the limitation, assess the risk, and implement compensating controls such as enhanced monitoring, network segmentation, or additional authentication requirements If timeout periods are currently set too high (e.g., several hours or days), develop a phased approach to reduce them to acceptable levels while managing user impact and communication When multiple systems require timeout configuration, group them by type (e.g., all Windows servers, all web applications) and implement standardized configurations to improve efficiency If users complain about timeout settings causing productivity issues, investigate whether the timeout periods are appropriate for the work being performed and whether auto-save or session persistence features can mitigate data loss concerns For legacy systems that cannot be configured with session timeouts, consider implementing network-level controls (firewall idle timeout) as a compensating control while planning for system replacement or upgrade Document any business-justified exceptions to standard timeout periods (e.g., long-running batch processes, specific operational requirements) and ensure appropriate compensating controls are in place If timeout settings exist but are not consistently enforced, investigate whether keep-alive mechanisms, application bugs, or misconfigurations are preventing proper timeout behavior Consider implementing a timeout warning notification to users before session termination to reduce unexpected logouts and improve user acceptance Ensure that timeout settings are included in system hardening standards, configuration baselines, and deployment checklists to prevent regression
Frequently Asked Questions
What is an appropriate session timeout period for CMMC compliance?
CMMC does not prescribe specific timeout values, but common industry practice is 15-30 minutes for standard user sessions and 10-15 minutes for administrative or privileged sessions. The organization must define timeout periods based on risk assessment, considering factors such as the sensitivity of data accessed, the environment (internal vs. external access), and operational requirements. Whatever periods are chosen must be documented and consistently enforced.
Does this control apply to service accounts and automated processes?
The control focuses on communications sessions, which typically involve interactive user access. Service accounts and automated system-to-system communications may require persistent connections for operational purposes. However, these should be documented as exceptions with appropriate compensating controls such as network segmentation, enhanced monitoring, or certificate-based authentication. The key is to distinguish between interactive user sessions (which should timeout) and automated processes (which may need persistent connections).
Can we use different timeout periods for different types of access?
Yes, the supplemental guidance explicitly states that time periods may be established 'by type of network access or for specific network accesses.' It is common and appropriate to have shorter timeouts for administrative access, external/VPN access, or access to sensitive systems, and longer timeouts for internal standard user access. All timeout periods must be documented and justified based on risk.
What is the difference between session timeout at the OS level versus application level?
OS-level timeout terminates the entire user session and all associated network connections (TCP/IP ports) when the user is inactive at the keyboard/mouse level. Application-level timeout terminates a specific application session (such as a web application login) but may not close the underlying network connection if multiple applications share it. The control requires termination at the appropriate level based on the system architecture - ideally both layers should enforce timeouts as defense-in-depth.
How do we handle situations where users lose work due to session timeouts?
This is a common user experience concern. Best practices include: implementing timeout warnings that notify users before termination (without resetting the timer), enabling auto-save functionality in applications, using session persistence features that save application state, and educating users about timeout policies. However, user convenience cannot override security requirements - if timeouts cause significant productivity issues, evaluate whether the timeout period is appropriate, but do not disable the control.
Do cloud services and SaaS applications need to comply with this control?
Yes, if the organization uses cloud services or SaaS applications to process, store, or transmit CUI, those services must have session timeout controls configured. Most enterprise cloud services provide configurable timeout settings. The organization is responsible for configuring these settings according to their documented timeout policy and providing evidence of the configuration. If a SaaS provider does not offer timeout configuration, this should be documented as a risk and addressed through contract requirements or alternative controls.
How ConformatIQ Helps With CMMC Readiness
ConformatIQ is an AI-assisted CMMC readiness platform designed to help organizations prepare for assessments more efficiently. The platform supports document generation such as SSPs and POA&Ms, guided readiness workflows, centralized evidence tracking, and interview preparation for assessments.
Ready to Get Full Guidance?
Access complete implementation details, detailed assessment questions, evidence requirements, and expert guidance for this control.
Request Full GuidanceInformation sourced from NIST SP 800-171 Rev. 2. See full disclaimer.