NIST 800-171 Control 3.13.9: Network Disconnection After Inactivity
Network disconnection after defined inactivity periods is a critical control for protecting sensitive systems from unauthorized access and session hijacking. NIST SP 800-171 3.13.9 requires organizations to automatically terminate connections when users are inactive, reducing the attack surface and enforcing session management best practices. Implementing this control prevents unattended terminals and remote sessions from becoming unauthorized entry points.
What this means
This control requires you to configure and enforce automatic termination of network connections when no user activity is detected for a specified time period. The goal is to eliminate idle sessions that could be exploited by attackers. This applies to local, remote, and interactive connections across systems handling Controlled Unclassified Information (CUI). The inactivity threshold should be risk-based and documented in your security policy.
How to comply
- 1.Define inactivity timeout periods in your security policy (typically 15-30 minutes for sensitive systems)
- 2.Configure automatic session termination on all servers, workstations, and network devices
- 3.Enable screen lock and forced logout mechanisms for both local and remote access
- 4.Apply timeout settings through Group Policy, device management, or vendor-native controls
- 5.Test and validate that connections terminate properly after the defined inactivity period
- 6.Document timeout configurations per system type and security zone
- 7.Monitor and audit session disconnections to verify control effectiveness
- 8.Communicate inactivity policies to users to prevent productivity disruption
Evidence auditors look for
- Group Policy Objects (GPO) configured with session timeout settings
- Screenshots of server/workstation idle session timeout configurations
- Network device configurations showing connection timeout parameters
- Remote access (VPN, RDP) session timeout settings documentation
- System logs showing automatic disconnection events with timestamps
- Security policy document specifying inactivity thresholds by system classification
- User access agreements acknowledging timeout policies
- Compliance audit reports validating timeout enforcement across the environment
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates session timeout policy deployment across your infrastructure, continuously monitors disconnection events, and generates audit logs for your NIST 800-171 assessment—eliminating manual configuration and compliance verification.
See how GRCWatch handles this control automatically
Start free trial