Mapped to NIST 800-171 Requirement: 3.1.10
CMMC Assessment Objective: AC.L2-3.1.10[a]
What This Objective Means
This objective focuses on identifying how long a system or session may remain idle before it is automatically locked or requires reauthentication. You must define this setting based on organizational risk tolerance and usability needs, but it should align with best practices for security.
Common timeout durations range from 10 to 15 minutes of inactivity.
Why It Matters
Unattended or idle sessions are a security risk. If a system is left open:
• Sensitive data may be viewed or stolen
• Malicious actors may take advantage of an unattended session
• There is no visibility into when access actually stopped
Defining a timeout threshold sets a clear standard for session security.
How to Implement It
• Choose an inactivity timeout duration that balances security and usability
• Document this time period in your:
◦ Access Control Policy
◦ System Security Plan (SSP)
◦ Configuration baseline or system hardening guides
• Ensure the value is applied across:
◦ Workstations and laptops
◦ Servers with interactive logins
◦ Remote access portals (e.g., VPN, web-based systems)
Evidence the Assessor Will Look For
• Policy or documentation specifying your session timeout duration
• System configuration standards referencing the inactivity period
• Screenshots of system settings showing the defined lock timeout
• Role-based variations (e.g., shorter timeouts for high-privilege accounts)
Common Gaps
• No defined timeout value in documentation
• Session timeout varies across systems without rationale
• Timeout duration is too long or left at the default setting (e.g., 30+ minutes)
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing session timeouts across the secure enclave after a defined period of inactivity
• Offering predefined configurations that align with CMMC expectations
• Documenting default timeout settings as part of the platform’s compliance package
• Supporting risk-based timeout variations if justified and documented
With Cuick Trac, session timeout is one more control you don’t have to configure manually—it’s built in.
Final CTA
An unattended session is an open door.
Schedule a Cuick Trac demo and define your inactivity threshold with confidence and consistency.