This objective requires your organization to define and document the specific duration of user inactivity that will trigger a session lock on systems that access or process Controlled Unclassified Information (CUI).