NIST 800-171 • LEVEL 2 • ACCESS CONTROL
3.1.11 — Session Termination
This requirement addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., disconnecting from the network) in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.09)03.13.09. A logical session is initiated whenever a user (or processes acting on behalf of a user) accesses a system. Logical sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination ends all system processes associated with a user’s logical session except those processes that are created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic session termination can include organization-defined periods of user inactivity, time-of-day restrictions on system use, and targeted responses to certain types of incidents.
CMMC Practice Mapping
NIST 800-53 Controls
Assessment Objectives
- a user session is terminated automatically after {{ insert: param, A.03.01.11.ODP.01 }}.
Practitioner Notes
Sessions need to end automatically after a period of inactivity. This is different from screen lock — session termination actually logs the user out, closing their applications and connections, not just hiding the screen.
Example 1: For Remote Desktop sessions, configure the GPO at Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Session Time Limits → "Set time limit for disconnected sessions" to 30 minutes and "Set time limit for active but idle RDP sessions" to 30 minutes. Disconnected sessions should be terminated, not left hanging.
Example 2: In Microsoft 365, go to Azure AD → Enterprise Applications → Office 365 → Conditional Access → Session Controls and set "Sign-in frequency" to 8 hours. This forces users to re-authenticate at least once per workday, even if they've been active. For sensitive CUI applications, set it to 1 hour.