- Set inactivity timeouts on the infrastructure that holds connections — VPN concentrators, firewalls, remote-desktop gateways, load balancers — and record the values chosen.
- Distinguish this from session lock (3.1.10) and session termination (3.1.11): this requirement is about the network connection itself, not the user session on top of it.
3.13.9OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.13.9 — Network connection termination
3.13 System and Communications Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Network connections do not linger after the conversation ends. Connections terminate at session end or after defined inactivity, so an abandoned connection cannot be adopted by someone else or hold open a slot an attacker can slip into.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Timeout configuration exports from connection-holding infrastructure, with the defined periods documented
- A dated spot-check showing an idle session actually disconnected at the configured threshold
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |