NIST SP 800-66 Rev 2
Technical

NIST SP 800-66 Rev 2 164.312(a)(2)(iii): Automatic Logoff (Addressable)

Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. NIST recommends timeouts proportionate to risk and re-authentication for sensitive functions.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 30 controls across 14 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 4 controls

FedRAMP Moderate · 4 controls

CMMC 2.0 · 3 controls

NIST SP 800-171 Rev 3 · 3 controls

C5 (Germany) · 2 controls

  • C5-IDM-03 Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins
  • C5-PSS-06 Session Management

CIS Controls v8 · 2 controls

  • CIS-4.10 Enforce Automatic Device Lockout on Portable End-User Devices
  • CIS-4.3 Configure Automatic Session Locking on Enterprise Assets

ISO 27001:2022 · 2 controls

  • 7.7 Clear desk and clear screen
  • 8.1 User end point devices

ISO 27002:2022 · 2 controls

  • 7.7 Clear desk and clear screen
  • 8.5 Secure authentication

NIST SP 800-53 Rev 5 · 2 controls

PCI DSS 4.0 · 2 controls

  • 2.2.6 2.2.6 System security parameters configured against misuse
  • 8.2.8 8.2.8 Re-authentication after 15 minutes idle

AWS Well-Architected Security Pillar · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

SOC 2 · 1 control

  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets

UK Cyber Essentials · 1 control

  • CE-SC.9 Device Unlocking Credentials and Brute-Force Protection

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical

Query this from an agent

The graph holds this control, the 30 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls