Skip to content
ControlVerdict
Sign in
SC.L2-3.13.9CMMC Level 2Level 2

Connections Termination

Submit your own example

Practice statement

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.9.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    a period of inactivity to terminate network connections associated with communications sessions is defined;

    1 example covers this

  2. [b]

    network connections associated with communications sessions are terminated at the end of the sessions; and

    1 example covers this

  3. [c]

    network connections associated with communications sessions are terminated after the defined period of inactivity.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.9Connections Termination
    Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

    • [a]

      a period of inactivity to terminate network connections associated with communications sessions is defined;

    • [b]

      network connections associated with communications sessions are terminated at the end of the sessions; and

    • [c]

      network connections associated with communications sessions are terminated after the defined period of inactivity.

    Inactivity windows defined per connection type: 15 minutes for admin sessions, 12 hours for VPN

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all three Connections Termination objectives: defining the inactivity period, terminating at end of session, and terminating after the defined inactivity period.

    Defined periods [a]. The standard names a value per connection type rather than one global number, because a 15-minute VPN drop would be unusable and a 12-hour admin session would be unsafe. Administrative remote desktop and SSH sessions: 15 minutes idle. Standard user remote desktop: 30 minutes idle. VPN: 12 hours idle with a 24-hour absolute lifetime forcing re-authentication. Web application sessions for CUI apps: 30 minutes idle. Values are recorded in the configuration standard with the rationale, so the defined-versus-implemented comparison an assessor makes is a document-to-config check.

    Termination at end of session [b]. Logoff tears down the session rather than leaving it disconnected: the remote desktop policy ends disconnected sessions instead of preserving them, so a closed window does not leave a live connection with a CUI application open behind it. VPN client disconnect and OS shutdown both trigger gateway-side teardown, and the gateway reaps sessions whose client heartbeat stops. Application sign-out invalidates the server-side session, not just the browser cookie.

    Termination on inactivity [c]. Group policy applies the idle limits to the jump tier. SSH uses ClientAliveInterval with a low ClientAliveCountMax plus a shell TMOUT for interactive shells, which covers the case where the client is alive but the human is not. The firewall's own idle session TTL keeps half-open flows from lingering after a client disappears without a FIN.

    Shift-work handling. Contractors on overlapping shifts previously shared long-lived sessions. Now each shift change requires a fresh authentication; the handoff procedure includes signing out, and a detection fires on a session whose duration exceeds the absolute lifetime.

    Maintenance. Quarterly test per connection type: open a session, idle it past the limit, and confirm termination with a screenshot and log entry. Monthly report of sessions exceeding the absolute VPN lifetime. Re-validate after gateway or OS upgrades, which sometimes reset session defaults.

    Accepted gap. A long-running simulation job on the build cluster cannot survive a 15-minute idle disconnect. Jobs run detached under a scheduler so the interactive session can terminate on schedule while the workload continues; interactive shells still time out, and no exception to the idle limit was granted.

    What the evidence looks like

    • Configuration standard listing the defined inactivity period per connection type
    • Group policy export for remote desktop idle and disconnected-session limits
    • VPN gateway idle and absolute lifetime settings
    • sshd_config and shell profile showing keepalive and TMOUT values
    • Quarterly idle-termination test evidence for each connection type

    Environment

    Mixed estate: an on-prem remote desktop jump tier, cloud VPN for remote staff, and SSH access to Linux build servers. Contractors work overlapping shifts.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.