defined period
A policy-established, organization-configurable duration of elapsed time—measured in minutes, hours, or days—that serves as a threshold triggering an automated security enforcement action when that duration expires without the expected activity. Across NIST SP 800-53/800-171, CIS Controls, PCI DSS, ISO/IEC 27001, and HIPAA, it functions as the configurable variable inside controls such as session locking, session termination, account disablement, and token expiry: the control specifies *that* enforcement must occur automatically, while the defined period is the organization-set value governing *when* it fires. It is intentionally left as a parameter rather than a fixed value in most frameworks because the appropriate threshold varies by asset type, data sensitivity, and risk posture—though regulators sometimes cap it (e.g., PCI DSS at 15 minutes for idle sessions, CIS Controls at 15 minutes for general-purpose OSes and 2 minutes for mobile devices).
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.
A policy-specified duration — set by an organization based on its risk tolerance, regulatory obligations, and operational context — that serves as the threshold triggering a required security or compliance action. Standards bodies (NIST SP 800-53, SP 800-171, CMMC, ISO/IEC 27001) deliberately leave the numeric value as an organizational assignment, expressed in NIST controls as `[Assignment: organization-defined time period]`; once an organization fills in that value and documents it in policy, it becomes the "defined period" that governs enforcement. The expression appears across multiple control domains — session inactivity logout, account and identifier disablement, identifier-reuse prohibition, and data retention — always denoting the same underlying concept: the documented, policy-anchored time boundary after which a specific protective action must automatically or procedurally occur.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- defined periods
- possessive
- defined period's
- pluralpossessive
- defined periods'