expected inactivity
A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
A policy threshold — either a duration or a described condition — that an organization defines to represent a session or period during which a user is not expected to interact with a system. It functions as the trigger criterion in session-management controls: NIST SP 800-53 AC-2(5) requires that "users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out]." The concept is intentionally broader than a simple countdown timer: the organization may supply either an "organization-defined time-period of expected inactivity" or a "description of when to log out," accommodating both quantitative thresholds and qualitative, scenario-based conditions. The control is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- expected inactivities
- possessive
- expected inactivity's
- pluralpossessive
- expected inactivities'