defined period
163520·updated Aug 30, 2026A policy-established, organization-configurable duration of elapsed time—measured in minutes, hours, or days—that serves as a threshold triggering an automated security enforcement action when that duration expires without the expected activity. Across NIST SP 800-53/800-171, CIS Controls, PCI DSS, ISO/IEC 27001, and HIPAA, it functions as the configurable variable inside controls such as session locking, session termination, account disablement, and token expiry: the control specifies *that* enforcement must occur automatically, while the defined period is the organization-set value governing *when* it fires. It is intentionally left as a parameter rather than a fixed value in most frameworks because the appropriate threshold varies by asset type, data sensitivity, and risk posture—though regulators sometimes cap it (e.g., PCI DSS at 15 minutes for idle sessions, CIS Controls at 15 minutes for general-purpose OSes and 2 minutes for mobile devices).
Source
when they are expecting inactivity longer than the defined period. Automatic enforcement ofthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- AC-2(5): Inactivity Logout - CSF Tools
- NIST Special Publication 800-53 Revision 1 Excerpt
- 3.5.6: Disable identifiers after a defined period of inactivity - CSF Tools
- NIST 800-171 3.5.6 Disable identifiers after a defined period of inactivity. : iCompaas Support
- 🔐 Fintech App Security: 🕒 Best Practices for Inactivity Timeouts ⏳ (ISO, PCI-DSS & NIST Guidelines) 🚀 - Cyberbuddies Academy Blog
- IA.L2-3.5.6 - CMMC 2.11 Control Explorer - GRC Academy
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A policy-specified duration — set by an organization based on its risk tolerance, regulatory obligations, and operational context — that serves as the threshold triggering a required security or compliance action. Standards bodies (NIST SP 800-53, SP 800-171, CMMC, ISO/IEC 27001) deliberately leave the numeric value as an organizational assignment, expressed in NIST controls as `[Assignment: organization-defined time period]`; once an organization fills in that value and documents it in policy, it becomes the "defined period" that governs enforcement. The expression appears across multiple control domains — session inactivity logout, account and identifier disablement, identifier-reuse prohibition, and data retention — always denoting the same underlying concept: the documented, policy-anchored time boundary after which a specific protective action must automatically or procedurally occur.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- defined periods
- possessive
- defined period's
- pluralpossessive
- defined periods'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A policy-established, organization-configurable duration of elapsed time—measured in minutes, hours, or days—that serves as a threshold triggering an automated security enforcement action when that duration expires without the expected activity. Across NIST SP 800-53/800-171, CIS Controls, PCI DSS, ISO/IEC 27001, and HIPAA, it functions as the configurable variable inside controls such as session locking, session termination, account disablement, and token expiry: the control specifies *that* enforcement must occur automatically, while the defined period is the organization-set value governing *when* it fires. It is intentionally left as a parameter rather than a fixed value in most frameworks because the appropriate threshold varies by asset type, data sensitivity, and risk posture—though regulators sometimes cap it (e.g., PCI DSS at 15 minutes for idle sessions, CIS Controls at 15 minutes for general-purpose OSes and 2 minutes for mobile devices).DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A policy-specified duration — set by an organization based on its risk tolerance, regulatory obligations, and operational context — that serves as the threshold triggering a required security or compliance action. Standards bodies (NIST SP 800-53, SP 800-171, CMMC, ISO/IEC 27001) deliberately leave the numeric value as an organizational assignment, expressed in NIST controls as `[Assignment: organization-defined time period]`; once an organization fills in that value and documents it in policy, it becomes the "defined period" that governs enforcement. The expression appears across multiple control domains — session inactivity logout, account and identifier disablement, identifier-reuse prohibition, and data retention — always denoting the same underlying concept: the documented, policy-anchored time boundary after which a specific protective action must automatically or procedurally occur.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.