defined period

A policy-specified duration of time that an organization sets as a threshold to trigger an automated or required manual security action — such as session termination, account disablement, identifier invalidation, or connection tear-down — when that threshold is crossed without qualifying activity. It functions as an organization-defined control parameter: the variable part of a security control that an organization instantiates during tailoring by assigning a concrete value appropriate to its risk posture. Authority documents use the phrase as a placeholder rather than a fixed value, deliberately leaving the numeric duration open; for example, NIST SP 800-171 requires organizations to "prevent reuse of identifiers for a defined period" and to "disable identifiers after a defined period of inactivity," while DoD guidance explicitly notes there are no minimum acceptable values for "a defined period" — the values are left to the contractor to determine. Across contexts the expression recurs wherever a control must fire after elapsed time — inactivity logout, network-session termination "after a defined period of inactivity," cryptographic key rotation windows, and similar — always mea

Advisory only. A term this product ships is defined by an authority document, not by a search result.