defined period

A policy-specified duration — set by an organization based on its risk tolerance, regulatory obligations, and operational context — that serves as the threshold triggering a required security or compliance action. Standards bodies (NIST SP 800-53, SP 800-171, CMMC, ISO/IEC 27001) deliberately leave the numeric value as an organizational assignment, expressed in NIST controls as `[Assignment: organization-defined time period]`; once an organization fills in that value and documents it in policy, it becomes the "defined period" that governs enforcement. The expression appears across multiple control domains — session inactivity logout, account and identifier disablement, identifier-reuse prohibition, and data retention — always denoting the same underlying concept: the documented, policy-anchored time boundary after which a specific protective action must automatically or procedurally occur.

Advisory only. A term this product ships is defined by an authority document, not by a search result.