expected inactivity
163504·updated Aug 30, 2026A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.
Source
] of expected inactivity or when [ Assignment: organization-defined circumstances ].the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- AC-2(5): Inactivity Logout - CSF Tools
- Assessing Security Requirements for Controlled Unclassified Information
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
** A condition used in session-management and access-control policy to denote a period during which a user anticipates not interacting with a system — distinguishing user-anticipated absence (a behavioral/intentional state) from mere observed idle time, which is handled by automatic mechanisms. In NIST control language, it serves as the organization-definable threshold after which a user is required to proactively log out, as distinct from the automatic session-lock or termination triggered by measured idle time under separate controls. The phrase functions as an ordinary English compound that carries no specialized technical meaning beyond the sum of its parts: the words "expected" and "inactivity" are used in their plain senses. **VERDICT:** COMPOSITIONAL **Sources:** - NIST SP 800-53 Rev. 4, Control AC-2(5) — *Inactivity Logout*, via csf.tools: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/ac-2-5/ - NIST SP 800-171r3, Section 03.01.01: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html - NIST SP 800-171Ar3, Assessment Objective A.03.01.01.h: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171Ar3/NIST.SP.800-171Ar3.html
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- expected inactivities
- possessive
- expected inactivity's
- pluralpossessive
- expected inactivities'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.DR-088 backfill from the noun definition column