expected inactivity
163504·updated Aug 30, 2026A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.
Source
] of expected inactivity or when [ Assignment: organization-defined circumstances ].the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A policy threshold — either a duration or a described condition — that an organization defines to represent a session or period during which a user is not expected to interact with a system. It functions as the trigger criterion in session-management controls: NIST SP 800-53 AC-2(5) requires that "users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out]." The concept is intentionally broader than a simple countdown timer: the organization may supply either an "organization-defined time-period of expected inactivity" or a "description of when to log out," accommodating both quantitative thresholds and qualitative, scenario-based conditions. The control is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- expected inactivities
- possessive
- expected inactivity's
- pluralpossessive
- expected inactivities'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A policy threshold — either a duration or a described condition — that an organization defines to represent a session or period during which a user is not expected to interact with a system. It functions as the trigger criterion in session-management controls: NIST SP 800-53 AC-2(5) requires that "users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out]." The concept is intentionally broader than a simple countdown timer: the organization may supply either an "organization-defined time-period of expected inactivity" or a "description of when to log out," accommodating both quantitative thresholds and qualitative, scenario-based conditions. The control is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.