inactivity logout
163518·updated Aug 30, 2026A session-management security control that terminates an authenticated user's active session—fully ending the credential context rather than merely locking the screen—once the user has been, or is expected to be, idle for an organization-defined period. Within NIST SP 800-53, it is codified as control AC-2(5) in the Account Management family; in its policy-based form it requires users to take physical action to log out when they anticipate inactivity longer than the defined threshold. Logout is treated as stronger than screen lock because a locked workstation may preserve application sessions, whereas logout ends the session and typically clears session tokens and cookies. Across the field it is invoked as a compliance requirement under frameworks such as HIPAA and GDPR, as well as NIST-aligned programs, and in regulated environments such as 21 CFR Part 11 it is considered critical for audit-trail accuracy, access control, and session integrity.
Source
Inactivity logoutthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- AC-2(5): Inactivity Logout - CSF Tools
- Daydream
- Building an Auto-Logout System for Angular Applications: Securing User Sessions with Inactivity Detection - DEV Community
- Configuring Auto Logout in Ignition Perspective (8.x) – Industrial Monitor Direct
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
An access-control requirement — and the named control under it — that obligates users or systems to terminate an authenticated session after a defined period during which no user interaction has been detected, so that unattended sessions cannot be exploited for unauthorized access. NIST SP 800-53 distinguishes two variants: the policy-based form (AC-2(5)), in which the *user* is required to log out manually when anticipating absence longer than the defined threshold, and the automated form (AC-11), in which the system enforces termination without human action; in both cases the goal is session termination — which clears tokens and credentials — rather than the weaker alternative of a screen lock, which may leave application sessions alive. Across compliance frameworks (HIPAA, 21 CFR Part 11, FedRAMP, CMMC) the expression is used as a named control label, a policy objective, and a product configuration parameter, always referring to the same underlying mechanism: ending an authenticated session upon elapsed inactivity.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- inactivity logouts
- possessive
- inactivity logout's
- pluralpossessive
- inactivity logouts'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A session-management security control that terminates an authenticated user's active session—fully ending the credential context rather than merely locking the screen—once the user has been, or is expected to be, idle for an organization-defined period. Within NIST SP 800-53, it is codified as control AC-2(5) in the Account Management family; in its policy-based form it requires users to take physical action to log out when they anticipate inactivity longer than the defined threshold. Logout is treated as stronger than screen lock because a locked workstation may preserve application sessions, whereas logout ends the session and typically clears session tokens and cookies. Across the field it is invoked as a compliance requirement under frameworks such as HIPAA and GDPR, as well as NIST-aligned programs, and in regulated environments such as 21 CFR Part 11 it is considered critical for audit-trail accuracy, access control, and session integrity.DR-088 backfill from the noun definition column