inactivity logout

An access-control requirement — and the named control under it — that obligates users or systems to terminate an authenticated session after a defined period during which no user interaction has been detected, so that unattended sessions cannot be exploited for unauthorized access. NIST SP 800-53 distinguishes two variants: the policy-based form (AC-2(5)), in which the *user* is required to log out manually when anticipating absence longer than the defined threshold, and the automated form (AC-11), in which the system enforces termination without human action; in both cases the goal is session termination — which clears tokens and credentials — rather than the weaker alternative of a screen lock, which may leave application sessions alive. Across compliance frameworks (HIPAA, 21 CFR Part 11, FedRAMP, CMMC) the expression is used as a named control label, a policy objective, and a product configuration parameter, always referring to the same underlying mechanism: ending an authenticated session upon elapsed inactivity.

Advisory only. A term this product ships is defined by an authority document, not by a search result.