3.13.9

Requirement

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

Discussion

This requirement applies to internal and external networks. Terminating network connections associated with communications sessions include de-allocating associated TCP/IP address or port pairs at the operating system level, or de-allocating networking assignments at the application level if multiple application sessions are using a single, operating system-level network connection. Time periods of user inactivity may be established by organizations and include time periods by type of network access or for specific network accesses

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing network disconnect; system design documentation; security plan; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: System or network administrators; personnel with information security responsibilities; system developer].
Test

[SELECT FROM: Mechanisms supporting or implementing network disconnect capability].

ID	Assessment Objectives
3.13.9[a]	A period of inactivity to terminate network connections associated with communications sessions is defined.
3.13.9[b]	Network connections associated with communications sessions are terminated at the end of the sessions.
3.13.9[c]	Network connections associated with communications sessions are terminated after the defined period of inactivity.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!