3.13.9 — Kill Idle Network Connections
What It Says
Section titled “What It Says”Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
What It Actually Means
Section titled “What It Actually Means”Network connections don’t stay open forever. Define timeout periods and enforce them:
- VPN sessions — 1 hour of inactivity (common standard)
- SSH connections — 15-30 minutes idle
- Database connections — 15 minutes idle
- Web application sessions — defined by the application (see also 3.1.11)
- Firewall session table — timeout configured per protocol
This is the network layer complement to session termination (3.1.11). Where 3.1.11 handles application-level session termination, this handles the underlying network connection.
The assessor will check: after a VPN user goes idle, does the connection eventually drop? Or does it stay open for days?
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Are conditions for terminating network connections defined? | Documented timeout values for VPN, SSH, database, and other connection types |
| 2 | Are network connections terminated after the defined conditions? | Connections actually drop after idle timeout — demonstrated live |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: System and communications protection policy; system security plan; system configuration settings showing session timeouts; network device configurations
People they’ll talk to: System or network administrators; personnel with information security responsibilities
Live demos they’ll ask for: Network session timeout mechanisms; attempt to maintain idle connection beyond timeout
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”These are the actual questions. Have answers ready.
- “What are your defined session timeouts for VPN, SSH, and other connections?”
- “Show me the VPN server configuration for idle timeout.”
- “Leave a session idle — show me it disconnects after the timeout.”
- “Are database connection timeouts configured?”
- “How do you handle users who complain about being disconnected?”
Where Companies Trip Up
Section titled “Where Companies Trip Up”No timeouts. Connections stay open until the user manually disconnects. Some never do.
VPN timeout too long. 8-hour timeout means an abandoned connection stays open all day. 1 hour is reasonable.
Application timeouts only. The web app session expires but the underlying VPN/network connection stays open. Both layers need timeouts.
Users bypass timeouts. Keep-alive scripts prevent idle disconnect. Block or detect these.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.1.11 — End the Session | Application-level session termination that complements network timeouts |
| 3.1.12 — Eyes on Remote Access | Remote sessions that need timeout enforcement |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: SC.L2-3.13.9 | SPRS Weight: 1 point | POA&M Eligible: Yes