164.312(a)(2)(iii) Automatic Logoff (Addressable)
Technical safeguard · Addressable
The requirement as we hold it
Automatic Logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. NIST recommends timeouts proportionate to risk and re-authentication for sensitive functions.
The examiner asks
- Show me the automatic logoff and the timeout you chose.
- Why is that timeout appropriate to your risk?
Evidence to bring
- the timeout configuration
- the risk rationale
Source: 164.312(a)(2)(iii) at eCFR. Our statement of the clause, not the instrument verbatim.