1Overview
SC.L2-3.13.9 requires that idle and ended network connections be closed. It requires that network connections associated with communications sessions be terminated at the end of the sessions or after a defined period of inactivity, so that connections do not remain open and available for misuse after their use has ended. It is a one-point requirement and may be deferred on a plan of action.
An open network connection that outlives its purpose is a standing opportunity: an abandoned session that is still connected can be resumed by someone else, and idle connections consume the boundary's attention. This control requires terminating connections at the end of their sessions or after a defined period of inactivity, so that connections close when done rather than lingering. The three assessment objectives are defining the inactivity period, terminating connections at session end, and terminating them after the defined period of inactivity.
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
The requirement pairs an event trigger with a time trigger: connections terminate at the end of a session, and also after a defined period of inactivity. The assessment objectives make explicit that the inactivity period is defined and that connections are terminated on either trigger. This ensures a connection does not persist indefinitely, whether the session ended cleanly or simply went idle.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.13.9 into three objectives: define the inactivity period, terminate connections at session end, and terminate connections after the defined period of inactivity.
A period of inactivity to terminate network connections associated with communications sessions is defined. The idle timeout is set.
Network connections associated with communications sessions are terminated at the end of the sessions. Connections close when the session ends.
Network connections associated with communications sessions are terminated after the defined period of inactivity. Connections close on idle timeout.
The three objectives are the defined period and the two termination triggers. The common gap is at objective [c], where connections are not actually closed on inactivity, so idle sessions persist. The assessor looks for a defined inactivity period and connections terminated on both triggers.
3Failure Patterns
The failures are about connections that linger.
No idle timeout
Connections that never time out on inactivity remain open indefinitely. A defined inactivity period and enforced timeout close them.
Sessions not terminated at end
Connections left open after a session ends remain available for resumption. Terminating at session end closes them.
Period defined but not enforced
An inactivity period on paper that the system does not enforce leaves connections open. The termination has to actually occur.
4Ownership
This is an IT and network-owned control.
| Role | Responsibility for this control |
|---|---|
| IT and network | Configures session and connection termination on end and inactivity. Owns the configuration evidence. |
| Security or compliance lead | Defines the inactivity period and confirms termination is enforced. |
| Program lead | Documents the defined inactivity period. |
5Tooling
The control is delivered by session and connection timeout configuration.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | Defined inactivity period | The idle timeout value. |
| [b], [c] | Session and connection timeout enforcement | Termination at session end and after inactivity. |
The caveat is that termination has to be enforced on both triggers. A defined period that the system ignores, or termination at session end without an idle timeout, leaves connections open. The assessor examines the defined period and enforced termination, so both objectives have to hold.
6Evidence
The satisfied version of 3.13.9 shows connections terminated on end and inactivity.
| Evidence | What it demonstrates |
|---|---|
| Defined inactivity period | Objective [a]. The idle timeout. |
| Timeout configuration | Objectives [b], [c]. Connections terminated on end and inactivity. |
The evidence should show a defined inactivity period and connections terminated at session end or after that period. The defined period together with the timeout configuration is the clearest demonstration of the control.
A connection should close when its use ends
An open connection that outlives its session is a standing entry point, so this control asks that connections terminate at session end or after a defined inactivity period. Configuring that termination is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.13.9. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.13.9[a] through 3.13.9[c]. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov