SC-10, Network Disconnect, asks the organization to terminate the network connection tied to a communications session at the end of the session or after an organization defined period of inactivity. You pick the time.
800-53 binds US federal systems, and others through contract. For the rest it is a reference, and idle session timeouts are a common questionnaire item.
What it means in practice
The guidance says this applies to internal and external networks. At the operating system level it means releasing the address and port pairs. At the application level it means releasing network assignments when several application sessions share one connection. Inactivity periods can differ by type of access.
Evidence to collect
- The policy that states the inactivity period for each access type.
- Configuration exports from VPN, bastion hosts, load balancers and SSH servers showing idle timeouts.
- A test record showing a session actually dropped after the period.
Common gaps
Timeouts set on the web app but not on the VPN or the admin shell. Another gap is a stated value of fifteen minutes with a configured value of never.
How to implement it
List every remote access path, set an idle timeout on each, and write down the number. Test it, then keep the test result.
A small worked example
A company lists four access paths: the VPN, the bastion host, the admin console and the database client. The VPN drops idle sessions after thirty minutes, the bastion after fifteen, the console after ten. The database client had no limit, so it was fixed and retested. The test log and the settings export become the evidence.
Quick check
Who decides the inactivity period?
The organization, and it may vary by type of network access.
