Executive Summary
CMMC objective AC.L2-3.13.9[b] requires documented definitions of inactivity periods before session termination. Organizations must define timeout values based on session type and risk level. Leadership must confirm documentation and evidence of implementation across all CUI-bearing systems.