SC-10 Network Disconnect
Guidance: draftPolicy clause: draftWhat these mean
sc10ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Moderate, High | System | None |
Related controls: AC-17, SC-23
Control statement
Section titled “Control statement”Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.
NIST discussion
Network disconnect applies to internal and external networks. Terminating network connections associated with specific communications sessions includes de-allocating TCP/IP address or port pairs at the operating system level and de-allocating the networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. Periods of inactivity may be established by organizations and include time periods by type of network access or for specific network accesses.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for SC-10
Determine if the network connection associated with a communication session is terminated at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Examine: System and communications protection policy; procedures addressing network disconnect; system design documentation; security plan; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.
Test: Mechanisms supporting and/or implementing a network disconnect capability.
Policy statement
- The System owner shall ensure the system terminates the network connection associated with a communications session at the end of the session or after Fill in: a time period of inactivity after which the system terminates a network connection associated with a communication session Typical: 30 minutes of inactivity. (SC-10)
From the System and Communications Protection Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”SC-10 asks you to end the network connection behind a communications session when the session ends, or after a set time with no activity. NIST’s discussion says it applies to internal and external networks, and that ending the connection means releasing the TCP/IP address and port pair in the operating system, and the application’s network assignment where several application sessions share one connection. It differs from AC-12 session termination, which ends the user’s logical session: a session can end while its connection stays up, and the reverse. SC-10 is in the Moderate and High baselines, not Low.
Common implementations. Idle timeouts on the places where connections are held open for a person or a remote system:
- The VPN or zero trust access service, and remote desktop and virtual desktop gateways
- SSH servers and administrator consoles, set to drop idle connections rather than keep them alive
- Load balancers, reverse proxies and application gateways, which close idle client and back-end connections
- Firewall and security group session tables, which drop idle flows
- Database and message queue servers, which close idle client connections
NIST’s discussion lets you set periods by type of network access. A single organization-wide value is simpler to test; shorter periods on some devices, such as load balancers, still meet it.
Organization-defined parameters. Typical value, from the System and Communications Protection policy, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Period of inactivity before the network connection ends | 30 minutes |
The value matches the 30 minutes of inactivity the AC-12 clause sets for remote and web sessions, so the session and its connection end together. If you shorten one, shorten the other.
Evidence assessors ask for.
- Idle timeout settings on the remote access service, remote desktop gateways, SSH servers, load balancers and firewalls
- A demonstration: the assessor leaves a remote access or SSH connection idle past the limit and confirms it is dropped
- The system security plan entry stating the inactivity period, and any shorter periods by type of access
- Configuration baselines or scan results showing the timeout settings across components
Inheritance. The remote access service, the enterprise firewalls and the cloud provider’s load balancers are often common controls, and the provider may fix some timeouts. The system owns the timeouts on its own servers, gateways and databases, so SC-10 is usually a hybrid control.
Common findings.
- VPN or remote desktop idle timeouts disabled, or set to hours or days.
- SSH servers or clients with keep-alive settings that hold idle connections open indefinitely.
- Timeouts set on the remote access service but not on the servers behind it.
- A network disconnect period longer than the AC-12 session timeout, so a connection outlives its session.
Enhancements in the Moderate baseline. SC-10 has no enhancements.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.