User sessions must expire after a bounded period of inactivity

Control Statement: The instance must terminate user sessions after a bounded period, configured in line with the organisation’s documented policy.

Description: The UserSessionTimeout system setting defines the period after which a user session is terminated. This control requires it to be set to a bounded, non-zero value consistent with the organisation’s documented session policy. Creatio applies a default of 60 minutes.

Rationale: Session timeout bounds the window in which an unattended authenticated session can be used by someone other than its owner — a shared workstation, an unlocked laptop, or a browser left open on a device that later changes hands. It is also the only control that limits the useful life of a stolen session token: every other authentication control in this category governs how a session is obtained, and none of them apply once one exists. Where the setting has been raised to a large value for convenience, that change is rarely revisited and rarely recorded.

Audit Procedure:

1. Open System Designer → System settings.
2. Locate the setting with code UserSessionTimeout and record its configured value.
3. Record the instance as non-compliant if the value is unset, zero, or exceeds the organisation’s documented maximum.
4. Where the value materially exceeds the 60-minute default, confirm a recorded justification exists.

Remediation:

1. Determine the required timeout from the organisation’s session policy.
2. Set UserSessionTimeout to that value.
3. Where a longer timeout is genuinely required for an operational reason, record the justification in the system of record required by CSB-FDNS-001.
4. Verify the change by leaving a test session idle beyond the configured period.

Default Value: Creatio applies a default user session timeout of 60 minutes.