SC.L2-3.13.9
Connections Termination
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.9 in the reference catalog with its NIST cross-references
Official requirement
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
Assessment objectives
a. a period of inactivity to terminate network connections associated with communications sessions is defined;
b. network connections associated with communications sessions are terminated at the end of the sessions; and
c. network connections associated with communications sessions are terminated after the defined period of inactivity.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Terminate network connections at session end or after the defined inactivity period.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are an administrator of a server that provides remote access. Your company’s policies state that network connections must be terminated after being idle for 60 min utes [a]. You edit the server configuration file and set the timeout to 60 minutes and restart the remote access software [c]. You test the software and verify that the connection is terminated appropriately.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing network disconnect; system design documentation; system security plan; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Ending an application session while leaving its underlying network connection open unnecessarily.