Network Disconnect SC-10

System and Communications Protection · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-10 (Network Disconnect) says an idle or finished network session should not stay open forever. When a communications session ends — or after a set period of inactivity — the system should tear down the network connection, so that an abandoned session cannot be picked up or left as an open door. It is an SC (System and Communications Protection) control in the Moderate baseline.

What good looks like

Terminate the network connection at the end of a session — not just log the user out of the application riding on top of it.
Set an inactivity timeout so idle sessions are dropped after a defined period; you choose the length based on risk.
Apply this to your remote-access paths first — SSH (Secure Shell) especially, since it is the main door into a Linux server.
Release the connection resources when a session closes — the TCP/IP (Transmission Control Protocol/Internet Protocol) address pairing — so nothing is left half-open.
Match the timeout to the access type: a public-facing admin session should time out sooner than a low-risk internal one.

Framework mapping

How to move it toward Implemented

Set an SSH idle timeout — ClientAliveInterval 300 and ClientAliveCountMax 0 in /etc/ssh/sshd_config — then reload sshd.
Add a shell inactivity timeout for interactive logins (TMOUT=900 in a file under /etc/profile.d/) so abandoned terminals close on their own.
Where a session-based service supports its own idle disconnect, set it, then confirm old connections actually drop with ss -tnp before and after the timeout, and save those captures as one dated file.
Attach that dated file as hardening evidence on the asset, naming SC-10 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.