Does your application automatically lock the session or log out an account after a period of inactivity?

This question is asking whether your application has automatic session timeout functionality that either locks a user's session or logs them out completely after a period of inactivity. Why this matters: Unattended, active sessions pose a significant security risk. If a user walks away from their device without logging out or locking it, someone else could access the application with their privileges. Automatic session timeouts are a basic security control that mitigates this risk by terminating or suspending access after a predetermined period of inactivity. This question is being asked in a security assessment because: 1. It addresses the principle of least privilege by ensuring access is available only when actively needed 2. It helps prevent unauthorized access through abandoned sessions 3. It's a requirement in many security frameworks and regulations (like NIST 800-53, PCI DSS, HIPAA) 4. It demonstrates basic security hygiene in your application design When answering this question, you should: - Clearly state whether your application has automatic session timeout functionality - Specify the default timeout period (e.g., 15 minutes, 30 minutes) - Mention if the timeout period is configurable by administrators - Describe what happens when a timeout occurs (full logout vs. session lock requiring re-authentication) - Note any exceptions or special cases where timeouts might be handled differently