# DoD Mandates Automated Session Termination

The Department of Defense (DoD) requires contractors handling Controlled Unclassified Information (CUI) to implement CMMC Level 2 requirement AC.L2-3.1.11, which mandates automatic termination of user sessions under specified conditions such as inactivity, policy violations, or maintenance events. This cybersecurity control aims to prevent unauthorized access through unattended sessions and applies across multiple platforms including Apple and Microsoft environments. Compliance with this requirement is essential for DoD contractors to maintain eligibility for contracts involving sensitive information.

- **Why this matters:** Procurement professionals should ensure contract solicitations and compliance assessments incorporate automated session termination controls aligned with CMMC Level 2 standards.
- Contractors must configure systems to enforce session termination policies, which may include inactivity timeouts, end-of-day session closures, or termination upon detected policy violations.
- This requirement impacts system design, security architecture, and ongoing compliance monitoring for DoD contracts involving CUI.
- Organizations providing cybersecurity solutions or IT services to DoD contractors can leverage this mandate to offer tailored compliance support and automated session management tools.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity
**Published:** September 28, 2026

### Government Entities
- Department of Defense (DoD)

### Key Quotes
> Configure the system to terminate user sessions based on the organization’s policy. Session termination policies can be simple or sophisticated. Examples are inactivity (end the session after a specified duration (e.g., one hour) of inactivity), day/time (all sessions are terminated at the end of the established workday), misbehavior (end the session due to an attempted policy violation), and maintenance (terminate sessions to prevent issues with an upgrade or service outage).
> — Original poster

### Sources
- [Requirement 3.1.11](https://www.reddit.com/r/CMMC/comments/1wsgbx1/requirement_3111) - reddit-cmmc