Which PCI DSS requirement specifies automatic disconnect of remote-access sessions after inactivity?

Which PCI DSS requirement specifies automatic disconnect of remote-access sessions after inactivity?

• A. Requirement 12.3.5
• B. Requirement 12.3.8
• C. Requirement 12.2
• D. Requirement 12.3.9

Answer: (B)

Automatic termination of idle remote-access sessions is a control that reduces the risk of session hijacking by ensuring that a remote connection is closed if no activity occurs for a defined period. In PCI DSS, the remote-access requirements include several controls for securely connecting to the Cardholder Data Environment, and one specific sub-control requires remote sessions to be automatically disconnected after inactivity. This exact idle-timeout measure is what protects systems from unattended or forgotten sessions being exploited. The other remote-access controls focus on authentication, encryption, and secure channels, but they do not specify the idle-disconnect behavior as explicitly.

Automatic termination of idle remote-access sessions is a control that reduces the risk of session hijacking by ensuring that a remote connection is closed if no activity occurs for a defined period. In PCI DSS, the remote-access requirements include several controls for securely connecting to the Cardholder Data Environment, and one specific sub-control requires remote sessions to be automatically disconnected after inactivity. This exact idle-timeout measure is what protects systems from unattended or forgotten sessions being exploited. The other remote-access controls focus on authentication, encryption, and secure channels, but they do not specify the idle-disconnect behavior as explicitly.