The session timeout requirement is the maximum amount of time that a user can be inactive on an application before the session is terminated and the user is required to re-authenticate. The best reason for determining the session timeout requirement is the organization policy, as it reflects the organization's risk appetite, security objectives, and compliance obligations. The organization policy should specify the appropriate session timeout value for different types of applications and data, based on their sensitivity and criticality.

The best practice would require re-authentication after a period of inactivity, in addition to authentication at the start of the user session. Authentication is a process of verifying the identity or the credentials of a user or a device that requests access to a system or a resource. Re- authentication is a process of repeating the authentication after a certain condition or event, such as a change of location, a change of role, a change of privilege, or a period of inactivity. Re- authentication can help to enhance the security and the accountability of the access control, as it can prevent or detect the unauthorized or malicious use of the user or the device credentials, and it can ensure that the user or the device is still active and valid. Re-authenticating after a period of inactivity can help to prevent the unauthorized or malicious access by someone who may have gained physical access to the user or the device session, such as a co-worker, a visitor, or a thief.
Re-authenticating periodically during a session, for each business process, or at system sign-off are not the best practices, as they may not be necessary or effective for the security or the accountability of the access control, and they may cause inconvenience or frustration to the user or the device.

A common risk with network configuration management is that network diagrams are not up to date. Network configuration management is a process or a technique that monitors, controls, and maintains the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, to ensure or maintain the performance, the functionality, or the security of the system or the service. Network diagrams are graphical representations or visualizations of the network devices or the components within a system or a service, and their connections or relationships, such as the topology, the layout, or the architecture, that are used or applied for the network configuration management process or technique, to understand, to document, or to communicate the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls. A common risk with network configuration management is that network diagrams are not up to date, which means that the network diagrams do not reflect or represent the current or the accurate configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, due to the changes or the modifications that occur or happen in the system or the service, such as the addition, the removal, or the update of the network devices or the components within a system or a service, and due to the lack or the absence of the update or the maintenance of the network diagrams. Network diagrams that are not up to date can pose or present a risk or a challenge to the network configuration management process or technique, as they can cause or result in the confusion, the inconsistency, or the error in the monitoring, the control, or the maintenance of the configuration or the settings of the network devices or the components within a system or a service, such as the routers, the switches, or the firewalls, and as they can also affect or impact the performance, the functionality, or the security of the system or the service.

One way to mitigate the risk of security flaws in custom software is to include security assurance clauses in the Service Level Agreement (SLA) between the customer and the software developer.
The SLA is a contract that defines the expectations and obligations of both parties, such as the scope, quality, performance, and security of the software. By including security assurance clauses, the customer can specify the security requirements and standards that the software must meet, and the developer can agree to provide evidence of compliance and remediation of any defects.