STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Okta must log out a session after a 15-minute period of inactivity.

DISA Rule

SV-273186r1098825_rule

Vulnerability Number

V-273186

Group Title

SRG-APP-000003

Rule Version

OKTA-APP-000020

Severity

CAT II

CCI(s)

• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.
• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

From the Admin Console:
1. Go to Security >> Global Session Policy.
2. Select the Default Policy.
3. In the Rules table, make these updates:
- Click "Add rule".
- Set "Maximum Okta global session idle time" to 15 minutes.

Check Contents

From the Admin Console:
1. Select Security >> Global Session Policy.
2. In the Default Policy, verify a rule is configured at Priority 1 that is not named "Default Rule".
3. Click the edit icon next to the Priority 1 rule.
4. Verify the "Maximum Okta global session idle time" is set to 15 minutes.

If "Maximum Okta global session idle time" is not set to 15 minutes, this is a finding.

Vulnerability Number

V-273186

Documentable

False

Rule Version

OKTA-APP-000020

Severity Override Guidance

From the Admin Console:
1. Select Security >> Global Session Policy.
2. In the Default Policy, verify a rule is configured at Priority 1 that is not named "Default Rule".
3. Click the edit icon next to the Priority 1 rule.
4. Verify the "Maximum Okta global session idle time" is set to 15 minutes.

If "Maximum Okta global session idle time" is not set to 15 minutes, this is a finding.

Check Content Reference

M

Target Key

5694