HUMAN VERIFICATION REQUIRED ASVS 7.1.1 Session-lifetime policy

The user's session inactivity timeout and absolute maximum session lifetime are documented, are appropriate in combination with other controls, and that the documentation includes justification for any deviations from NIST SP 800-63B re-authentication requirements.