From a compliance perspective, it would be beneficial to enforce a global session limit of 30 or 60 minutes, rather than allowing individual users to configure their own limits. This would allow us to state a definitive session limit value for compliance purposes, such as in our SSP for CMMC L2.