Does anyone know if there is a way to extend the length of time before SCA will consider a session to be expired and require login again?

Not possible. But can possibly be done through a custom solution.

Session timeouts are mandated by PCI guidelines. The best solution I have seen is trying to time how long the session has been active for and then asking the user if they're still there -- clicking yes refreshes the session by making an arbitrary AJAX call to the system. However, just make sure that you are not automatically refreshing the session (that would be against PCI guidelines).

Can you provide where this is found in the PCI guidelines? At first glance, I believe you are referring to requirement 8.1.8 in https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf which states:

If a session has been idle for
more than 15 minutes, require the user
to re-authenticate to re-activate the
terminal or session.

However, after taking a further look, it does not appear that 8.1.8 is required for customer facing accounts given the following text from that document:

Note: These requirements are applicable for all accounts, including point-of-sale accounts, with administrative capabilities and all accounts used
to view or access cardholder data or to access systems with cardholder data. This includes accounts used by vendors and other third parties (for
example, for support or maintenance).

However, Requirements 8.1.1, 8.2, 8.5, 8.2.3 through 8.2.5, and 8.1.6 through 8.1.8 are not intended to apply to user accounts within a point-ofsale payment application that only have access to one card number at a time in order to facilitate a single transaction (such as cashier accounts).

Is it possible that we could extend the user session without breaking PCI compliance, or is there a different section of the document that I should be looking at?

I don't see how the secondary paragraph applies in this situation.

Our thought process was that the second paragraph indicated that customer accounts did not need to follow requirement 8.1.8, as this rule was intended for accounts with admin capabilities. I just wanted to ask because we wanted to check if we were either misinterpreting this section or missing some other key information that would guide us towards the shorter solution.

I think you missed the part where it says "all accounts used to view or access cardholder data or to access systems with cardholder data".

Ah, sorry. I sent over that paragraph and document from an older version of the document. Here is the updated document (https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf?agreement=true&time=1602534450703) and text:

Note: These requirements are applicable for all accounts, including point-of-sale accounts, with administrative capabilities and all accounts used
to view or access cardholder data or to access systems with cardholder data. This includes accounts used by vendors and other third parties (for
example, for support or maintenance). These requirements do not apply to accounts used by consumers (e.g., cardholders).

However, Requirements 8.1.1, 8.2, 8.5, 8.2.3 through 8.2.5, and 8.1.6 through 8.1.8 are not intended to apply to user accounts within a point-ofsale payment application that only have access to one card number at a time in order to facilitate a single transaction (such as cashier accounts).

I think the statement *"These requirements do not apply to accounts used by consumers (e.g., cardholders).*" is specifically what we are looking at when making this argument. We are hoping to be able to utilize a longer session time with that text in mind. Given this updated text and document, would you agree with our conclusion that we can provide a user session longer than 30 minutes, or do you think we are missing something here? I appreciate you taking the time to work through this with me!

@Steve Goldberg what are your thoughts on this?

I have asked our security team for their position, as well as an architect about the feasibility of implementing this (if applicable).

Thanks for the detailed response Steve! Greatly appreciate it. I’ll be excited to hear what NetSuite decides on going forward.

Awesome, thanks Steve! I fully understand that it will need stringent checks being a security measure and look forward to what comes of this!