The large standards (ISO, NIST) tend toward one-size fits all, the real intent is to promote careful consideration, and deliberate and informed decision making. Specific values such as these are a property of a good policy implementation, the slightly abstract standards tend to only recommend maxima or minima, if even.
Such a "control" is typically assigned a persistent, unique identifier by a particular standard, the common ones are suitable here are AC-11 and SC-10 (from NIST SP800-53(PDF) ) and FTA_SSL (from ISO/IEC 15408, aka Common Criteria for Information Technology Security Evaluation, "FTA" is the class of access control, "SSL" refers to session locking).
Roughly from more-specific to less-specific:
OMB M-06-16 (PDF) U.S. Presidential Memorandum Protection of Sensitive Agency Information
3. Use a "time-out" function for remote access and mobile devices requiring user re-
authentication after 30 minutes inactivity; and
Australian DSD Information Security Manual 2013 Controls
Session and Screen locking, Control 0427
· configure the lock to activate either:
- after a maximum of 15 minutes of system user inactivity
- if manually activated by the system user
(see also control 0428 which states 10 minutes for "confidential" and "secret" levels).
Unchanged in 2014 edition.
U.S. CNSS CNSSI-1253 Security Categorization And Control Selection For National Security Systems
Control AC-11 Session lock
...not to exceed 30 minutes
NIST SP800-53 Recommended Security Controls for Federal Information Systems and Organizations
Guide to Enterprise Telework and Remote Access Security
Control AC-11 Session Lock: Timeout is "organization defined"
(See also Canadian ITSG-41)
Control SC-10 Network Disconnect
SP800-46 suggests 15 minutes as appropriate for remote access (page 4-3)
8.5.15 If a session has been idle for
more than 15 minutes, require the user
to re-authenticate to re-activate the
terminal or session.
(in v3 the requirement has been renumbered to 8.1.8, but otherwise unchanged)
12.3.8 Automatic disconnect of sessions
for remote-access technologies after a
specific period of inactivity
U.S. FBI/DoJ CJISD-ITS-DOC-08140-5.2 Criminal Justice Information Services Security Policy
5.5.5 Session Lock
The information system shall prevent further access to the system by initiating a session lock after a maximum of 30 minutes of inactivity, and the session lock remains in effect until [...]
ECMA ECMA-271 Extended Commercially Oriented Functionality Class for Security Evaluation
188.8.131.52 Session lock or terminate
The TOE shall support a session lock. The TOE shall provide an idle process monitor for each front-end
which inhibits after a customer defined amount of time user interactions except user authentication.
Rather old (December 1999) the same time frame as ISO/IEC 17799:2000, sadly never updated by ECMA. TOE is Target Of Evaluation, some Common Criteria terminology.
ISO 27001:2005(E)/ISO 27002:2005(E)(see this document for a useful overview)
Control A.11.3.3 Clear desk and clear screen policy
The clear desk and clear screen policy should take into account the information classifications (see 7.2), legal and contractual requirements (see 15.1), and the corresponding risks and cultural aspects of the organization.
See also §11.5.5 Session time-out
Council On CyberSecurity Critical Security Controls v5.1
CSC 16-6 Configure screen locks on systems to limit access to
CERT Knowledge and Information Management (KIM)
KIM:SG4.SP2 Control Access to Information Assets
[...] The organization must decide upon the right mix of controls to
address the various forms of the information asset and any special
considerations of the asset.
There's absolutely nothing wrong with using your own values once you have properly defined your risks and requirements, and documented the decisions. You may even decide on session lock exemptions (e.g. in the case of air traffic control, or locations with enhanced physical security), or mandate proximity devices.