---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable MID Server governance checks

# Enable MID Server governance checks {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers.
Unused MID Servers that remain active create bidirectional security risk. Their credentials can still authenticate to the ServiceNow instance, giving an attacker a valid entry point. While active, the instance can still issue commands to them, extending the attack surface of instance compromise into infrastructure no one is
monitoring.

With MID Server governance you can keep track of the last usage of each MID Server and create a policy to decommission it after a period of inactivity. The default inactivity timeout for MID Servers is 30 days.

Confirm that the mid.inactivity.timeout.enabled property exists in the System Properties \[sys_properties\] table and is set to true.

## More information {#sc-enable-mid-server-governance-checks__section_wc1_cqn_phc}

{#sc-enable-mid-server-governance-checks__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | mid.inactivity.timeout.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Security risk | * Severity score: 4.6 * CVSS rating: Medium * Security risk details: An attacker with access to an active MID Server could compromise the credential or impersonate the server and add output records to the ECC queue. An attacker wouldn't be able to use these credentials to horizontally traverse to other MID servers by inserting commands for them inside of ECC queue due to role restrictions on each MID Server user. {#sc-enable-mid-server-governance-checks__ul_g1g_3sf_xwb} |
| Functional impact | Inactive MID Servers are decommissioned on purpose. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-mid-server-governance-checks__table_ajc_b43_3kb}