Login Logistics

Are there any best practices for enforcing any kind of automatic timeout for logins?