The app must close any opened network ports at the end of the app session or after a period of inactivity as defined by the organization using the app. Ports that are not closed upon termination of an app or following a pre-defined period of inactivity leave the device vulnerable to exposure from attacks that exploit ports that remain open