2.2.1 applies to each time-out "that is a function of the content". Does that include time-outs that are applied by the server software, and of which the Web unit may have no knowledge (e.g. session timing out from inactivity)? Clarification is needed. The Understanding document addresses this but fails to clarify it, but it looks like server-based session time-outs would be non-conforming.
Proposed Change:
"Remove the phrase ""that is a function of the content"".
Add clarification of server-based session time-outs to the Understanding document or the SC itself."
The Success Criterion has been changed to clarify that it was intended that only time limits set by the content are in scope, and additional clarification has been added to the How to Meet document.