How long before system timeout should a warning appear?
On a service which includes a lot of sensitive info in digital input forms, how long before timeout should you display a warning message?
Someone proposed a 15 minute session with a timeout warning at five minutes, but I suspect (but can't justify why) that that will be annoying and there's a reason warnings usually come at one or two minutes from timeout.
Is there a best practice guide for this, or particular reason that warnings are usually shortly before timeout?
Cheers