I'm wondering if there's a specific 'standard' time for logging users out of a website that contains sensitive information and data. I am thinking that kicking them off the website in 24 hours could be a little inconvenient and frustrating, so extending the session time beyond 24 hours might be an option. Does anyone know any other options/solutions for this matter?
As per maxathousand's comment: it should be based on a risk assessment. I would add that it should also be based on consideration of you users and their routines.
The existence of session windows allows a User to access a system without having to relog, sometimes it may go further in allowing a User to pick-up where they left-off (i.e. avoid having to repeat certain hurdles again). Choosing a session window of 24 hours is like saying: the User logged in and did something, but if they are going to continue to do that tomorrow they will be doing it at an earlier time of day than today.
As you can see, that won't fit most peoples' routines (if they have routines). E.g. if someone finished work, got home, and started using your system then had to leave to do other things, you leave them a very narrow practical window to reuse that session the next day (assuming they have work finishing at the same time).