I've tried to find such a standard that mention the lifetime of SME OTP, however, NIST is no longer recommended using SMS OTP due to the risk involved.
Regardless of the security concerns, I still need to implement SMS OTP and would like to know the standard criteria in implementing SMS OTP. What should be the lifetime, How long should the user wait until he can request for another OTP, can the user request the same OTP again?