BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

system_settings_screensaver_ask_for_password_delay_enforce Enforce Session Lock After Screen Saver is Started

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded System Settings

Title

Enforce Session Lock After Screen Saver is Started

Control

/usr/bin/osascript -l JavaScript << EOS
function run() {
let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\
.objectForKey('askForPasswordDelay'))
if ( delay <= $ODV ) {
return("true")
} else {
return("false")
}
}
EOS

Discussion

A screen saver _MUST_ be enabled and the system _MUST_ be configured to require a password to unlock once the screensaver has been on for a maximum of $ODV seconds.

An unattended system with an excessive grace period is vulnerable to a malicious user.

Related controls

ac-11

Fix

This is implemented by a Configuration Profile.