AC-11 Device Lock
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Device Lock
Control
a. Prevent further access to the system by [Selection (one or more): initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and
b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
Discussion
Device locks are temporary actions taken to prevent logical access to organizational systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences. Device locks can be implemented at the operating system level or at the application level. A proximity lock may be used to initiate the device lock (e.g., via a Bluetooth-enabled device or dongle). User-initiated device locking is behavior or policy-based and, as such, requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of systems, such as when organizations require users to log out at the end of workdays.
Parameters
ac-11_odp.01: [initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended]
ac-11_odp.02: time period
Related controls
ac-2, ac-7, ia-11, pl-4
STIG rules that implement this control 42
Apple iOS/iPadOS 26 V1R3
- AIOS-26-006800 CAT II Apple iOS/iPadOS 26 must be configured to lock the display after 15 minutes (or less) of inactivity.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-006300 CAT II Apple iOS/iPadOS 27 (MOS) must be configured to lock the display after 15 minutes (or less) of inactivity.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000001 CAT II The macOS system must prevent Apple Watch from terminating a session lock.
- APPL-15-000002 CAT II The macOS system must enforce screen saver password.
- APPL-15-000003 CAT II The macOS system must enforce session lock no more than five seconds after screen saver is started.
- APPL-15-000005 CAT II The macOS system must configure user session lock when a smart token is removed.
- APPL-15-000070 CAT II The macOS system must enforce screen saver timeout.
- APPL-15-002090 CAT II The macOS system must disable TouchID for unlocking the device.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000001 CAT II The macOS system must prevent Apple Watch from terminating a session lock.
- APPL-26-000002 CAT II The macOS system must enforce screen saver password.
- APPL-26-000003 CAT II The macOS system must enforce session lock no more than five seconds after screen saver is started.
- APPL-26-000005 CAT II The macOS system must configure user session lock when a smart token is removed.
- APPL-26-000070 CAT II The macOS system must enforce screen saver timeout.
- APPL-26-002090 CAT II The macOS system must disable TouchID for unlocking the device.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-271020 CAT II Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.
- UBTU-22-271025 CAT II Ubuntu 22.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.
- UBTU-22-412025 CAT II Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-101000 CAT II Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.
- UBTU-24-200020 CAT II Ubuntu 24.04 LTS must initiate a graphical session lock after 10 minutes of inactivity.
- UBTU-24-200040 CAT II Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface automount function.
- UBTU-24-200042 CAT II Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user smart card removal action.
Google Android 16 COBO Y26M10
- GOOG-16-006300 CAT II Google Android 16 must be configured to lock the display after 15 minutes (or less) of inactivity.
Google Android 17 COBO Y26M06
- GOOG-17-005200 CAT II Google Android 17 must be configured to lock the display after 15 minutes (or less) of inactivity.
Microsoft Windows 11 V2R11
- WN11-CC-000365 CAT II Windows 11 must be configured to prevent Windows apps from being activated by voice while the system is locked.
Microsoft Windows Server 2022 V2R11
- WN22-SO-000120 CAT II Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
Microsoft Windows Server 2025 V1R4
- WN25-SO-000120 CAT II Windows Server 2025 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-700730 CAT II RHEL 10 must prevent a user from overriding the disabling of the graphical user smart card removal action.
- RHEL-10-700740 CAT II RHEL 10 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
- RHEL-10-700750 CAT II RHEL 10 must automatically lock graphical user sessions after 10 minutes of inactivity.
- RHEL-10-700760 CAT II RHEL 10 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
- RHEL-10-700770 CAT II RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated.
- RHEL-10-700780 CAT II RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-271045 CAT II RHEL 9 must be able to initiate directly a session lock for all connection types using smart card when the smart card is removed.
- RHEL-09-271050 CAT II RHEL 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.
- RHEL-09-271055 CAT II RHEL 9 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
- RHEL-09-271060 CAT II RHEL 9 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
- RHEL-09-271065 CAT II RHEL 9 must automatically lock graphical user sessions after 10 minutes of inactivity.
- RHEL-09-271070 CAT II RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
- RHEL-09-271075 CAT II RHEL 9 must initiate a session lock for graphical user interfaces when the screensaver is activated.
- RHEL-09-271080 CAT II RHEL 9 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
- RHEL-09-412035 CAT II RHEL 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.
Samsung Android 16 COBO Y26M10
- KNOX-16-005100 CAT II Samsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.