`AC-11(01)` Pattern-hiding Displays

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded AC Moderate baseline High baseline part of AC-11

Title

Pattern-hiding Displays

Control

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Discussion

The pattern-hiding display can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.

Assessment objective

AC-11(01) information previously visible on the display is concealed, via device lock, with a publicly viewable image.

STIG rules that implement this control 25

Apple iOS/iPadOS 26 V1R3

AIOS-26-007500 CAT II Apple iOS/iPadOS 26 must be configured to not display notifications when the device is locked.
AIOS-26-007600 CAT II Apple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked.

Apple iOS/iPadOS 27 V1R1

AIOS-27-007100 CAT II Apple iOS/iPadOS 27 must be configured to not display notifications when the device is locked.
AIOS-27-007200 CAT II Apple iOS/iPadOS 27 must not display notifications (calendar information) when the device is locked.

Apple macOS 15 (Sequoia) V1R8

APPL-15-000007 CAT II The macOS system must disable hot corners.
APPL-15-000009 CAT II The macOS system must prevent AdminHostInfo from being available at LoginWindow.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000007 CAT II The macOS system must disable hot corners.
APPL-26-000009 CAT II The macOS system must prevent AdminHostInfo from being available at LoginWindow.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-412025 CAT II Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-101000 CAT II Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.
UBTU-24-200043 CAT II Ubuntu 24.04 LTS must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Google Android 16 COBO Y26M10

GOOG-16-006800 CAT II Google Android 16 must be configured to not display the following (work profile) notifications when the device is locked: [selection: a. email notifications b. calendar appointments c. contact associated with phone call notification d. text message notification e. other application-based notifications f. all notifications].

Google Android 17 COBO Y26M06

GOOG-17-005800 CAT II Google Android 17 must be configured to not display the following (work profile) notifications when the device is locked: [selection: - Email notifications - Calendar appointments - Contact associated with phone call notifications - Text message notifications - Other application-based notifications - All notifications].

Microsoft Windows 11 V2R11

WN11-CC-000385 CAT II Windows Ink Workspace must be configured to disallow access above the lock.

Microsoft Windows Server 2022 V2R11

WN22-SO-000120 CAT II Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.

Microsoft Windows Server 2025 V1R4

WN25-SO-000120 CAT II Windows Server 2025 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-700750 CAT II RHEL 10 must automatically lock graphical user sessions after 10 minutes of inactivity.
RHEL-10-700760 CAT II RHEL 10 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
RHEL-10-700770 CAT II RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated.
RHEL-10-700780 CAT II RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
RHEL-10-700790 CAT II RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-271065 CAT II RHEL 9 must automatically lock graphical user sessions after 10 minutes of inactivity.
RHEL-09-271070 CAT II RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
RHEL-09-271085 CAT II RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Samsung Android 16 COBO Y26M10

KNOX-16-005800 CAT II Samsung Android must be configured to not display the following (Work Environment) notifications when the device is locked: All notifications.

AC-11(01) Pattern-hiding Displays