AC-11(01) Pattern-hiding Displays
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Pattern-hiding Displays
Control
Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Discussion
The pattern-hiding display can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.
Assessment objective
AC-11(01) information previously visible on the display is concealed, via device lock, with a publicly viewable image.
STIG rules that implement this control 25
Apple iOS/iPadOS 26 V1R3
- AIOS-26-007500 CAT II Apple iOS/iPadOS 26 must be configured to not display notifications when the device is locked.
- AIOS-26-007600 CAT II Apple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-007100 CAT II Apple iOS/iPadOS 27 must be configured to not display notifications when the device is locked.
- AIOS-27-007200 CAT II Apple iOS/iPadOS 27 must not display notifications (calendar information) when the device is locked.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000007 CAT II The macOS system must disable hot corners.
- APPL-15-000009 CAT II The macOS system must prevent AdminHostInfo from being available at LoginWindow.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000007 CAT II The macOS system must disable hot corners.
- APPL-26-000009 CAT II The macOS system must prevent AdminHostInfo from being available at LoginWindow.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-412025 CAT II Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-101000 CAT II Ubuntu 24.04 LTS must allow users to directly initiate a session lock for all connection types.
- UBTU-24-200043 CAT II Ubuntu 24.04 LTS must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Google Android 16 COBO Y26M10
- GOOG-16-006800 CAT II Google Android 16 must be configured to not display the following (work profile) notifications when the device is locked: [selection: a. email notifications b. calendar appointments c. contact associated with phone call notification d. text message notification e. other application-based notifications f. all notifications].
Google Android 17 COBO Y26M06
- GOOG-17-005800 CAT II Google Android 17 must be configured to not display the following (work profile) notifications when the device is locked: [selection: - Email notifications - Calendar appointments - Contact associated with phone call notifications - Text message notifications - Other application-based notifications - All notifications].
Microsoft Windows 11 V2R11
- WN11-CC-000385 CAT II Windows Ink Workspace must be configured to disallow access above the lock.
Microsoft Windows Server 2022 V2R11
- WN22-SO-000120 CAT II Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
Microsoft Windows Server 2025 V1R4
- WN25-SO-000120 CAT II Windows Server 2025 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-700750 CAT II RHEL 10 must automatically lock graphical user sessions after 10 minutes of inactivity.
- RHEL-10-700760 CAT II RHEL 10 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
- RHEL-10-700770 CAT II RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated.
- RHEL-10-700780 CAT II RHEL 10 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
- RHEL-10-700790 CAT II RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-271065 CAT II RHEL 9 must automatically lock graphical user sessions after 10 minutes of inactivity.
- RHEL-09-271070 CAT II RHEL 9 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
- RHEL-09-271085 CAT II RHEL 9 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Samsung Android 16 COBO Y26M10
- KNOX-16-005800 CAT II Samsung Android must be configured to not display the following (Work Environment) notifications when the device is locked: All notifications.