AC-11 Device Lock
Guidance: draftPolicy clause: draftWhat these mean
ac11ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Moderate, High | System | 1 (1 in a baseline) |
Related controls: AC-2, AC-7, IA-11, PL-4
Control statement
Section titled “Control statement”- a. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and
- b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
NIST discussion
Device locks are temporary actions taken to prevent logical access to organizational systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences. Device locks can be implemented at the operating system level or at the application level. A proximity lock may be used to initiate the device lock (e.g., via a Bluetooth-enabled device or dongle). User-initiated device locking is behavior or policy-based and, as such, requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of systems, such as when organizations require users to log out at the end of workdays.
Control enhancements
Section titled “Control enhancements”AC-11(1) Pattern-hiding Displays
Section titled “AC-11(1) Pattern-hiding Displays”Baselines: Moderate, High
Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Discussion and assessment objectives for AC-11(1)
The pattern-hiding display can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.
Determine if information previously visible on the display is concealed, via device lock, with a publicly viewable image.
Examine: Access control policy; procedures addressing session lock; display screen with session lock activated; system design documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: System session lock mechanisms.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for AC-11
Determine if:
- AC-11a. further access to the system is prevented by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended];
- AC-11b. device lock is retained until the user re-establishes access using established identification and authentication procedures.
Examine: Access control policy; procedures addressing session lock; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; security plan; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.
Test: Mechanisms implementing access control policy for session lock.
Policy statement
- The System owner shall ensure the system prevents further access by Select one or more: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended Typical: initiating a device lock after 15 minutes of inactivity, and requiring the user to initiate a device lock before leaving the system unattended. (AC-11a)
- The System owner shall ensure the device lock remains until the user reestablishes access using the established identification and authentication procedures. (AC-11b)
AC-11(1) Pattern-hiding displays
- The System owner shall ensure the device lock conceals information previously visible on the display with a publicly viewable image. (AC-11(1))
From the Access Control Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”AC-11 covers the moment a user walks away without logging out. The device locks after a set period of inactivity, users lock it themselves before they leave, and unlocking needs the same identification and authentication as logging on. AC-11(1), in the Moderate baseline, adds that the lock screen hides whatever was on the display.
A device lock is not a logout. NIST’s discussion says it is no substitute for logging out at the end of the workday, which AC-2(5) asks users to do. Ending a session altogether is AC-12.
Common implementations. An inactivity lock set by group policy or device management on every workstation and laptop (on Windows, the machine inactivity limit), and a screen lock and passcode enforced on mobile devices. The lock screen shows a blank screen, a clock or an organization image, never a live preview of the desktop or of notification content (AC-11(1)). Servers and administrator consoles lock too, including remote desktop sessions. The Rules of Behavior tell users to lock their screen when they step away, which covers the user-initiated half of item a.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| How the system prevents further access (a) | Both: a device lock after 15 minutes of inactivity, and the user locking the device before leaving it unattended |
| Inactivity period before the device locks (a) | 15 minutes |
AC-11(1) has no parameters.
Evidence assessors ask for.
- The group policy or device management profile setting the inactivity lock and lock screen, for workstations and mobile devices
- A demonstration: the assessor leaves a workstation idle and checks that it locks on time, hides the screen, and needs authentication to unlock
- Settings for servers and remote desktop sessions, where they differ from workstations
- The Rules of Behavior or training content telling users to lock their devices
Inheritance. Workstation and mobile device settings are usually common controls, pushed by the organization’s device management. The system owns the lock on its own servers, consoles and any devices outside central management.
Common findings.
- Inactivity periods longer than the policy states, or set by users rather than enforced.
- Kiosks, shared workstations, operations center screens or lab machines exempted with no documented decision.
- Lock screens that show notification content or a preview of open windows.
- Remote desktop and virtual desktop sessions that never lock.
Enhancements in the Moderate baseline. AC-11(1) pattern-hiding displays.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.