AC-11 AC · Access Control

Device Lock

LOW ✓ MODERATE ✓ HIGH
1 Enhancement 1 Overlay 4 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Device locks are temporary actions taken to prevent logical access to organizational systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences. Device locks can be implemented at the operating system level or at the application level. A proximity lock may be used to initiate the device lock (e.g., via a Bluetooth-enabled device or dongle). User-initiated device locking is behavior or policy-based and, as such, requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of systems, such as when organizations require users to log out at the end of workdays.

Enhancements NIST SOURCE

AC-11(1) Pattern-hiding Displays LOW ✓ MODERATE ✓ HIGH

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Discussion

The pattern-hiding display can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.

Open full page for AC-11(1) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for AC-11 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. one or more of the following PARAMETER VALUES is/are selected: {initiating a device lock after <AC-11_ODP[02] time period> of inactivity; requiring the user to initiate a device lock before leaving the system unattended};
  2. time period of inactivity after which a device lock is initiated is defined (if selected);
  3. further access to the system is prevented by <AC-11_ODP[01] SELECTED PARAMETER VALUES>;
  4. device lock is retained until the user re-establishes access using established identification and authentication procedures.

Examine

[SELECT FROM: Access control policy; procedures addressing session lock; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; security plan; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing access control policy for session lock].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

  • Base control: Included (matches standard baseline)
  • Included: (1)

HIGH

  • Base control: Included (matches standard baseline)
  • Included: (1)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for AC-11. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Access control policy
  • security plan
  • system security plan

Configuration

  • system design documentation
  • system configuration settings and associated documentation

Testing

  • Mechanisms implementing access control policy for session lock

Other Records

  • procedures addressing session lock
  • procedures addressing identification and authentication
  • other relevant documents or records