Control: ism-0428; Revision: 9; Updated: Dec-22; Applicability: ALL; Essential Eight: N/A
Systems are configured with a session or screen lock that:
- activates after a maximum of 15 minutes of user inactivity, or if manually activated by users
- conceals all session content on the screen
- ensures that the screen does not enter a power saving state before the session or screen lock is activated
- requires users to authenticate to unlock the session
- denies users the ability to disable the session or screen locking mechanism.