CMMC Practice Requirement:

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

CMMC Requirement Explanation:

You can not rely on users to lock their session before stepping away from their system (e.g., locking their computer screen). By configuring your systems to automatically lock after a period of activity you reduce the risk of your systems being accessed by unauthorized persons.

Example CMMC Implementation:

Configure your systems to lock their screens and display a screen saver after a period of inactivity. A common setting is to display a screen saver after 15 minutes. To regain access to the system, the user must log in again.

Scenario(s):

- Scenario 1:

John, an employee at your company forgot to lock his workstation before leaving his desk. When he comes back to his desk his system has been locked and he has to login again. This is thanks to a setting on his computer that locks the session after 15 minutes of inactivity.
 

Discover Our NIST SP 800-171 Solutions:

 /assets/images/compliance_accelerator_white.png

Compliance Accelerator

For contractors seeking compliance
 /assets/images/quantum_assessor_white.png

Quantum Assessor

For IT service providers
 /assets/images/supply_chain_logo_white.png

Supply Chain Verifier

For contractors seeking to verify partner compliance