Skip to content
ControlVerdict
Sign in
AC.L2-3.1.10CMMC Level 2Level 2

Session Lock

Submit your own example

Practice statement

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.10.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the period of inactivity after which the system initiates a session lock is defined;

    1 example covers this

  2. [b]

    access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and

    1 example covers this

  3. [c]

    previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AC.L2-3.1.10Session Lock
    Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

    • [a]

      the period of inactivity after which the system initiates a session lock is defined;

    • [b]

      access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and

    • [c]

      previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

    Screen lock ≤15 minutes with pattern-hiding on CUI endpoints

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all Session Lock objectives for in-scope endpoints.

    Windows. Intune profile: idle lock at 15 minutes or less, password/PIN required to resume, lock screen does not preview CUI notification content (pattern-hiding).

    macOS. Configuration profile enforces screensaver lock ≤15 minutes with password on wake for enclave users.

    Maintenance. Weekly compliance dashboard; devices noncompliant >3 days open a ticket. Users cannot locally raise the timeout.

    Accepted gap. Shop-floor tablets that must stay readable during a shift use a supervised kiosk mode with auto-logoff at shift end instead of a short lock; they hold no CUI at rest.

    What the evidence looks like

    • Intune/macOS profile exports showing lock timeout and notification settings
    • Compliance report sample
    • Kiosk exception documentation

    Environment

    Windows 11 CUI fleet managed by Intune; macOS engineers on a smaller baseline.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.