Assessment Objective
Determine if:
- AC-11a. further access to the system is prevented by [Selection (one or more): initiating a device lock after [Assignment: time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended];
- AC-11b. device lock is retained until the user re-establishes access using established identification and authentication procedures.
Assessment Methods
Examine
- Access control policy
- procedures addressing session lock
- procedures addressing identification and authentication
- system design documentation
- system configuration settings and associated documentation
- security plan
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing access control policy for session lock
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | AC-11 Device Lock |