Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.1.10 and CMMC Level 2 assessment objective AC.L2-3.1.10[b].
What This Objective Means
This objective focuses on verifying that your systems are technically configured with the appropriate security configuration to enforce session lockouts after a defined period of inactivity.
Session lockouts require users to reauthenticate when a session has been idle, ensuring consistent enforcement of inactivity timeouts as part of comprehensive session management system.
Why Enforcing Session Lockouts Matters
Without enforced session lockouts, unattended sessions may be exploited by unauthorized individuals, increasing risk of unauthorized access or misuse of sensitive systems and data. Proper security settings are essential to mitigate these risks effectively.
Consistent enforcement turns documented policies into operational security safeguards.
How to Implement AC 3.1.10b
Configure technical controls that enforce session lockouts after your defined inactivity timeout expires. Ensuring these controls align with your overall system compliance strategy is critical.
Common configurations include system Group Policies, device management settings, and application or VPN timeout controls aligned to your access control policies.
Implementation Summary Table
| Configuration Area | Action |
|---|---|
| Workstations | Configure inactivity timeout and lock behavior via OS policies or device management tools. |
| Remote Access | Enforce session lockouts in VPN portals and remote desktop sessions based on inactivity. |
| Web Applications | Set application session timeouts and lock screens after inactivity to enhance web session security. |
| Authentication Behavior | Require reauthentication after a lockout, including passwords or multi-factor authentication. |
| Policy Alignment | Ensure session timeout values match your documented access control policy. |
Evidence Assessors Commonly Expect
Assessors typically expect screenshots or exported settings showing configured timeout thresholds and lockout enforcement in system configuration tools, which are part of the overall security configuration.
This may include Group Policy Objects (GPOs), mobile device management policies, or server and application configuration files that demonstrate the lockout behavior.
Common Gaps to Avoid
Common gaps include having a defined inactivity timeout in policy that isn’t actually enforced in system configuration, inconsistent lockout enforcement across different platforms, and lock screens that do not require reauthentication, which can undermine the effectiveness of your information security recommendations.
FAQ
What does AC.L2-3.1.10b require?
It requires that systems are technically configured to enforce session lockouts after a defined period of inactivity, requiring reauthentication to continue.
Why are session lockouts important?
Session lockouts prevent unattended sessions from being accessed by unauthorized users, reducing risk of accidental or malicious access.
What evidence shows enforcement of session lockouts?
Evidence can include exported configuration settings, screenshots of timeouts and lock screen behavior, and logs showing inactive sessions were locked consistently.