AC.L2-3.1.10
Session Lock
Requirement
Assessment objectives
An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.
Determine if:
- athe period of inactivity after which the system initiates a session lock is defined;
- baccess to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
- cpreviously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.
How to implement
Screens that show CUI must lock after a short idle period and hide what was on them. Pick the inactivity timeout (the guide leaves the value to you, and its example uses five minutes, L2 guide p.45; 15 minutes is a common choice for computers), enforce it with device management on every laptop, desktop and shop terminal, and make sure the lock shows a login screen or blank/pattern display, not the document.
The minimum for a small organization · Expert CMMC's reading, not official text
Screens that can show CUI lock after a set idle period and hide what was on them. At minimum: write down the idle time for each kind of device [a], and set every computer, terminal and phone that can show CUI to lock after it [b], showing a sign-in screen or blank pattern instead of the content [c]. The screen-lock settings built into the operating system are the usual way, pushed centrally or, where they are set on each device by hand, with every user told the required setting and how to make it.
Required outcome: what the requirement or its objectives call for. Recommended way: one common way to get there. Going further: worth doing, more than this practice asks.
- 1Required outcomePolicyDefine the period of inactivity after which each kind of device locks the session.[a]
- 2Required outcomeTechnicalLock the session after the defined period, so the device cannot be used or its data viewed until the user signs in again, and hide what was on the screen behind a sign-in screen or a pattern-hiding display that shows no CUI. Where the setting is not managed centrally, tell every user the required setting and how to make it.[b][c]
You can tell it worked when a device left idle past the defined period locks, hides what was on the screen and asks for sign-in.
- 3Recommended wayPolicyRecord the idle periods in the access control policy or the SSP. The guide leaves the value to the organization (its example uses five minutes, L2 guide p.45); 15 minutes is a common choice for computers, often shorter for shop-floor terminals and phones; ask users to lock manually when they step away.[a]
- 4
- 5Recommended wayTechnicalSet idle timeouts for browser sessions too, in the cloud service and on VPN or portal sessions, so an unattended browser does not keep a CUI document open.[b]
- 6
Evidence to collect
Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.
A process you started recently is shown honestly by its dated procedure, the first record it produced and the date it began. No evidence row needs more history than the process has existed, and the review periods shown are suggestions unless a guide page or regulation is named beside them.
Defined inactivity period[a]
Policy · Suggested: current version, reviewed on the schedule you set
Named in the assessment guide · p.44 AC.L2-3.1.10 Examine: "Access control policy"
Policy or SSP statement per device type.
For this practice it must include [a] the policy or SSP statement giving, for each kind of device (computers, shop-floor terminals, phones and tablets), the period of inactivity after which it locks, and, where the lock is set on each device by hand, how users are told the setting.
Does not show: that devices lock after that period or hide the screen ([b], [c]): the statement defines the period; the device profile and an idle test show the lock in place.
Device management session lock policy[b][c]
Configuration export · Suggested: current configuration
Named in the assessment guide · p.44 AC.L2-3.1.10 Examine: "system configuration settings and associated documentation"
Intune/Group Policy or MDM profile export for inactivity limit, screen saver and password-on-resume.
For this practice it must include [b] the inactivity limit pushed to each kind of device and the groups it is assigned to (Intune Settings Catalog or Group Policy 'Interactive logon: Machine inactivity limit', the macOS screen saver delay, auto-lock on phones); [c] the lock screen or password-protected screen saver that replaces the screen's content ('Enable screen saver', 'Password protect the screen saver', macOS password on wake).
Does not show: that devices have applied the profile, or that devices outside management lock: the profile shows values and assignment; the compliance report and an idle test show the effect, and unmanaged devices need their own record.
Intune/Jamf/RMM report showing the lock policy applied to all enclave devices.
For this practice it must include [b] each managed device beside the lock profile's status on it (applied, pending or error), read in the device management console's per-profile device status report (in Intune, the configuration profile → Device status), so devices without the setting can be seen.
Does not show: that a device actually locks or hides its screen: 'applied' means the setting arrived, and an idle test shows the lock; devices not enrolled in management are not in the report at all.
Microsoft 365 admin 'Idle session timeout' or Google session control settings.
For this practice it must include [b] for CUI open in a browser: the idle session timeout and its value in the Microsoft 365 admin center (Org settings → Security & privacy → Idle session timeout), or the web session length in Google Admin (Security → Google session control), which ends a session after a set length rather than after idle time.
Does not show: that the computer locks: these settings sign a browser out of the cloud apps and do not lock the device or hide other windows ([b], [c] on the device are the device profile's).
How assessors check
- Examine
- Policy, device configuration, compliance reports, session timeout settings.
- Interview
- Users about locking when away; the device administrator.
- Test
- Leave a device idle for the defined period and observe the lock and the pattern-hiding display; wake it and show a password or PIN is required.
Tools and products
Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.
Built-in settings; the only cost is your existing management tool.
Jamf Now is aimed at small fleets; Jamf Pro is the standard for larger ones. Intune also manages Macs if you already have it.
Jamf Now, Apple device management for small businesses · Free for up to 3 devices, then from 4 US dollars per device per month, for organizations with fewer than 25 employees (Jamf pages, read 2026-11-12).
- Free for up to 3 devices only.
- Jamf Now manages up to 3 devices free. source
- Jamf Now starts at 4 US dollars per device per month, for organizations with fewer than 25 employees. source
Vendor details checked November 12, 2026 (oldest check shown). Plans change; confirm before buying.
Jamf Pro and Jamf Protect (sold together as Jamf for Mac), commercial · Jamf for Mac (Jamf Pro, Jamf Connect and Jamf Protect) 12.50 US dollars per Mac per month, billed annually, 25-device minimum; no standalone Jamf Pro price is shown (Jamf pricing page, read 2026-11-12).
- Jamf Pro manages and secures Apple devices. source
- Jamf for Mac (Jamf Pro, Jamf Connect and Jamf Protect) is priced per Mac per month, billed annually, with a 25-device minimum. source
Vendor details checked November 12, 2026 (oldest check shown). Plans change; confirm before buying.
A tenant setting in the Microsoft 365 admin center.
Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.
Common pitfalls
- Policy set to 15 minutes but shop or conference-room PCs excluded 'because the lock is annoying'.
- Screen saver that shows photos from the user's folders (may display CUI images).
- Forgetting browser sessions on shared devices and phones that sync CUI email.
Platform notes
Microsoft 365 (GCC / GCC High)
Intune Settings Catalog: 'Interactive logon: Machine inactivity limit' (in seconds: the period you defined, for example 900 for 15 minutes), 'Enable screen saver', 'Password protect the screen saver'; Microsoft 365 idle session timeout in the admin center (Org settings → Security & privacy). iOS/Android compliance policies for auto-lock.
Google Workspace
Managed Windows/macOS/ChromeOS device policies for screen lock; Google session length control for web sessions; mobile device management auto-lock.
On-premises or MSP-managed
Group Policy user configuration for screen saver timeout and password protection, plus the machine inactivity limit; MDM for Macs; VPN idle timeout.
Related practices: AC.L2-3.1.11, PE.L2-3.10.6, IA.L2-3.5.1
Editorial implementation guidance published November 14, 2026. It is not part of the official requirement and does not replace the assessment guide.
Crosswalk
Full crosswalkThe NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports.
NIST SP 800-171 Rev 2
3.1.10SP 800-171 Rev 3
03.01.10SP 800-53 Rev 5
AC-11DSAC-11(1)DSHow these were reachedHide how these were reached
- AC-11 · Device Lock
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 AC-11 → 800-53 Rev 5 AC-11
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.01.10 → 800-53 Rev 5 AC-11
- AC-11(1) · Device Lock | Pattern-hiding Displays
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 AC-11 (1) → 800-53 Rev 5 AC-11(1)
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.01.10 → 800-53 Rev 5 AC-11(1)
Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. NIST also names this Rev 3 requirement as the successor of other withdrawn requirements: open “How these were reached” under the Rev 5 controls for which, in NIST's words.
Where each link comes from (8 links from 5 official documents)
32 CFR Part 170 Office of the Federal Register / GPO
- AC.L2-3.1.10 → 3.1.10“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)
Further discussion
Practice guide notes
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Lock sessions after the defined inactivity period and conceal previously displayed information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage systems for an organization that stores, processes, and transmits CUI . You notice that employees leave their offices without locking their computers. Sometimes their screens display sensitive company information. You configure all machines to lock after five minutes of inactivity [a,b]. You also remind your coworkers to lock their systems when they walk away [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing session lock; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records
Common mistakes
Using a screen saver that leaves the session usable or sensitive content visible.
Track this in a workspace
The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Source: DoD CIO · https://dodcio.defense.gov/CMMC/