NIST 800-53 AC-11 Device Lock: Screen Locks Auditors Accept

AC-11 is the screen lock control. Prevent further access to the system after a period of inactivity you define, or when the user requests it, and keep the lock until the user proves who they are again.

800-53 binds federal systems and, by contract, some suppliers. If you answer security questionnaires, you will see this control in other words almost every time.

What it means in practice

The guidance explains that device locks are temporary. They apply when someone steps away but does not want to log out. They can be set at the operating system or application level, and a proximity lock, such as a Bluetooth device, may trigger them.

Two limits matter. User initiated locking depends on behavior, so it is policy as much as technology. And a lock does not replace logging out where you require that at the end of the day.

The enhancement, AC-11.1 Pattern hiding Displays, covers hiding what was on the screen when the lock engages.

Evidence to collect

• The inactivity period and where it is written down.
• Endpoint management settings showing the lock enforced on laptops and workstations.
• A report of devices that do not comply.
• Application level session lock settings for sensitive tools.

Common gaps

• A policy of five minutes with a fleet setting of sixty.
• Servers and kiosks left out of scope.
• Users able to turn the lock off.

How to implement it

Push the setting through device management so users cannot change it. Choose a period you can defend, and pick a shorter one for systems that hold sensitive data. Report on exceptions monthly.

Quick check

Sources

• NIST SP 800-53 Rev 5, AC-11: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-11
• NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json