Device Lock AC-11

Access Control · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-11 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-11 (Device Lock) is about locking a session when a person steps away, so an unattended screen or shell can’t be used by whoever walks up next. The system either locks itself after a set period of inactivity, or the user locks it on demand before leaving, and getting back in requires signing in again. It is a technical Access Control that appears in the Moderate baseline, where it also carries the enhancement AC-11(1) (Pattern-Hiding Displays).

What good looks like

Lock the session automatically after a set idle time — don’t rely on people remembering to do it.
Also let a user lock on demand before they walk away from the keyboard.
Require the user to sign in again to unlock — the same identification and authentication used to log in, not a quick dismiss.
At Moderate, cover the screen with a neutral, publicly viewable image so a passer-by can’t read what was there (enhancement AC-11(1), Pattern-Hiding Displays).
Treat the lock as a step-away measure, not a substitute for logging out at the end of the day.

Framework mapping

CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software (Safeguard 4.3, automatic session locking)

How to move it toward Implemented

Set an idle timeout so shells close on their own — add readonly TMOUT=900 then export TMOUT to /etc/profile.d/idle-timeout.sh (900 seconds = 15 minutes). TMOUT (the Bash shell idle-timeout in seconds) ends idle console and SSH (Secure Shell) sessions.
For the physical console, install a locker so a user can lock before stepping away — vlock (Virtual Console Lock) on a text console, or on a desktop set the screensaver to lock with gsettings set org.gnome.desktop.screensaver lock-enabled true.
Confirm that unlocking demands the account password — that satisfies the ‘reestablish access’ part — and if a graphical desktop is present, keep its lock screen covering the display, which closes AC-11(1).
Save the settings as evidence: the /etc/profile.d/idle-timeout.sh file and a grep TMOUT /etc/profile.d/idle-timeout.sh showing the value, plus a short note that unlock requires signing in.
Attach that config and note as hardening evidence on the asset, naming AC-11 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.