Use session lock with pattern-hiding displays
📖 What This Means
This practice requires organizations to implement session locks on devices that display sensitive information. A session lock automatically locks the device after a period of inactivity, preventing unauthorized access. Additionally, the display should hide patterns or sensitive information when locked to avoid visual exposure. For example, if an employee steps away from their computer in a shared workspace, the session lock ensures that anyone passing by cannot see or access the information on the screen. This is particularly important for defense contractors handling Controlled Unclassified Information (CUI), as it prevents accidental or intentional data breaches.
🎯 Why It Matters
Failing to implement session locks with pattern-hiding displays exposes sensitive information to unauthorized individuals, increasing the risk of data breaches. For instance, a 2021 report found that 20% of breaches occurred due to unattended devices. In the defense sector, unauthorized access to CUI can lead to significant financial losses, legal penalties, and reputational damage. The DoD emphasizes this control to protect CUI from visual and physical access by unauthorized personnel, ensuring compliance with CMMC requirements.
✅ How to Implement
- 1. Configure session lock settings in your cloud platform (e.g., AWS WorkSpaces, Azure Virtual Desktop).
- 2. Set inactivity timeout to 15 minutes or less.
- 3. Enable screen saver with password protection.
- 4. Use pattern-hiding features like blanking the screen when locked.
- 5. Test the session lock functionality to ensure it works as intended.
📋 Evidence Examples
Session lock configuration
Screen saver settings
Testing results
Policy document
Training records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AC.L2-3.1.10 ("Use session lock with pattern-hiding displays"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how access to CUI systems is controlled, including the specific IAM tools, policies, and processes used. Reference your Access Control Policy and identify the systems in scope. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AC.L2-3.1.10 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to use session lock with pattern-hiding displays. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AC.L2-3.1.10 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to use session lock with pattern-hiding displays. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AC.L2-3.1.10 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all access points to CUI systems (VPN, direct network, cloud portals)
- • Document which IAM system manages access (Azure AD, AWS IAM, on-prem AD)
- • Map user roles to system access levels
- • Ensure this control covers all systems within your defined CUI boundary where use session lock with pattern-hiding displays applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Access Control Policy
- 📄 IAM configuration documentation
- 📄 Access request and approval records
- 📄 Evidence artifacts specific to AC.L2-3.1.10
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that access controls are implemented as described, test whether unauthorized users are blocked, and review access logs for evidence of enforcement.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Is session lock enabled on all devices?
Question 2: Is the inactivity timeout set to 15 minutes or less?
Question 3: Does the session lock hide patterns or sensitive information?
Question 4: Have you tested the session lock functionality?
Question 5: Is there a documented policy for session lock requirements?
⚠️ Common Mistakes (What Auditors Flag)
1. Not setting a short enough inactivity timeout
2. Failing to enable pattern-hiding features
3. Inconsistent implementation across devices
4. Not documenting session lock policies
5. Not testing session lock functionality
📚 Parent Policy
This practice is governed by the Access Control Policy