Security requirement
- a.Prevent access to the system by [Organization-defined: SELECTED PARAMETER VALUES].
- b.Retain the device lock until the user reestablishes access using established identification and authentication procedures.
- c.Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Discussion
Device locks are temporary actions taken to prevent access to the system when users depart from the immediate vicinity of the system but do not want to log out due to the temporary nature of their absences. Device locks can be implemented at the operating system level or application level. User-initiated device locking is behavior- or policy-based and requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of the system (e.g., when organizations require users to log out at the end of workdays). Publicly viewable images can include static or dynamic images, such as patterns used with screen savers, solid colors, photographic images, a clock, a battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Implementation perspective
Treat Device Lock as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to approved identities, least privilege, remote access, information flow, and the full account lifecycle.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- access authorization and approval records
- account inventories and entitlement exports
- access review results
- authentication and authorization logs
Common failure patterns
- CUI access that exceeds mission need
- shared or orphaned accounts
- remote access paths outside the approved boundary
- access reviews that cannot be reconciled to deployed permissions
Assessment objectives and methods
Assessment objectives (3)
- a.
access to the system is prevented by [Organization-defined: SELECTED PARAMETER VALUES].
- c.
information previously visible on the display is concealed via device lock with a publicly viewable image.
- b.
the device lock is retained until the user reestablishes access using established identification and authentication procedures.
Examine
- access control policy and procedures
- procedures for session lock and identification and authentication
- system design documentation
- system configuration settings
- display screen with session lock activated
- system security plan
- other relevant documents or records
Interview
- personnel with information security responsibilities
- system developers
- system administrators
Test
- mechanisms for implementing the access control policy for session lock
- session lock mechanisms
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.