AC.L2-3.1.10
Session Lock
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.10 in the reference catalog with its NIST cross-references
Official requirement
Use session lock with pattern- hiding displays to prevent access and viewing of data after a period of inactivity.
Assessment objectives
a. the period of inactivity after which the system initiates a session lock is defined;
b. access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
c. previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Lock sessions after the defined inactivity period and conceal previously displayed information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage systems for an organization that stores, processes, and transmits CUI . You notice that employees leave their offices without locking their computers. Sometimes their screens display sensitive company information. You configure all machines to lock after five minutes of inactivity [a,b]. You also remind your coworkers to lock their systems when they walk away [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing session lock; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records
Common mistakes
Using a screen saver that leaves the session usable or sensitive content visible.