Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.1.10OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.1.10 — Session lock

3.1 Access Control · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

An unattended, unlocked screen is open access to whatever the session can reach. Sessions lock after a defined idle period, and the locked display hides what was on screen rather than leaving the spreadsheet visible behind a password prompt.

Across revisions

Rev. 3 renames the requirement Device Lock (03.01.10) with the same substance.

Mapped practices

Brilliant at the Basics practices that support this requirement

No practice maps to this requirement — deliberately.

The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Enforce the idle timeout and pattern-hiding lock centrally; a setting users can turn off is not enforcement.
  • Handle shop-floor and lab machines deliberately — where a lock genuinely conflicts with operations, document the compensating physical safeguard instead of silently exempting the machine.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Policy exports showing the timeout and lock display configuration
  • The documented exception list for operational machines, with compensating measures
Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated