NIST SP800-53 Recommended Security Controls for Federal Information Systems and Organizations CNSS CNSSI-1253 Security Categorization And Control Selection For National Security Systems (see also control 0428 which states 10 minutes for 'confidential' and 'secret' levels). if manually activated by the system user.after a maximum of 15 minutes of system user inactivity.

Use a 'time-out' function for remote access and mobile devices requiring user re-Īuthentication after 30 minutes inactivity andĪustralian DSD Information Security Manual 2013 Controls Presidential Memorandum Protection of Sensitive Agency Informationģ. Roughly from more-specific to less-specific: Such a 'control' is typically assigned a persistent, unique identifier by a particular standard, the common ones are suitable here are AC-11 and SC-10 (from NIST SP800-53(PDF) ) and FTA_SSL (from ISO/IEC 15408, aka Common Criteria for Information Technology Security Evaluation, 'FTA' is the class of access control, 'SSL' refers to session locking). Specific values such as these are a property of a good policy implementation, the slightly abstract standards tend to only recommend maxima or minima, if even. The large standards (ISO, NIST) tend toward one-size fits all, the real intent is to promote careful consideration, and deliberate and informed decision making.

Computer locks after 5 minutes