The DOC requires the OUs to ensure that information systems prevent further access to the system by initiating a session lock after thirty (30) minutes of and the session lock inactivity, remains in effect until the user reestablishes access using appropriate identification and authentication procedures. DOC Criteria: The DOC requires OUs to initiate session lock after thirty (30) minutes of inactivity for web applications, remote access, and portable devices, and fifteen (15) minutes of inactivity for desktop systems. For all other session locks (application or system specific), the time period must be defined by the OU. is defined as only those actions that require “Inactivity” interaction of a user (i.e., system and application calls are not included). Session Termination Session Termination The DOC requires the OUs to ensure that information systems automatically terminate a remote session after AC-12 thirty (30) minutes of inactivity. X X is defined as only those DOC Criteria: “Inactivity” actions that require interaction of a user (i.e., system and application calls are not included). Remote Access Remote Access Remote Access Refer to CITR-008: and CITR-20: AC-17 X X X Safeguarding Information While on Foreign Travel for control details. Protection of Confidentiality/Integrity Using Encryption AC-17.2 X X Remote Access CITR-20: to CITR-008: and Safeguarding Information While on Foreign Travel for control details. Wireless Access Wireless Access AC-18 X X X Wireless Encryption Enhancements Refer to CITR-014: Policy for control details. Access Control for Mobile Devices Access Control for Mobile Devices AC-19 X X X Remote Access Refer to CITR-008: and CITR-020:
The DOC requires the OUs to ensure that information systems prevent further access to the system by initiating a session lock after thirty (30) minutes of inactivity, and the session lock remains in effect until the user reestablishes access using appropriate identification and authentication procedures. DOC Criteria: The DOC requires OUs to initiate session lock after thirty (30) minutes of inactivity for web applications, remote access, and portable devices, and fifteen (15) minutes of inactivity for desktop systems. For all other session locks (application or system specific), the time period must be defined by the OU. “Inactivity” is defined as only those actions that require interaction of a user (i.e., system and application calls are not included). Session Termination AC-12 Session Termination The DOC requires the OUs to ensure that information systems automatically terminate a remote session after thirty (30) minutes of inactivity. DOC Criteria: “Inactivity” is defined as only those actions that require interaction of a user (i.e., system and application calls are not included). X X Remote Access AC-17 Remote Access Refer to CITR-008: Remote Access and CITR-20: Safeguarding Information While on Foreign Travel for control details. X X X AC-17.2 Protection of Confidentiality/Integrity Using Encryption to CITR-008: Remote Access and CITR-20: Safeguarding Information While on Foreign Travel for control details. X X Wireless Access AC-18 Wireless Access Refer to CITR-014: Wireless Encryption Enhancements Policy for control details. X X X Access Control for Mobile Devices AC-19 Access Control for Mobile Devices Refer to CITR-008: Remote Access and CITR-020: X X X