NIST SP800-53 Recommended Security Controls for Federal Information Systems and Organizations

CNSS CNSSI-1253 Security Categorization And Control Selection For National Security Systems (see also control 0428 which states 10 minutes for 'confidential' and 'secret' levels).

if manually activated by the system user.

after a maximum of 15 minutes of system user inactivity.

Use a 'time-out' function for remote access and mobile devices requiring user re-Īuthentication after 30 minutes inactivity andĪustralian DSD Information Security Manual 2013 Controls Presidential Memorandum Protection of Sensitive Agency Informationģ. Roughly from more-specific to less-specific: Such a 'control' is typically assigned a persistent, unique identifier by a particular standard, the common ones are suitable here are AC-11 and SC-10 (from NIST SP800-53(PDF) ) and FTA_SSL (from ISO/IEC 15408, aka Common Criteria for Information Technology Security Evaluation, 'FTA' is the class of access control, 'SSL' refers to session locking). Specific values such as these are a property of a good policy implementation, the slightly abstract standards tend to only recommend maxima or minima, if even. The large standards (ISO, NIST) tend toward one-size fits all, the real intent is to promote careful consideration, and deliberate and informed decision making.

Computer locks after 5 minutes