The smartphone inactivity timeout must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25010	WIR-MOS-NS-016	SV-40112r2_rule	PESL-1	Low

Description
Sensitive DoD data could be compromised if the smartphone does not automatically lock after the required period of inactivity.

STIG	Date
General Mobile Device (Technical) (Non-Enterprise Activated) Security Technical Implementation Guide	2013-03-19

Details

Check Text ( C-39060r1_chk )
This check applies to any mobile OS device (smartphones, tablets, etc.). Check a sample of 2-3 devices managed by the site to verify a device inactivity timeout has been set to 60 minutes or less (15 minutes is recommended). The exact procedure will vary, depending on the mobile OS. Have the user show that a device inactivity timeout has been set to 60 minutes or less. Mark as a finding if configuration is not set as required.

Check Text ( C-39060r1_chk )

This check applies to any mobile OS device (smartphones, tablets, etc.).

Check a sample of 2-3 devices managed by the site to verify a device inactivity timeout has been set to 60 minutes or less (15 minutes is recommended). The exact procedure will vary, depending on the mobile OS.

Have the user show that a device inactivity timeout has been set to 60 minutes or less.

Mark as a finding if configuration is not set as required.

Fix Text (F-27661r3_fix)
Set the CMD inactivity timeout to 15 minutes or less.