|Finding ID||Version||Rule ID||IA Controls||Severity|
|Sensitive DoD data could be compromised if the smartphone does not automatically lock after the required period of inactivity.|
|General Mobile Device (Technical) (Non-Enterprise Activated) Security Technical Implementation Guide||2013-07-03|
|Check Text ( C-39060r1_chk )|
| This check applies to any mobile OS device (smartphones, tablets, etc.). |
Check a sample of 2-3 devices managed by the site to verify a device inactivity timeout has been set to 60 minutes or less (15 minutes is recommended). The exact procedure will vary, depending on the mobile OS.
Have the user show that a device inactivity timeout has been set to 60 minutes or less.
Mark as a finding if configuration is not set as required.
|Fix Text (F-27661r4_fix)|
|Enforce the CMD inactivity timeout requirement of 15 minutes or less through a combination of "Auto-Lock" and "Grace period" values that do not sum to greater than 15 minutes.|