Sentry must initiate a session lock after a 15-minute period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-250984	MOIS-ND-000050	SV-250984r1028211_rule	CCI-000057	medium
Description
A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Rather than relying on the user to manually lock their management session prior to vacating the vicinity, network devices need to be able to identify when a management session has idled and take action to initiate the session lock. Once invoked, the session lock shall remain in place until the administrator reauthenticates. No other system activity aside from reauthentication shall unlock the management session. Note that CCI-001133 requires that administrative network sessions be disconnected after 10 minutes of idle time. So this requirement may only apply to local administrative sessions.
STIG			Date
Ivanti Sentry 9.x NDM Security Technical Implementation Guide			2024-09-25

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock

0.50

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-11(1)Pattern-hiding Displays

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12Session Termination

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12(2)Termination Message

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V1R7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)DISA STIG Benchmark (XCCDF)V1R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-10Non-repudiation

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-11Re-authentication

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2Identification and Authentication (Organizational Users)

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(1)Multi-factor Authentication to Privileged Accounts

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(12)Acceptance of PIV Credentials

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+8 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-000057

1.00

DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)

Details

Check Text (C-250984r1028211_chk)

Verify the System manager Timeout is set to 15 minutes. 1. Log in to the Sentry System Manager. 2. Navigate to Settings >> Timeout. 3. Verify the System Manager timeout is set to 15. If the System Manager timeout is not set to 15, this is a finding.

Fix Text (F-54373r1004828_fix)

Set the System Manager Timeout to 15 minutes. 1. Log in to the Sentry System Manager. 2. Navigate to Settings >> Timeout. 3. Configure the System Manager timeout to 15. 4. Click "Apply" and "Save" in the top right corner.