AC-11 Device lock
What the standard requires
a. Prevent further access to the system by [initiating a device lock after [time period] of inactivity | requiring the user to initiate a device lock before leaving the system unattended] ; and b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.
Maps to 1 control in 1 other framework
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
Track AC-11 with evidence behind it
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.