Detections
Analytics

2.3.1 Set an inactivity interval of 20 minutes or less for the screen saver

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

A locking screensaver is one of the standard security controls to limit access to a computer and the current user's session when the computer is temporarily unused or unattended. In macOS the screensaver starts after a value selected in a drop down menu, 10 minutes and 20 minutes are both options and either is acceptable. Any value can be selected through the command line or script but a number that is not reflected in the GUI can be problematic. 20 minutes is the default for new accounts.

Rationale:

Setting an inactivity interval for the screensaver prevents unauthorized persons from viewing a system left unattended for an extensive period of time.

Solution

Perform the following to implement the prescribed state:

1. Open System Preferences
2. Select Desktop & Screen Saver
3. Select Screen Saver
4. Set Start after to 20 minutes or less

Alternatively:

1. In Terminal, run one of the the following commands:

defaults -currentHost write com.apple.screensaver idleTime -int 600
defaults -currentHost write com.apple.screensaver idleTime -int 1200

There are anomalies if the command line is used to make the setting something other than what is available in the GUI Menu. Choose either 10 minutes or 20 minutes,

See Also

https://workbench.cisecurity.org/files/2105

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-11, CSCv6|16.5

Plugin: Unix

Control ID: ea9ad64b43a089fc8929919d8c459f79e9d1b3f6fa9514b1337df4503c25406d