The smartphone inactivity timeout must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25010	WIR-MOS-NS-016	SV-40112r2_rule	PESL-1	Low

Description
Sensitive DoD data could be compromised if the smartphone does not automatically lock after the required period of inactivity.

STIG	Date
BlackBerry Playbook OS (NEA mode) Security Technical Implementation Guide (STIG)	2014-08-25

Details

Check Text ( C-39060r1_chk )
This check applies to any mobile OS device (smartphones, tablets, etc.). Check a sample of 2-3 devices managed by the site to verify a device inactivity timeout has been set to 60 minutes or less (15 minutes is recommended). The exact procedure will vary, depending on the mobile OS. Have the user show that a device inactivity timeout has been set to 60 minutes or less. Mark as a finding if configuration is not set as required.

Check Text ( C-39060r1_chk )

This check applies to any mobile OS device (smartphones, tablets, etc.).

Check a sample of 2-3 devices managed by the site to verify a device inactivity timeout has been set to 60 minutes or less (15 minutes is recommended). The exact procedure will vary, depending on the mobile OS.

Have the user show that a device inactivity timeout has been set to 60 minutes or less.

Mark as a finding if configuration is not set as required.

Fix Text (F-27661r4_fix)
Enforce the CMD inactivity timeout requirement of 15 minutes or less through a combination of "Auto-Lock" and "Grace period" values that do not sum to greater than 15 minutes.