Windows 10 Mobile must lock the display after 15 minutes (or less) of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70091	MSWM-10-201009	SV-84713r1_rule		Medium

Description
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #02b

Description

The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #02b

STIG	Date
Microsoft Windows 10 Mobile Security Technical Implementation Guide	2017-09-11

Details

Check Text ( C-70567r1_chk )
Review Windows 10 Mobile configuration settings to determine if the mobile device has the screen lock timeout set to 15 minutes or less. If feasible, use a spare device to determine how much idle time must elapse before the screen lock activates. This validation procedure is performed on both the MDM administration console and the Windows 10 Mobile device. On the MDM administration console: 1. Ask the MDM administrator to display the device password settings. 2. Verify the device timeout/inactivity setting is turned on. 3. Verify the minimum length is set to 15 minutes. On the Windows 10 Mobile device: 1. Initiate the test by unlocking the device. 2. Verify that within 15 minutes or less the device screen turns off and if after turning the screen on again that a password is required to gain access to the device. If the MDM is not configured to require a device lock after 15 minutes or less or; the device fails to lock in 15 minutes or less, this is a finding.

Check Text ( C-70567r1_chk )

Review Windows 10 Mobile configuration settings to determine if the mobile device has the screen lock timeout set to 15 minutes or less. If feasible, use a spare device to determine how much idle time must elapse before the screen lock activates.

This validation procedure is performed on both the MDM administration console and the Windows 10 Mobile device.

On the MDM administration console:

1. Ask the MDM administrator to display the device password settings.
2. Verify the device timeout/inactivity setting is turned on.
3. Verify the minimum length is set to 15 minutes.

On the Windows 10 Mobile device:

1. Initiate the test by unlocking the device.
2. Verify that within 15 minutes or less the device screen turns off and if after turning the screen on again that a password is required to gain access to the device.

If the MDM is not configured to require a device lock after 15 minutes or less or; the device fails to lock in 15 minutes or less, this is a finding.

Fix Text (F-76327r1_fix)
Configure Windows 10 Mobile policies to lock the device within 15 minutes or less. Deploy the policy on managed devices.