← Back to Apple macOS 13 (Ventura) Security Technical Implementation Guide

V-257144

CAT II (Medium)

The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule ID

SV-257144r958400_rule

STIG

Apple macOS 13 (Ventura) Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-000056

Discussion

A screen saver must be enabled and set to require a password to unlock. An excessive grace period impacts the ability for a session to be truly locked, requiring authentication to unlock.

Check Content

Verify the macOS system is configured to initiate a session lock within five seconds of the screen saver starting with the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep "askForPasswordDelay"

askForPasswordDelay = 5;

If there is no result, or if "askForPasswordDelay" is not set to "5" or less, this is a finding.

Fix Text

Configure the macOS system to initiate a session lock within five seconds of the screen saver starting by installing the "Login Window Policy" configuration profile.