AC.2.010 — Use Session Lock with Pattern-Hiding Displays

CMMC Level 2SPRS if unmet: -1LOW priority~2h to implement

Use session lock with pattern-hiding displays after a period of inactivity.

What AC.2.010 means in plain English

When someone walks away from their computer without logging out, the screen should automatically lock after a few minutes of no activity — ideally showing a screensaver or blank screen rather than leaving work visible. Anyone who wants to use that computer then needs to enter a password. This prevents someone from walking by an unattended machine and reading or stealing CUI.

The assessment question

“Are all computers configured to automatically lock the screen and require a password after 15 minutes or less of inactivity, and does the lock screen hide the work that was on-screen rather than leaving it visible?”

How to implement AC.2.010

Set screen lock timeout in Windows: Settings > Personalization > Lock screen > Screen timeout settings, then set "Screen" to 10 minutes. Also set Settings > Accounts > Sign-in options > "Require sign-in" to "When PC wakes from sleep."
Set the screensaver with password protection: right-click desktop > Personalize > Lock screen > Screen saver settings. Check "On resume, display logon screen" and set wait time to 10 minutes. Use a blank screensaver (not a pattern that shows work content).
Push this setting across all machines using Group Policy (if you have a Windows domain) or Intune (if using Microsoft 365 Business Premium): Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options: "Interactive logon: Machine inactivity limit" — set to 600 seconds (10 minutes).
Confirm the setting is working by walking away from a computer for 10 minutes and verifying the screen locks.
Remind employees to manually lock their screen (Windows key + L) whenever they step away, even for short periods — add this to your security awareness training.

Evidence your assessor will ask for

Screenshot of Windows screen lock / screensaver settings showing timeout value
Group Policy or Intune policy screenshot showing inactivity lock configured
Written policy stating screen lock must activate within 15 minutes of inactivity
Photo or screenshot of lock screen appearing on a test machine after timeout period

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.010 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control