CIS · Control 4.3 · Priority: critical · Component: Protect

What this control covers

Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.

Why it matters

Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.

How to implement

AWS

Bake hardening into EC2 Image Builder + AMI accounts; use Systems Manager Fleet Manager for inventory and patch state.

Azure

Intune enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via Defender for Endpoint.

GCP

Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).

Google Workspace

Endpoint Management (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.
  • user_device_scan — Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Configure Automatic Session Locking on Enterprise Assets.

Quick checklist

  • Configure — End User / Mobile
  • Protect — End User / Mobile

Related articles on this site