A screen saver must be enabled and set to require a password to unlock. An excessive grace period impacts the ability for a session to be truly locked, requiring authentication to unlock.
Check
Verify the macOS system is configured to initiate a session lock within five seconds of the screen saver starting with the following command:
If there is no result, or if "askForPasswordDelay" is not set to "5" or less, this is a finding.
Fix
Configure the macOS system to initiate a session lock within five seconds of the screen saver starting by installing the "Login Window Policy" configuration profile.