The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

STIG ID: APPL-13-000003  |  SRG: SRG-OS-000028-GPOS-00009 |  Severity: medium |  CCI: CCI-000056 |  Vulnerability Id: V-257144

Vulnerability Discussion

A screen saver must be enabled and set to require a password to unlock. An excessive grace period impacts the ability for a session to be truly locked, requiring authentication to unlock.

Check

Verify the macOS system is configured to initiate a session lock within five seconds of the screen saver starting with the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep "askForPasswordDelay"

askForPasswordDelay = 5;

If there is no result, or if "askForPasswordDelay" is not set to "5" or less, this is a finding.

Fix

Configure the macOS system to initiate a session lock within five seconds of the screen saver starting by installing the "Login Window Policy" configuration profile.