On this page

Idle Session Timeout Screenshot Guide

1. Purpose of this Guide

This artefact demonstrates that your company enforces automatic log-off after a set idle period. Cyber Essentials requires this because if staff leave their laptops or web apps unlocked, attackers can waltz in. An enforced timeout slams the gate shut after a few minutes of inactivity.

2. What You Will Submit

You will need:

  • A screenshot showing idle session timeout settings.

  • The screenshot should clearly display:

    • The platform (Windows, macOS, Google Workspace, Microsoft 365, AWS, etc.).

    • The timeout duration (e.g. 5, 10, or 15 minutes).

    • Confirmation that automatic lock or log-off is enabled.

3. How to Collect / Obtain / Generate This Evidence

Windows 10/11:

  1. Open Group Policy Editor → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options.

  2. Find Interactive logon: Machine inactivity limit.

  3. Screenshot showing the value (e.g. 900 seconds = 15 mins).

macOS:

  1. Open System Settings → Lock Screen.

  2. Under Turn display off on battery/power, set to ≤ 10–15 minutes.

  3. Ensure Require password after sleep or screen saver begins is enabled.

  4. Screenshot this panel.

Google Workspace (Admin Console):

  1. Log into Admin Console → Devices → Chrome → Settings → User & Browser Settings.

  2. Find Idle Settings / Sign-out policy.

  3. Screenshot showing automatic sign-out after idle period.

Microsoft 365 (Entra / Office web apps):

  1. Open Microsoft Entra Admin Center → Conditional Access → Session controls.

  2. Check Sign-in frequency and Idle timeout policy.

  3. Screenshot showing policy applied to users.

AWS Console (example for cloud services):

  1. Open IAM → Account Settings → Console session timeout.

  2. Screenshot showing the timeout duration.

4. Evidence Format

  • Accepted file types: PNG, JPG, PDF.

  • Suggested naming format:
    YourCompanyName_IdleSessionTimeout_YYYY-MM-DD.png
    Example: AcmeCorp_IdleSessionTimeout_2025-07-01.png

5. What “Good” Looks Like

  • Screenshot shows timeout enabled (not “Never”).

  • Timeout duration is reasonable (≤ 15 minutes).

  • Platform name visible (to prove authenticity).

  • Date/version visible where possible.

Why it matters: auditors want to see that unattended sessions won’t sit open for hours, giving attackers easy access.

6. Tips

  • If you apply timeout via MDM (Intune, Jamf, Workspace ONE), grab a screenshot of the policy setting.

  • Redact personal names or device IDs if they appear.

  • Use consistent timeout values across systems for simplicity.