Security
by jamesrl
Some security conscious firms I have been with have used as little as 5 minutes. One global firm I was with used 15 minutes, and would bend it to 30 minutes on request.
Not sure you will find these things published. Companies tend not to share that kind of information.
You have to determine whats right for your business. If you have sensitive information on the screen all the time, 30 seconds may be annoying , but appropriate. If you are just working with non-propriatary information, then 15 minutes(time it takes to get a coffee) may be enough.
James
by johnsmith
We have a policy in place that forces password protection on the screensaver with a timeout of 5 minutes. We are a financial org with a large amount of sensitive client financial data.
This looks very good on a security audit, by the way.
by eosrebelx
by johnsmith
You might look at ciac.org, sans.org, nsa.gov, and policy.nrcs.usda.gov. Several higher education institutions have published their guidelines as well. There does not appear to be a hard and fast rule, or even a Best Practices recommendation; just whatever your organization is comfortable with. Physical security is a factor; generally the timeout time should be lower as the level of physical access increases. Logical access is also a consideration; how much access does the user have to information/systems?
We basically took the lowest comfort level timeout for the highest level users (within reason; some wanted 1 minute!) and made it the company standard. We also cycle our breaks within a given department so no machine is left unattended (out of view of an on-duty employee).
This discussion is closed to new replies.
Sort by Trending