NIST 800-53 r5 · Controls catalogue · Family AC

AC-11Device Lock

Prevent further access to the system by {{ insert: param, ac-11_odp.01 }} ; and Retain the device lock until the user reestablishes access using established identification and authentication procedures.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (2)

T1021.001 Remote Desktop Protocol Lateral Movement
T1563.002 RDP Hijacking Lateral Movement

Weaknesses this control addresses (3)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-284`	Improper Access Control	6,900+	Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
`CWE-306`	Missing Authentication for Critical Function	3,300+	Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
`CWE-613`	Insufficient Session Expiration	600+	Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family AC

AC-1 AC-10 AC-12 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-2 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9