Technical controls must enforce session time-outs and lockouts for all systems containing covered information so that unattended or idle sessions are automatically protected.

Session time-outs and lockouts are enforced through technical controls

— Pyrana Information Security Policy.pdf

for all systems containing covered information

— Pyrana Information Security Policy.pdf

All mobile and desktop devices must be locked when unoccupied

— Pyrana Information Security Policy.pdf