Session Lock

Define one number and let the operating system do the rest.

Objective [a] is the inactivity period, written in policy. Fifteen minutes is a common choice, and the requirement sets no value. Enforce the OS lock at that number through group policy or Intune and [b] follows. Every mainstream lock screen hides the desktop behind an image, a clock, or a blank display, which is all the pattern-hiding [c] asks for. Just confirm the locked screen itself cannot show CUI, the controlled unclassified information your contract requires you to protect.

Manage the setting centrally or prove users apply it themselves.

Central enforcement removes the question. For any machine outside central management, you need a documented required setting, users told to apply it, and a way to verify they did. That is a harder story to tell than one Intune policy, which is the argument for central management.

Web applications reachable from unmanaged devices need their own timeout.

OS session lock protects the machine it runs on. If a portal that touches CUI can be reached from a device you do not manage, the application or a gateway in front of it must enforce its own inactivity timeout. You cannot vouch for the lock on a device you do not control. When access only happens from managed endpoints with enforced lock, the OS answer covers the application too.

Session lock is not a substitute for logging off.

Lock covers the walk-away case. It does not replace ending sessions under AC.L2-3.1.11. Where a platform cannot lock a session, terminating it is the right lever instead, and the two requirements together cover the unattended session from both ends.