Re: Screensavers Timeouts

[David Grisham <DGrisham () SALUD UNM EDU>]

I can speak for UNM Hospitals and our health science center.  We are about to implement five minute
screen saver timeout on workstations that access EPHI.  Our workforce must also lock the workstation when they leave 
the workstation unattended and they must log out of clinical systems at the end of their shift. As stated, we are going 
to get grief no matter what we set.  However, we have workstation security component of HIPAA security to set our 
standard.
 Cheers.-grish
Information Security Officer, UNM Hospitals  

> > > dtindall () SPU EDU 9/13/2005 12:23:38 PM >>>

Be ready to take some flack no matter what you decide..  We use group policy on our Windows domain for fac/staff 
desktops to enforce the setting (no over-rides are allowed for the individual user).  We experimented with 30 minutes, 
then settled at 2 hrs after some additional "user input."  We also encourage users to lock their systems whenever they 
leave their desks.
 
It's not perfect, but seems to strike a reasonable balance.
 
--Dave

Dave Tindall
Asst VP for Technology Services (CIO)
Seattle Pacific University
Computer & Information Systems
Phone: (206) 281-2239
Fax: (206) 281-2850
Email: dtindall () spu edu
Web: http://www.spu.edu  

From: Clonts, Neal D. (HSC) [mailto:Neal-Clonts () OUHSC EDU] 
Sent: Tuesday, September 13, 2005 11:01 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Screensaver Timeouts



Fellow Security Professionals,
 
Our campus is looking at implementing a policy for screensaver timeouts and we are wondering if anyone else currently 
has this type of policy in place.
If you do have a policy on screensaver timeouts, how many minutes do you require before the screensaver is activated?
Neal Clonts, CISSP, CISA, MCP
Information Security Services
University of Oklahoma Health Sciences Center
Office Phone: 405-271-2476, Option 2
Cell Phone: 405-255-2999
Website: http://security.ouhsc.edu