Discloses the device's ability to prevent unauthorised use or misuse after a period of inactivity: whether it can be set to force the logged-in user to re-authenticate after a predetermined idle time (auto-logoff, session lock or password-protected screen saver), with a note on whether and how the logoff or lock can be disabled, per session or globally, with appropriate user warnings (ALOF-1); and whether the user or administrator can configure the idle time before logoff or lock, with the time or its fixed or configurable range stated, and whether it can be set per user or per role (ALOF-2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.