Do I have to have a password protected screen saver?
Yes. Workstation inactivity must trigger a password protected screen saver on your desktop. For systems that access sensitive data the inactivity timer must be 20 minutes or less. General purpose desktops must be 60 minutes or less.