The information system initiates a session lock after the organization-defined time period of inactivity.