diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index 665b290ed4..4a068a0810 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -21,11 +21,17 @@
     end
   end
 
-  context "installed by bosh_sudoers" do
+  context "installed by bosh_sudoers (CIS-5.2.2, CIS-5.2.3)" do
     describe file("/etc/sudoers") do
       it { should be_file }
       its(:content) { should match(/%bosh_sudoers ALL=\(ALL\) NOPASSWD: ALL/m) }
       its(:content) { should match "#includedir /etc/sudoers.d" }
+      its(:content) { should match(/^Defaults\s+use_pty$/) }
+      its(:content) { should match(%r{^Defaults\s+logfile=/var/log/sudo\.log$}) }
+    end
+
+    describe command("egrep -sh '!use_pty' /etc/sudoers /etc/sudoers.d/* | egrep -v '^[[:space:]]*#' --") do
+      its(:stdout) { should eq("") }
     end
   end
 
@@ -69,6 +75,17 @@
       it { should be_file }
     end
 
+    context "idle session timeout (CIS-5.4.3.2)" do
+      describe file("/etc/profile.d/01-tmout.sh") do
+        it { should be_file }
+        it { should be_mode(0o644) }
+        it { should be_owned_by("root") }
+        its(:group) { should eq("root") }
+        its(:content) { should match(/^readonly TMOUT=900$/) }
+        its(:content) { should match(/^export TMOUT$/) }
+      end
+    end
+
     describe command("grep -q .bashrc /root/.profile") do
       it("has exit status of 0") { expect(subject.exit_status).to eq 0 }
     end
@@ -229,6 +246,10 @@
       expect(sshd_config.content).to match(/^MaxAuthTries 3$/)
     end
 
+    it "sets MaxStartups to 10:30:60 (CIS-5.1.18)" do
+      expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/).map(&:strip)).to contain_exactly("MaxStartups 10:30:60")
+    end
+
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do
       expect(sshd_config.content).to match(/^PermitEmptyPasswords no$/)
     end
diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index c6573274db..52d3aa01e1 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -24,6 +24,9 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
+sed "/^[ \t]*MaxStartups/d" -i "$chroot/etc/ssh/sshd_config"
+echo 'MaxStartups 10:30:60' >> "$chroot/etc/ssh/sshd_config"
+
 sed "/^ *PermitEmptyPasswords/d" -i $chroot/etc/ssh/sshd_config
 echo 'PermitEmptyPasswords no' >> $chroot/etc/ssh/sshd_config
 
diff --git a/stemcell_builder/stages/bosh_users/apply.sh b/stemcell_builder/stages/bosh_users/apply.sh
index 6afe426c05..e0ffe4fd68 100755
--- a/stemcell_builder/stages/bosh_users/apply.sh
+++ b/stemcell_builder/stages/bosh_users/apply.sh
@@ -36,3 +36,10 @@ cp $assets_dir/ps1.sh $chroot/etc/profile.d/00-bosh-ps1
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/root/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
+
+# configure idle session shell timeout
+cat << 'EOF' > "$chroot/etc/profile.d/01-tmout.sh"
+readonly TMOUT=900
+export TMOUT
+EOF
+chmod 0644 "$chroot/etc/profile.d/01-tmout.sh"
diff --git a/stemcell_builder/stages/bosh_users/assets/sudoers b/stemcell_builder/stages/bosh_users/assets/sudoers
index d2f7795cc6..e64a91ef67 100644
--- a/stemcell_builder/stages/bosh_users/assets/sudoers
+++ b/stemcell_builder/stages/bosh_users/assets/sudoers
@@ -4,6 +4,10 @@
 # Defaults
 
 Defaults        !lecture,tty_tickets,!fqdn
+# Run sudo commands in a dedicated pseudo-terminal
+Defaults        use_pty
+# Log sudo activity to a dedicated log file
+Defaults        logfile=/var/log/sudo.log
 
 # Uncomment to allow members of group sudo to not need a password
 # %sudo ALL=NOPASSWD: ALL