iOS AIOS-27-009500
DISA STIG recommends
AIOS-27-009500 CAT I
Apple iOS/iPadOS 27 must require that a valid password be successfully entered before the mobile device data is unencrypted.
NIST SP 800-53: SC-28
Check
Review configuration settings to require a passcode to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding.
Fix
Install a configuration profile to require a password to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes".
Our decision
Apply as published
No decision recorded: the recommendation stands. The owner signs in to change it.