iOS test plan

What to test on a iOS release so the baseline still holds: the checks of Apple iOS/iPadOS 27 V1R1, by area

Derive from STIG mSCP branch Include CAT III Owner's templates

The release under test Version Hardware

Areas to test Hardware root of trust and secure enclave 7 Platform SSO and identity 8 Authentication 16 Disk encryption 3 MDM enrolment 7 Updates and release changes 1 Network 12 Browsers 1 Everything else 30 Untick an area to leave it out of the exports; it stays on the page, marked as not tested this time.

Export the kept checks Report look Untick a check, then Rebuild or export; the form carries the state and nothing is stored. One area is drawn at a time; what you untick in one is kept when you open another, and every export covers the whole plan: the checks kept, what was left out and why, a findings table and a sign-off.

The report looks

Plain: Calibri and grey tables, nothing else: the look before styles.
Formal assessment: A government assessment report in the SP 800-53A manner: serif headings, numbered sections, cover page. Cover page. Numbered sections.
Engineering runbook: For the engineer at the keyboard: monospaced headings, dark command blocks. Numbered sections.
Executive: Navy and teal with a cover page: for the people who sign it off. Cover page.
Compact checklist: Black on white, small type, no cover: prints the most checks per page.
Modern: A clean product look in indigo and slate.
Dark console: Light text on a dark page, terminal colours: for screens, not paper.
Board: Issue-tracker blues and lane greys, as the decisions board draws them.
Audit workpaper: Ledger green and auditor blue, with room for initials and references. Cover page. Numbered sections.
Markdown-native: How the report reads on GitHub: system fonts, ruled headings, grey code.
Word: Office's own blues: the house style of a document written in Word. Cover page. Numbered sections.

The look applies to Word, PDF, LaTeX and the printable checklist; Markdown, CSV and JSON stay plain. Each follows one of the mockups in docs/mockups/exports.

Link to this plan: the release, hardware and areas as a URL to bookmark or send; unticked checks do not travel with it.

Hardware root of trust and secure enclave 7 kept

owner's template Open Settings on the device and read the line above the Apple Account; open the device's record in the MDM.
Apple Platform Deployment, "About device supervision" (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: Settings says the device is supervised and managed by the organisation; the MDM shows Automated Device Enrollment with supervision on.
If it does not: An unsupervised device cannot be locked by the organisation, cannot have profiles made non-removable, and fails the STIG's supervision rule; re-enrol it through Apple Business Manager (a wipe) rather than a manual profile.
owner's template Trigger a fresh Managed Device Attestation from the MDM (a DeviceInformation query with a nonce, or the MDM's attestation action) and read the result.
Apple Platform Deployment, "Managed Device Attestation for Apple devices" (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: A valid attestation chained to Apple's private PKI, with the serial number, UDID and managed state matching the record, dated within the last seven days.
If it does not: A missing or failed attestation on an A11-or-later device means the device may not be what the record says; quarantine it from Conditional Access until a fresh attestation passes. Attestation needs iOS 16 or later.
owner's template Check the passcode profile against the STIG's values: minimum six characters, no more than four repeating or sequential characters, auto-lock within 15 minutes, ten failed attempts before wipe, a password required before data decrypts.
DISA, Apple iOS/iPadOS 26 STIG (passcode rules AIOS-26-006500 to 006950, 010400) (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: Settings, Face ID & Passcode (or Touch ID & Passcode) cannot be set weaker than the profile, and the device wipes after the tenth failed attempt in a test on a spare device.
If it does not: A passcode weaker than the profile allows means the profile is not installed or is not the most restrictive; the MDM's profile list on the device shows which one won.
owner's template Open Settings, Privacy & Security, Lockdown Mode and read its state; check the MDM's enrolment behaviour with it on.
Apple, "About Lockdown Mode" (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: Lockdown Mode is off on managed devices (Apple does not expose it to MDM, and a device with it on cannot enrol); where a high-risk user turns it on by policy, the device is documented as outside the managed fleet.
If it does not: A managed device found with Lockdown Mode on cannot be re-enrolled while it stays on; decide with the user whether the device is managed or locked down, not both.
owner's template On iOS 26.1 or later, open Settings, Privacy & Security, Background Security Improvements.
Apple, "About Background Security Improvements" (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: Automatically Install is on, and the device shows the latest improvement installed (Apple lists them on its security releases page with the base version they apply to).
If it does not: Off means the device waits for the next full update for fixes Apple ships in between; turn it on, or set the MDM restriction that forces it where the MDM supports one.
owner's template Read the Activation Lock state in the MDM's device record.
Apple Platform Deployment, "Activation Lock on Apple devices" (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: Activation Lock is organisation-linked and the bypass code is held by the MDM; on a supervised device the user-linked lock is disallowed by default.
If it does not: A user-linked lock without a bypass code means the device cannot be reassigned if the user leaves; retrieve the bypass code (possible for 15 days after supervision) or plan to clear the lock through Apple Business Manager.
owner's template Run the device through the MDM's OS-version compliance rule and compare with Apple's security releases page.
Apple security releases (Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad)
Success looks like: The device runs the current release (iOS 27, iPadOS 27) or the previous one still receiving fixes; an iPhone XS or XR stays on iOS 18 and is flagged as such.
If it does not: A device behind the current release by more than the fleet's grace period is non-compliant; the STIG requires the latest OS.

Any release

Choose a version and hardware above and the plan leaves out what does not apply to them, saying why. Every release and the hardware it runs on is on the Fleet page.

Derived from

STIG: Apple iOS/iPadOS 27 V1R1
Checks: 85 tested: 64 from the publishers' procedures, 21 from the owner's templates
By area: Hardware root of trust and secure enclave 7, Platform SSO and identity 8, Authentication 16, Disk encryption 3, MDM enrolment 7, Updates and release changes 1, Network 12, Browsers 1, Everything else 30

Templates 5

Conditional Access holds on the new release 3 steps · Authentication · conditional-access.yaml
Whatever the platform, the new OS release must still satisfy the compliance and device-state signals the Conditional Access policies ask for.
Entra ID single sign-on on iPhone, iPad and Android through the Microsoft brokers 5 steps · Platform SSO and identity · entra-sso-mobile.yaml
On Apple devices the Microsoft Enterprise SSO plug-in rides Microsoft Authenticator (extension com.microsoft.azureauthenticator.ssoextension) and is turned on by an Extensible Single Sign-on payload of type Redirect; on Android the broker is Authenticator or Company Portal. Test with a test account under the fleet's Conditional Access policies, on a device enrolled the way the fleet is enrolled.
Supervision, attestation, passcode and Lockdown Mode on an iPhone or iPad 7 steps · Hardware root of trust and secure enclave · hardware-root-ios.yaml
Every supported iPhone and iPad has a Secure Enclave; what varies is whether the organisation owns the chain above it. Test on a device enrolled through Automated Device Enrollment with the fleet's profiles applied.
Automated enrolment and the baseline profiles on a wiped device 3 steps · MDM enrolment · mdm-enrolment.yaml
The first thing to test on a new release is that a wiped device enrols without a hand on it and receives the baseline.
Kerberos SSO extension against Active Directory 3 steps · Platform SSO and identity · sso-kerberos-extension.yaml
For organisations with on-premises Active Directory. The MDM deploys an Extensible Single Sign-On payload of type Kerberos with the realm and the hosts it covers. Run on the corporate network or VPN.

Templates are YAML files under data/test-plans in the repository; the owner extends them by adding a file. Each says which releases and hardware it applies to, what success looks like and what to do when a step fails, and cites the document it follows. They are labelled as the owner's, not the publisher's.

How the areas are chosen

Each check is filed by the words in its title (then its procedure): Secure Enclave, TPM, secure boot and attestation under the hardware root of trust; Platform SSO, Entra, Kerberos and passkeys under SSO; BitLocker, FileVault and LUKS under disk encryption; passwords, smart cards, session lock and sudo under authentication; audit and logs under logging; firewall, SMB, SSH, TLS, Bluetooth and sharing under network; updates and releases under updates; enrolment and management under MDM; browsers by name; meeting rooms under collaboration. The rest is "everything else". The words are the publishers'; only the filing is this product's.

The iOS baseline · Fleet · All baselines