DISA STIG library V1R3
| Ref | Title | Text | |
|---|---|---|---|
| AIOS-26-001000 | Apple iOS/iPadOS 26 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis]. | Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DOD network (work) VPN profile. This validation proc | |
| AIOS-26-003000 | Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-26-003200 | Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud document and data synchronization). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-26-003300 | Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Keychain). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-26-003450 | Apple iOS/iPadOS 26 must not allow backup to remote systems (Cloud Photo Library). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-26-003500 | Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-26-003600 | Apple iOS/iPadOS 26 must not allow backup to remote systems (managed applications data stored in iCloud). | Review configuration settings to confirm "Allow managed apps to store data in iCloud" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple | |
| AIOS-26-003700 | Apple iOS/iPadOS 26 must not allow backup to remote systems (enterprise books). | Review configuration settings to confirm "Allow backup of enterprise books" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-26-006500 | Apple iOS/iPadOS 26 must be configured to enforce a minimum password length of six characters. | Review configuration settings to confirm the minimum passcode length is six or more characters. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configurat | |
| AIOS-26-006600 | Apple iOS/iPadOS 26 must be configured to not allow passwords that include more than four repeating or sequential characters. | Review configuration settings to confirm simple passcodes are not allowed. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, | |
| AIOS-26-006800 | Apple iOS/iPadOS 26 must be configured to lock the display after 15 minutes (or less) of inactivity. | Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple con | |
| AIOS-26-006900 | Apple iOS/iPadOS 26 must be configured to not allow more than 10 consecutive failed authentication attempts. | Review configuration settings to confirm that consecutive failed authentication attempts is set to 10 or fewer. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has mul | |
| AIOS-26-006950 | Apple iOS/iPadOS 26 must be configured to enforce a passcode reuse prohibition of at least two generations. | Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If a | |
| AIOS-26-007000 | Apple iOS/iPadOS 26 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store]. | Review configuration settings to confirm "Allow Trusting New Enterprise App Authors" is disabled. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configur | |
| AIOS-26-007200 | Apple iOS/iPadOS 26 must not include applications with the following characteristics: access to Siri when the device is locked. | Review configuration settings to confirm that Siri is disabled on the Lock screen. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration p | |
| AIOS-26-007400 | Apple iOS/iPadOS 26 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a re… | Verify no apps with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic | |
| AIOS-26-007500 | Apple iOS/iPadOS 26 must be configured to not display notifications when the device is locked. | Review configuration settings to confirm the display of notifications when the device is locked has been disabled. This check procedure is performed on the Apple iOS/iPadOS management tool and mobile device. In the Apple iOS/iPadOS manageme | |
| AIOS-26-007600 | Apple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked. | Review configuration settings to confirm "Show Today view in Lock screen" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configurati | |
| AIOS-26-008400 | Apple iOS/iPadOS 26 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device. | The DOD warning banner can be displayed by either of the following methods (required text is found in the Vulnerability Discussion): 1. By placing the DOD warning banner text in the user agreement signed by each iPhone and iPad user. 2. By | |
| AIOS-26-009200 | Apple iOS/iPadOS 26 must be configured to not allow backup of [all applications, configuration data] to locally connected systems. | Review configuration settings to confirm backup in management apps is disabled and "Encrypt local backup" is enabled in iTunes (for Windows computer) and in Finder on Mac. Note: iTunes Backup/Finder backup is implemented by the configuratio | |
| AIOS-26-009700 | Apple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data. | Review configuration settings to confirm "Allow documents from managed apps in unmanaged apps" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has | |
| AIOS-26-009800 | Apple iPadOS 26 must be configured to disable multiuser modes. | Verify multiuser mode (shared iPad) is disabled in the MDM console for iPadOS devices. This requirement is not applicable for iOS devices. If multiuser mode is not disabled in the MDM console for iPadOS devices, this is a finding. | |
| AIOS-26-009900 | Apple iOS/iPadOS 26 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM. | Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is perfo | |
| AIOS-26-010000 | Apple iOS/iPadOS 26 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM. | Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is perfo | |
| AIOS-26-010200 | Apple iOS/iPadOS 26 must be configured to disable ad hoc wireless client-to-client connection capability. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-010400 | Apple iOS/iPadOS 26 must require a valid password be successfully entered before the mobile device data is unencrypted. | Review configuration settings to confirm the device is set to require a passcode before use. This procedure is performed on the iOS and iPadOS device. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device | |
| AIOS-26-010500 | Apple iOS/iPadOS 26 must implement the management setting: limit Ad Tracking. | Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration pro | |
| AIOS-26-010600 | Apple iOS/iPadOS 26 must implement the management setting: not allow automatic completion of Safari browser passcodes. | Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, t | |
| AIOS-26-010700 | Apple iOS/iPadOS 26 must implement the management setting: encrypt backups/Encrypt local backup. | Review configuration settings to confirm "Force encrypted backups" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profi | |
| AIOS-26-010800 | Apple iOS/iPadOS 26 must implement the management setting: not allow use of Handoff. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-010850 | Apple iOS/iPadOS 26 must implement the management setting: not allow use of iPhone widgets on Mac. | Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check | |
| AIOS-26-010900 | Apple iOS/iPadOS 26 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device. | Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multipl | |
| AIOS-26-011000 | Apple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop. | Review configuration settings to confirm "Allow MailDrop" is disabled. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles | |
| AIOS-26-011200 | iPhone and iPad must have the latest available iOS/iPadOS operating system installed. | Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and de | |
| AIOS-26-011300 | Apple iOS/iPadOS 26 must implement the management setting: use SSL for Exchange ActiveSync. | Review configuration settings to confirm "Use SSL" for the Exchange account is enabled for incoming mail. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has m | |
| AIOS-26-011400 | Apple iOS/iPadOS 26 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 26 Mail app. | Review configuration settings to confirm "Allow messages to be moved" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration p | |
| AIOS-26-011500 | Apple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination. | Review configuration settings to confirm "Treat AirDrop as an unmanaged destination" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple c | |
| AIOS-26-011600 | Apple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing. | Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone | |
| AIOS-26-011700 | Apple iOS/iPadOS 26 must implement the management setting: not share location data through iCloud. | Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad only. On | |
| AIOS-26-011800 | Apple iOS/iPadOS 26 must implement the management setting: force Apple Watch wrist detection. | Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-26-011900 | Apple iOS/iPadOS 26 users must complete required training. | Review a sample of site User Agreements for iOS device users or similar training records and training course content. Verify iPhone and iPad users have completed required training. If any iPhone/iPad user has not completed required training | |
| AIOS-26-012000 | A managed photo app must be used to take and store work-related photos. | Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device | |
| AIOS-26-012200 | Apple iOS/iPadOS 26 must implement the management setting: enable USB Restricted Mode. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-012300 | Apple iOS/iPadOS 26 must not allow managed apps to write contacts to unmanaged contacts accounts. | Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note | |
| AIOS-26-012400 | Apple iOS/iPadOS 26 must not allow unmanaged apps to read contacts from managed contacts accounts. | Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an | |
| AIOS-26-012500 | Apple iOS/iPadOS 26 must implement the management setting: disable AirDrop. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-012600 | Apple iOS/iPadOS 26 must implement the management setting: disable paired Apple Watch. | Review configuration settings to confirm "Allow Paired Watch" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad | |
| AIOS-26-012700 | Apple iOS/iPadOS 26 must disable "Password AutoFill" in browsers and applications. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-012800 | Apple iOS/iPadOS 26 must disable "Allow setting up new nearby devices". | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-012900 | Apple iOS/iPadOS 26 must disable password proximity requests. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-013000 | Apple iOS/iPadOS 26 must disable password sharing. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-013100 | Apple iOS/iPadOS 26 must disable "Find My Friends" in the "Find My" app. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-26-013200 | The Apple iOS/iPadOS 26 must be supervised by the MDM. | Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-26-013300 | Apple iOS/iPadOS 26 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DOD-approved USB storage drives with iOS/iPadOS devices. | This requirement is not applicable if the AO has approved the use of USB drives to load files to Apple devices. The approval must be in writing and include which USB storage devices are approved for use. If the AO has not approved the use o | |
| AIOS-26-013400 | The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. | Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configurati | |
| AIOS-26-013500 | Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements. | Review configuration settings to confirm configuration profiles are not removable. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. The procedures below assume the site is not enrolled in App | |
| AIOS-26-014300 | Apple iOS/iPadOS 26 must disable "Allow network drive access in Files access". | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-26-014400 | Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of dictation. | If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Disable connections to Siri servers for the purpose of dictation" is disabled. This check procedure is performed on the device manageme | |
| AIOS-26-014500 | Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of translation. | This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the revie | |
| AIOS-26-014600 | Apple iOS/iPadOS 26 must disable copy/paste of data from managed to unmanaged applications. | Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Require managed pasteboard | |
| AIOS-26-014700 | Apple iOS/iPadOS 26 must have DOD root and intermediate PKI certificates installed. | Verify DOD intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DOD intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the | |
| AIOS-26-014800 | Apple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch. | Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed o | |
| AIOS-26-014900 | Apple iOS/iPadOS 26 must disable the installation of alternative marketplace apps. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-26-015000 | Apple iOS/iPadOS 26 must disable app installation from a website. | This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applica | |
| AIOS-26-015100 | Apple iOS/iPadOS 26 must delete eSIM content when the device is erased. | This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applica | |
| AIOS-26-015400 | Apple iOS/iPadOS 26 must disable ChatGPT connection for Apple Intelligence. | This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the revie | |
| AIOS-26-015500 | Apple iOS/iPadOS 26 must disable the download of iOS/iPadOS beta updates. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-26-015600 | Apple iOS/iPadOS 26 must disable the ability to hide apps. | This check procedure is performed on the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable t | |
| AIOS-26-015700 | Apple iOS/iPadOS 26 must disable recording cell phone calls on the iPhone. | This check procedure is performed on the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the sco | |
| AIOS-26-015800 | Apple iOS/iPadOS 26 must disable iPhone Mirroring on Mac. | This check procedure is performed on the device management tool and iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope o | |
| AIOS-26-016000 | Apple iOS/iPadOS 26 must disable the ability of the user to wipe the device. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-016400 | Apple iOS/iPadOS 26 must disable automatic downloads of apps purchased on other Apple devices. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-016500 | Apple iOS/iPadOS 26 must disable pairing with a host Mac or PC. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-016600 | Apple iOS/iPadOS 26 must disable AirPrint. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-016700 | Apple iOS/iPadOS 26 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurab | |
| AIOS-26-016800 | Apple iOS/iPadOS 26 must disable AirPrint: Allow storage of AirPrint credentials in Keychain. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurab | |
| AIOS-26-016900 | Apple iOS/iPadOS 26 must allow AirPrint feature: Disallow AirPrint to destinations with untrusted certificates. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurab | |
| AIOS-26-017000 | Apple iOS/iPadOS 26 must disable Allowed Content Ratings (Movies). | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-017100 | Apple iOS/iPadOS 26 must disable Allowed Content Ratings (TV Shows). | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-26-017200 | Apple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Wand. | Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the | |
| AIOS-26-017300 | Apple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Generation. | Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the | |
| AIOS-26-017400 | Apple iOS/iPadOS 26 must disable Apple Intelligence feature: generate new Genmoji. | Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the | |
| AIOS-26-017700 | DOD Apple iOS/iPadOS 26 devices must have a Mobile Threat Detection (MTD) app installed. | Confirm an MTD app is installed on managed iPhones and iPads. This check procedure is performed on both the device management tool and the iPhone and iPad device. In the iOS/iPadOS management tool, verify an MTD app is listed as a managed a | |
| AIOS-26-017800 | DOD Apple iOS/iPadOS 26 devices must disable FaceTime. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This chec | |
| AIOS-26-017900 | DOD Apple iOS/iPadOS 26 devices must disable eSIM transfers. | Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requi | |
| AIOS-26-018000 | DOD Apple iOS/iPadOS 26 devices must disable screenshots and screen recordings. | Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration p | |
| AIOS-26-018100 | Apple iOS/iPadOS 26 must implement the management setting: disable Camera. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding (if the AO has not approved the use of Apple device camera). If the iPhone or iPad being reviewed | |
| AIOS-26-018300 | Apple iOS/iPadOS 26 must be configured to disable Wi-Fi Aware. | Confirm required Wi-Fi Aware procedures have been implemented. 1. Verify required training has been received by site personal that have site managed iPhones and iPads (AIOS-26-0011900). 2. Verify the site reviewed all managed iOS/iPadOS app |
88 of 88.