DISA STIG library V1R1
| Ref | Title | Text | |
|---|---|---|---|
| AIOS-27-000400 | Apple iOS/iPadOS 27 must allow the administrator (MDM) and/or the user to perform the following management function: enable/disable VPN protection across the device and [selection: other methods]. | Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DoW network (work) VPN profile. This validation proc | |
| AIOS-27-002700 | Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-27-002800 | Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud document and data synchronization). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-27-002900 | Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Keychain). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-27-003000 | Apple iOS/iPadOS 27 must not allow backup to remote systems (Cloud Photo Library). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-27-003100 | Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream). | Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data stor | |
| AIOS-27-003200 | Apple iOS/iPadOS 27 must not allow backup to remote systems (managed applications data stored in iCloud). | Review configuration settings to confirm "Allow managed apps to store data in iCloud" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple | |
| AIOS-27-003300 | Apple iOS/iPadOS 27 must not allow backup to remote systems (enterprise books). | Review configuration settings to confirm "Allow backup of enterprise books" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-27-006000 | Apple iOS/iPadOS 27 (MOS) must be configured to enforce a minimum password length of six characters. | Review configuration settings to confirm the minimum passcode length is six or more characters. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configurat | |
| AIOS-27-006100 | Apple iOS/iPadOS 27 (MOS) must be configured to not allow passwords that include more than four repeating or sequential characters. | Review configuration settings to confirm simple passcodes are not allowed. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, | |
| AIOS-27-006300 | Apple iOS/iPadOS 27 (MOS) must be configured to lock the display after 15 minutes (or less) of inactivity. | Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, t | |
| AIOS-27-006400 | Apple iOS/iPadOS 27 (MOS) must be configured to not allow more than 10 consecutive failed authentication attempts. | Review configuration settings to confirm that consecutive failed authentication attempts is set to 10 or fewer. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has mul | |
| AIOS-27-006500 | Apple iOS/iPadOS 27 must be configured to enforce a passcode reuse prohibition of at least two generations. | Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If a | |
| AIOS-27-006600 | Apple iOS/iPadOS 27 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoW-approved commercial app repository, MDM server, mobile application store]. | Review configuration settings to confirm "Allow Trusting New Enterprise App Authors" is disabled. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configur | |
| AIOS-27-006800 | The Apple iOS/iPadOS 27 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to… | Verify no apps or app clips with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits M | |
| AIOS-27-006900 | Apple iOS/iPadOS 27 must not include applications with the following characteristics: access to Siri when the device is locked. | Review configuration settings to confirm that Siri is disabled on the Lock screen. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check pro | |
| AIOS-27-007100 | Apple iOS/iPadOS 27 must be configured to not display notifications when the device is locked. | Review configuration settings to confirm the display of notifications when the device is locked has been disabled. This check procedure is performed on the Apple iOS/iPadOS management tool and mobile device. In the Apple iOS/iPadOS manageme | |
| AIOS-27-007200 | Apple iOS/iPadOS 27 must not display notifications (calendar information) when the device is locked. | Review configuration settings to confirm "Show Today view in Lock screen" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configurati | |
| AIOS-27-008100 | Apple iOS/iPadOS 27 (MOS) must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device. | The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a L | |
| AIOS-27-008400 | Apple iOS/iPadOS 27 must be configured to not allow backup of [all applications, configuration data] to locally connected systems. | Review configuration settings to confirm backup in management apps is disabled and "Encrypt local backup" is enabled in iTunes (for Windows computer) and in Finder on Mac. Note: iTunes Backup/Finder backup is implemented by the configuratio | |
| AIOS-27-008800 | Apple iOS/iPadOS 27 must not allow non-DoW applications to access DoW data. | Review configuration settings to confirm "Allow documents from managed apps in unmanaged apps" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has | |
| AIOS-27-008900 | Apple iOS/iPadOS 27 (MOS) must be configured to disable multiuser modes. | Verify multiuser mode (shared iPad) is disabled in the MDM console for iPadOS devices. This requirement is not applicable for iOS devices. If multiuser mode is not disabled in the MDM console for iPadOS devices, this is a finding. | |
| AIOS-27-009000 | Apple iOS/iPadOS 27 (MOS) must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM. | Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is perfo | |
| AIOS-27-009100 | Apple iOS/iPadOS 27 (MOS) must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory installed application)] upon unenrollment from MDM. | Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is perfo | |
| AIOS-27-009400 | All mobile operating system (MOS) cryptography must be configured to be in FIPS 140-3-validated mode. | Review configuration settings to confirm the device is set to require a passcode before use. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. This procedure is performed in the A | |
| AIOS-27-009500 | Apple iOS/iPadOS 27 must require that a valid password be successfully entered before the mobile device data is unencrypted. | Review configuration settings to require a passcode to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. This procedure is performed in the Apple iOS/iPadOS management t | |
| AIOS-27-009700 | Apple iOS/iPadOS 27 must implement the management setting: limit Ad Tracking. | Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration pro | |
| AIOS-27-009800 | Apple iOS/iPadOS 27 must implement the management setting: not allow automatic completion of Safari browser passcodes. | Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, t | |
| AIOS-27-009900 | Apple iOS/iPadOS 27 must implement the management setting: encrypt backups/encrypt local backup. | Review configuration settings to confirm "Force encrypted backups" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profi | |
| AIOS-27-010000 | Apple iOS/iPadOS 27 must implement the management setting: not allow use of Handoff. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-010100 | Apple iOS/iPadOS 27 must implement the management setting: not allow use of iPhone widgets on Mac. | Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check | |
| AIOS-27-010200 | Apple iOS/iPadOS 27 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device. | Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multipl | |
| AIOS-27-010300 | Apple iOS/iPadOS 27 must implement the management setting: disable Allow MailDrop. | Review configuration settings to confirm "Allow MailDrop" is disabled. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles | |
| AIOS-27-010400 | iPhone and iPad must have the latest available iOS/iPadOS operating system installed. | Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and de | |
| AIOS-27-010500 | Apple iOS/iPadOS 27 must implement the management setting: use SSL for Exchange ActiveSync. | Review configuration settings to confirm "Use SSL" for the Exchange account is enabled for incoming mail. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has m | |
| AIOS-27-010600 | Apple iOS/iPadOS 27 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 27 Mail app. | Review configuration settings to confirm "Allow messages to be moved" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration p | |
| AIOS-27-010700 | Apple iOS/iPadOS 27 must implement the management setting: treat AirDrop as an unmanaged destination. | Review configuration settings to confirm "Treat AirDrop as an unmanaged destination" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple c | |
| AIOS-27-010800 | Apple iOS/iPadOS 27 must implement the management setting: not have any Family Members in Family Sharing. | Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone | |
| AIOS-27-010900 | Apple iOS/iPadOS 27 must implement the management setting: not share location data through iCloud. | Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad only. On | |
| AIOS-27-011000 | Apple iOS/iPadOS 27 must implement the management setting: force Apple Watch wrist detection. | Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-27-011100 | Apple iOS/iPadOS 27 users must complete required training. | Review a sample of site User Agreements for iOS device users or similar training records and training course content. Verify iPhone and iPad users have completed required training. If any iPhone/iPad user has not completed required training | |
| AIOS-27-011200 | A managed photo app must be used to take and store work-related photos. | Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device | |
| AIOS-27-011400 | Apple iOS/iPadOS 27 must implement the management setting: enable USB Restricted Mode. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-011500 | Apple iOS/iPadOS 27 must not allow managed apps to write contacts to unmanaged contacts accounts. | Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note | |
| AIOS-27-011600 | Apple iOS/iPadOS 27 must not allow unmanaged apps to read contacts from managed contacts accounts. | Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an | |
| AIOS-27-011700 | Apple iOS/iPadOS 27 must implement the management setting: disable AirDrop. | Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is | |
| AIOS-27-011800 | Apple iOS/iPadOS 27 must implement the management setting: disable paired Apple Watch. | Review configuration settings to confirm "Allow Paired Watch" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad | |
| AIOS-27-012000 | Apple iOS/iPadOS 27 must disable "Password AutoFill" in browsers and applications. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-012100 | Apple iOS/iPadOS 27 must disable "Allow setting up new nearby devices". | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-012200 | Apple iOS/iPadOS 27 must disable password proximity requests. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-012300 | Apple iOS/iPadOS 27 must disable password sharing. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-012400 | Apple iOS/iPadOS 27 must disable "Find My Friends" in the "Find My" app. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to c | |
| AIOS-27-012500 | The Apple iOS/iPadOS 27 must be supervised by the MDM. | Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configura | |
| AIOS-27-012600 | Apple iOS/iPadOS 27 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DoW-approved USB storage drives with iOS/iPadOS devices. | This requirement is not applicable if the AO has approved the use of USB drives to load files to Apple devices. The approval must be in writing and include which USB storage devices are approved for use. If the AO has not approved the use o | |
| AIOS-27-012700 | The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. | Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configurati | |
| AIOS-27-012800 | Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DoW security requirements. | Review configuration settings to confirm configuration profiles are not removable. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. The procedures below assume the site is not enrolled in App | |
| AIOS-27-012900 | Apple iOS/iPadOS 27 must disable "Allow network drive access in Files access". | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-27-013000 | Apple iOS/iPadOS 27 must disable connections to Siri servers for the purpose of dictation. | Review configuration settings to confirm connections to Siri servers for the purpose of dictation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration | |
| AIOS-27-013100 | Apple iOS/iPadOS 27 must disable connections to Siri servers for the purpose of translation. | Review configuration settings to confirm connections to Siri servers for the purpose of translation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configurati | |
| AIOS-27-013200 | Apple iOS/iPadOS 27 must disable copy/paste of data from managed to unmanaged applications. | Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Require managed pasteboard | |
| AIOS-27-013300 | Apple iOS/iPadOS 27 must have DoW root and intermediate PKI certificates installed. | Verify DoW intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DoW intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the | |
| AIOS-27-013400 | Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is | |
| AIOS-27-013500 | Apple iOS/iPadOS 27 must disable the installation of alternative marketplace apps. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-27-013600 | Apple iOS/iPadOS 27 must disable app installation from a website. | This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applica | |
| AIOS-27-013700 | Apple iOS/iPadOS 27 must delete eSIM content when the device is erased. | This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applica | |
| AIOS-27-013800 | Apple iOS/iPadOS 27 must disable third-party artificial intelligence (AI) app (example: ChatGPT) connections for Apple Intelligence. | Review configuration settings to confirm third-party AI app connections to Apple Intelligence are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration pro | |
| AIOS-27-013900 | Apple iOS/iPadOS 27 must disable the download of iOS/iPadOS beta updates. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Not | |
| AIOS-27-014000 | Apple iOS/iPadOS 27 must disable the ability to hide apps. | This check procedure is performed on the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable t | |
| AIOS-27-014100 | Apple iOS 27 must disable recording cellphone calls on the iPhone. | This check procedure is performed on the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the sco | |
| AIOS-27-014200 | Apple iOS/iPadOS 27 must disable iPhone Mirroring on Mac. | This check procedure is performed on the device management tool and iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope o | |
| AIOS-27-014300 | Apple iOS/iPadOS 27 must disable the ability of the user to wipe the device. | Review configuration settings to confirm "Allow Erase All Content and Settings" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If t | |
| AIOS-27-014700 | Apple iOS/iPadOS 27 must disable automatic downloads of apps purchased on other Apple devices. | Review configuration settings to confirm "Allow automatic app downloads" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPho | |
| AIOS-27-014800 | Apple iOS/iPadOS 27 must disable pairing with a host Mac or PC. | Review configuration settings to confirm "Allow host pairing" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad | |
| AIOS-27-014900 | Apple iOS/iPadOS 27 must disable AirPrint. | Review configuration settings to confirm "Allow AirPrint" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad bein | |
| AIOS-27-015000 | Apple iOS/iPadOS 27 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons. | Review configuration settings to confirm "Allow discovery of AirPrint printers using iBeacons" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically | |
| AIOS-27-015100 | Apple iOS/iPadOS 27 must disable AirPrint: Allow storage of AirPrint credentials in Keychain. | Review configuration settings to confirm "Allow storage of AirPrint credentials in Keychain" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a | |
| AIOS-27-015200 | Apple iOS/iPadOS 27 must allow the AirPrint feature: Disallow AirPrint to destinations with untrusted certificates. | Review configuration settings to confirm "Disallow AirPrint to destinations with untrusted certificates" is enabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is autom | |
| AIOS-27-015300 | Apple iOS/iPadOS 27 must disable Allowed Content Ratings (Movies). | Review configuration settings to confirm "Allowed Content Ratings (Movies)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the i | |
| AIOS-27-015400 | Apple iOS/iPadOS 27 must disable Allowed Content Ratings (TV Shows). | Review configuration settings to confirm "Allowed Content Ratings (TV Shows)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the | |
| AIOS-27-015500 | Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Wand. | Review configuration settings to confirm the Apple Intelligence feature "Image Wand" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPa | |
| AIOS-27-015600 | Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Generation. | Review configuration settings to confirm the Apple Intelligence feature "Image Generation" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone | |
| AIOS-27-015700 | Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: generate new Genmoji. | Review configuration settings to confirm the Apple Intelligence feature "generate new Genmoji" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPh | |
| AIOS-27-015800 | DoW Apple iOS/iPadOS 27 devices must have a Mobile Threat Detection (MTD) app installed. | Confirm an MTD app is installed on managed iPhones and iPads. This check procedure is performed on both the device management tool and the iPhone and iPad device. In the iOS/iPadOS management tool, verify an MTD app is listed as a managed a | |
| AIOS-27-015900 | DoW Apple iOS/iPadOS 27 devices must disable FaceTime. | This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This chec | |
| AIOS-27-016000 | DoW Apple iOS/iPadOS 27 devices must disable eSIM transfers. | Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requi | |
| AIOS-27-016100 | DoW Apple iOS/iPadOS 27 devices must disable screenshots and screen recordings. | Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration p | |
| AIOS-27-016200 | Apple iOS/iPadOS 27 must implement the management setting: disable Camera. | Determine if the site AO has approved the use of Apple device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If appr | |
| AIOS-27-016400 | Apple iOS/iPadOS 27 must be configured to disable Wi-Fi Aware. | Confirm required Wi-Fi Aware procedures have been implemented. 1. Verify site personal that have site-managed iPhones and iPads have completed required training (AIOS-27-011100). 2. Verify the site reviewed all managed iOS/iPadOS apps insta | |
| AIOS-27-016500 | The Apple iOS/iPadOS 27 device must be configured to disable web-based artificial intelligence (AI) interactions. | On the mobile device, try to browse unauthorized AI URLs. Examples to input: chatgpt.com, claude.ai, gemini.google.com, v0.dev. Verify the unauthorized AI websites cannot be reached. If the iPhone/iPad has not been configured to disable web |
89 of 89.