AIOS-27-000400 Apple iOS/iPadOS 27 must allow the administrator (MDM) and/or the user to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].
All changes in this version
Maps to CM-6 via CCI-000366
Title
Apple iOS/iPadOS 27 must allow the administrator (MDM) and/or the user to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].
Control
Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DoW network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DoW network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DoW network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement.
Discussion
The system administrator (SA) and/or user must have the capability to configure VPN access to meet organization-specific policies based on mission needs. SFR ID: FMT_SMF_EXT.1.1 #3
Related controls
CCI-000366
Fix
If a third-party unmanaged VPN app is installed on the iOS 27 device, do not configure the VPN app with a DoW network VPN profile.