BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AIOS-27-013400 Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

DISA STIG library V1R1
All changes in this version
first version loaded CAT II

Maps to AC-6(10), IA-2(1) via CCI-000765, CCI-002235

Title

Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

Control

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow auto unlock" is not checked. If Allow auto unlock is enabled, this is a finding.

Discussion

Auto Unlock allows an Apple Watch to automatically unlock an iPhone or Mac when in close proximity (not available for iPad). This feature allows the iPhone/Mac to be unlocked without the user entering the device passcode, which may lead to unauthorized users access to the iPhone/Mac and sensitive DoW data. This control is not applicable if the authorizing official (AO) has approved the use of Apple Watches. SFR ID: FMT_MOF_EXT.1.2 #47

Related controls

CCI-000765, CCI-002235

Fix

If the AO has not approved the use of Apple Watch with DoW-owned iPhones, configure the Apple iOS configuration profile to disable "Allow auto unlock". This is a supervised-only control. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Allow auto unlock" to "False". Configuration Profile Key: allowAutoUnlock