NIST macOS Security Compliance Project iOS 26 Guidance, Revision 3.0 (6262df0)
| Ref | Title | Text | |
|---|---|---|---|
| icloud_backup_disabled | Ensure iCloud Backup is set to Disabled | iCloud backup _MUST_ be disabled. | |
| icloud_drive_disable | Ensure Allow iCloud Documents and Data is set to Disabled | Institutionally owned devices _MUST_ not sync data through iCloud. | |
| icloud_enterprisebook_metadata_sync_disable | Preventing synchronization of enterprise book meta data. | The iOS device _MUST_ be configured to prevent the synchronization of enterprise book meta data to Apple iCloud servers. Apple's iCloud service does not provide an organization with enough control over the storage and access of data and, t | |
| icloud_keychain_disable | Disable iCloud Keychain Sync | The iOS system's ability to automatically synchronize a user's passwords to their iCloud account _MUST_ be disabled. | |
| icloud_managed_apps_store_data_disabled | Ensure Managed Apps Storing Data in iCloud is Set to Disabled | Managed Apps _MUST_ not store data in iCloud. | |
| icloud_photo_stream_disable | Ensure Photo Stream is set to Disabled | If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoD information systems. An adversary could exploit vulnerabilities created by the weaker con | |
| icloud_photos_disable | Disable iCloud Photo Library | The iOS built-in Photos.app connection to Apple's iCloud service _MUST_ be disabled. Apple's iCloud service does not provide an organization with enough control over the storage and access of data and, therefore, automated photo synchroniz | |
| icloud_shared_photo_stream_disable | Ensure Shared Photo Stream is set to Disabled | If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoD information systems. An adversary could exploit vulnerabilities created by the weaker con | |
| os_account_modification_disable | Disallow Account Modification | The iOS devices _MUST_ be configured to prevent the untrained user to change account information. | |
| os_airdrop_disable | Ensure AirDrop is set to Disabled | AirDrop _MUST_ be disabled to prevent file transfers to or from unauthorized devices. AirDrop allows users to share and receive files from other nearby Apple devices. | |
| os_airdrop_unmanaged_destination_enable | Ensure Treat AirDrop as unmanaged destination is set to Enabled | AirDrop _MUST_ be treated as an unmanaged destination. | |
| os_airplay_incoming_password_require | Require Passcode for Incoming Airplay Connection Requests | When a user is allowed to use AirPlay without a password, it may mistakenly associate the iPhone and iPad with an AirPlay-enabled device other than the one intended (i.e., by choosing the wrong one from the AirPlay list displayed). This cre | |
| os_airplay_outgoing_password_require | Require the User to Enter a Password when Connecting to an AirPlay-enabled device for the First Time. | When a user is allowed to use AirPlay without a password, it may mistakenly associate the iPhone and iPad with an AirPlay-enabled device other than the one intended (i.e., by choosing the wrong one from the AirPlay list displayed). This cre | |
| os_airprint_credential_storage_disable | Disable Storage of AirPrint Credentials | Storage of AirPrint credentials _MUST_ be disabled. | |
| os_airprint_disable | Disable AirPrint | The iOS built-in AirPrint capability _MUST_ be disabled. The service AirPrint _MUST_ be disabled to prevent inadvertently printing content on unknown printers and leaking data. | |
| os_airprint_force_trusted_TLS | Requires trusted certificates for TLS printing communication | The service AirPrint _MUST_ be configured to require trusted certificates for TLS printing communication. | |
| os_allow_contacts_read_managed_sources_unmanaged_destinations_disable | Ensure Managed Apps Cannot Read Unmanaged Contact Accounts | Managed Apps _MUST_ not be allowed to read contacts from unmanaged contact destinations. | |
| os_allow_contacts_write_managed_sources_unmanaged_destinations_disable | Ensure Managed Apps Cannot Write to Unmanaged Contact Accounts | Managed Apps _MUST_ not be allowed to write contacts to unmanaged contact destinations. | |
| os_allow_documents_managed_sources_unmanaged_destinations_disable | Ensure Allow documents from managed sources in unmanaged destinations is set to Disabled | Documents from managed sources _MUST_ not be allowed in unmanaged destinations. | |
| os_allow_documents_unmanaged_sources_managed_destinations_disable | Ensure Allow documents from unmanaged sources in managed destinations is set to Disabled | Documents from unmanaged sources _MUST_ not be allowed in managed destinations. | |
| os_apple_watch_pairing_disable | Ensure Apple Watch Pairing is Disabled | Pairing an Apple Watch _MUST_ be disabled. NOTE: Any currently paired Apple Watch is unpaired and the watch's content is erased. | |
| os_apple_watch_wrist_detection_enable | Ensure Force Apple Watch wrist detection is set to Enabled | Wrist detection _MUST_ be enabled for paired Apple Watches. | |
| os_application_allow_list | Define Allowed Applications | Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly | |
| os_application_deny_list | Apps not allowed on the device | In case specific apps are allowed to be used on the device a specific list _SHOULD_VALUEONDEMAND_ needs to be defined by the MDM. These apps will not open on the device. | |
| os_authentication_password_autofill_enable | Ensure Require Touch ID / Face ID authentication before AutoFill is set to Enabled | Re-authentication _MUST_ be enabled at each Autofill operation. | |
| os_auto_correction_disable | Disable Auto Correction | The device _MUST_ be configured not to use the auto correction feature of the iOS. | |
| os_auto_dim_allow | Ensure auto dim of iPads with OLED displays is set to Enabled | Automatic dimming of iPads with OLED displays _MUST_ be enabled. | |
| os_auto_unlock_disable | Prevent Apple Watch from Unlocking a Device | Apple Watches are not an approved authenticator and their use _MUST_ be disabled. Disabling Apple watches is a necessary step to ensuring that the information system retains a session lock until the user reestablishes access using an autho | |
| os_automatic_app_download_disable | Disallow Automatic Downloads of Apps Purchased on other Apple Devices. | The automatic download of apps to a mobile device could cause the exposure of sensitive information when an unauthorized app is installed. | |
| os_background_security_improvement_install_enable | Enforce Background Security Improvements are Automatically Installed using DDM. | Background Security Improments _MUST_ be configured to enforce automatic installation and that the user cannot modify the setting within Settings. | |
| os_background_security_improvement_removal_disable | Disable rollback of Background Security Improvements using DDM. | The ability for the user to roll back Background Security Improvements _MUST_ be disabled. | |
| os_bluetooth_modification_disable | Bluetooth Status Modification Disabled | The ability to enable or disable Bluetooth _MUST_ be disabled. | |
| os_call_recording_disable | Disable Call Recording | The built-in Call Recording _MUST_ be disabled in certain organizations or jurisdictions by legal statutes and/or privacy laws. The Call Recording service announces to all users that a cellular phone call is about to be recorded. When reco | |
| os_camera_disable | Disable Camera | It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They | |
| os_chat_disable | Prevent the Usage of iMessage | The iOS device _MUST_ be configured to disable iMessage on the device to prevent receiving malicious content via iMessage. | |
| os_default_browser_modification_disable | Disable Modifying the Default Web Browser Application | The ability to modify the default web browser application _MUST_ be disabled to prevent unauthorized changes to the device's behavior. | |
| os_default_calling_modification_disable | Disable Modifying the Default Calling Application | The ability to modify the default calling application _MUST_ be disabled to prevent unauthorized changes to the device's behavior. | |
| os_default_messaging_modification_disable | Disable Modifying the Default Messaging Application | The ability to modify the default messaging application _MUST_ be disabled to prevent unauthorized changes to the device''s behavior. | |
| os_definition_lookup_disable | Disable Definition Lookup on the Device | The iOS device _MUST_ be configured not use the spell check feature of the OS. | |
| os_device_name_change_disable | Disable Device Name Changes | The iOS device _MUST_ be configured to disable device name changes. | |
| os_diagnostics_reports_disable | Disable Sending Diagnostic and Usage Data to Apple | The ability to submit diagnostic data to Apple _MUST_ be disabled. The information system _MUST_ be configured to provide only essential capabilities. Disabling the submission of diagnostic and usage information will mitigate the risk of u | |
| os_diagnostics_reports_modification_disable | Disable changing Sending Diagnostic and Usage Data to Apple | The ability to change the setting to submit diagnostic data to Apple _MUST_ be disabled. The information system _MUST_ be configured to provide only essential capabilities. Disabling the submission of diagnostic and usage information will | |
| os_disallow_enterprise_app_trust | Disallow Apps to be Installed from Unauthorized Sources | Apps _MUST_ be installed from authorized application repositories. Disallowing enterprise app trust prevents apps from being provisioned by universal provisioning profiles. | |
| os_enterprise_books_disable | Ensure Backup of Enterprise Books is set to Disabled | If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoD information systems. An adversary could exploit vulnerabilities created by the weaker con | |
| os_erase_contents_and_settings_disable | Ensure Allow Erase All Content and Settings is set to Disabled | Erase all contents and settings _MUST_ be disabled on institutionally owned iOS devices. | |
| os_esim_delete | Ensure the eSIM Contents are Deleted When Device is Erased | An eSIM may contain sensitive data and must be wiped of data when the mobile device is wiped to protect sensitive data from exposure. | |
| os_esim_transfers_disable | Ensure the ability to transfer an eSIM is set to Disabled | Outgoing transfers of eSIMs _MUST_ be disabled. | |
| os_exchange_SMIME_encryption_certificate_overwrite_disable | Disable changing the S/MIME encryption settings. | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The usage of S/MIME encryption _MUST_ be configured to set mail signing as the default. | |
| os_exchange_SMIME_encryption_default_certificate_overwrite_enable | Enable selecting the appropriate S/MIME encryption certificate. | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The user _MUST_ be enabled to select the appropriate signing identity. | |
| os_exchange_SMIME_encryption_enforce | Setting S/MIME Encryption as Default | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The usage of S/MIME encryption _MUST_ be configured to set mail signing as the default. | |
| os_exchange_SMIME_encryption_per_message_disable | Disable Encryption Selection Option per Mail Message | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The user _MUST_ not be enabled to have the option to decide wether to encrypt a mail communication. Encryption _MUST_ be the defaul | |
| os_exchange_SMIME_signing_certificate_overwrite_disable | Disable changing the S/MIME signing settings | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The option for a user to overwrite the of S/MIME configuration _MUST_ prevented. | |
| os_exchange_SMIME_signing_enabled | Enable S/MIME Signing | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The usage of S/MIME signing _MUST_ be configured to set mail signing as the default. | |
| os_exchange_SMIME_signing_overwrite_disable | Disable Modifying the S/MIME Signing Settings | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The option for a user to overwrite the of S/MIME configuration _MUST_ prevented. | |
| os_exchange_mail_recents_sync_disable | Prevent synching of recent recipients. | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. The synchronization of recent addresses _MUST_ be prevented not to synchronize sensitive addresses locally to the device. | |
| os_exchange_notes_disable | Ensure Notes service is disabled for Exchange ActiveSync | Exchange ActiveSync Notes service can be disabled for an account. Note: The user can reenable the Notes service unless the setting EnableNotesUserOverridable is set to false. | |
| os_exchange_notes_user_override_disable | Ensure Notes service override is disabled for Exchange ActiveSync | Exchange ActiveSync Notes service can be disabled for a user. Setting EnableNotesUserOverridable to false prevents the user from altering the service status. | |
| os_exchange_peraccountVPN | Enforce per account VPN for managed Mail accounts. | The iOS device needs some specific configurations for the Exchange setup to meet the minimum requirements. When leveraging per account VPN configurations mail, calendar and contacts need to be configured to leverage the specific VPNUUID i | |
| os_exchange_reminders_disable | Ensure Reminders service is disabled for Exchange ActiveSync | Exchange ActiveSync system can disable the Reminders service for an account. Note: The user can reenable the Notes service unless the setting 'EnableRemindersUserOverridable' is set to false. | |
| os_exchange_reminders_user_override_disable | Ensure Reminders service override is disabled for Exchange ActiveSync | Exchange ActiveSync system can disable the Reminders service for an account, but it can be reenabled by the user. The Reminders service is completely disabled when the 'EnableRemindersUserOverridable' setting is set to 'false'. | |
| os_external_intelligence_integration_disable | External Intelligence Integrations Must Be Disabled | The external intelligence integration feature of Apple Intelligence allows information to be downloaded from the device and processed by an external application in the cloud. The external intelligence integration feature of Apple Intelligen | |
| os_external_intelligence_integration_sign_in_disable | Sign In to External Intelligence Integrations Must Be Disabled | The ability to sign into external intelligence integrations _MUST_ be disabled. The external intelligence integration feature of Apple Intelligence allows information to be downloaded from the device and processed by an external applicatio | |
| os_facetime_disable | Disable FaceTime App | FaceTime _MUST_ be disabled. | |
| os_files_network_drive_access_disable | Ensure Allow Network Drive Access in Files App is Set to Disabled | Network drive access in Files app _MUST_ be disabled. | |
| os_files_usb_drive_access_disable | Ensure Allow USB Drive Access in Files App is Set to Disabled | USB drive access in Files app _MUST_ be disabled. | |
| os_find_my_friends_disable | Disable Find My Friends Service | The Find My Friends service _MUST_ be disabled. Sharing the location of a device may be an violation to an organization and potentially put users at risk. | |
| os_force_date_and_time_enable | Ensure Force Automatic Date and Time is Set to Enabled | Automatic date and time _MUST_ be enabled. | |
| os_force_encrypted_backups_enable | Ensure Force Encrypted Backups is Enabled | iOS and iPadOS backups _MUST_ be encrypted. | |
| os_genmoji_disable | Ensure the Ability to Create Genmojis is Set to Disabled | Use of Genmojis _MUST_ be disabled. | |
| os_handoff_disable | Disable Handoff | Handoff _MUST_ be disabled. Handoff allows you to continue working on a document or project when the user switches from one Apple device to another. Disabling Handoff prevents data transfers to unauthorized devices. | |
| os_hide_apps_disable | Disable Ability to Hide Apps | Hidden apps cannot be seen by enterprise management applications (e.g., MDM server), and therefore, unauthorized apps or apps with embedded malware could be installed and hidden from the MDM or mobile threat detection (MTD) apps. Hidden app | |
| os_ibeacon_airprint_disable | Disable Discovery of AirPrint Printers using iBeacons | iBeacon discovery _MUST_ be disabled to prevent AirPrint Bluebooth beacons from being potentially exploited for network phishing. | |
| os_image_playground_disable | Ensure the Ability to Use AI Image Generation is Set to Disabled | AI image generation _MUST_ be disabled. | |
| os_image_wand_disable | Disable Apple Intelligence ImageWand | Apple Intelligence features such as Apple ImageWand _MUST_ be disabled. | |
| os_install_configuration_profile_disable | Ensure Allow Installing Configuration Profiles is Set to Disabled | Configuration profiles _MUST_ be installed via an organization's MDM. | |
| os_install_vpn_configuration_disable | Ensure Allow Adding VPN Configurations is Set to Disabled | VPN configurations _MUST_ be installed via an organization's MDM. | |
| os_iphone_mirroring_disable | Ensure the Ability to Mirror a Device is Set to Disabled | Device mirroring _MUST_ be disabled. | |
| os_iphone_widgets_on_mac_disable | Disable Use of iPhone Widgets on Mac | iPhone widgets on Mac _MUST_ be disabled. | |
| os_limit_ad_tracking_enable | Enable Limit Ad Tracking | Ad tracking and targeted ads _MUST_ be disabled. The information system _MUST_ be configured to provide only essential capabilities. Disabling ad tracking ensures that applications and advertisers are unable to track users' interests and d | |
| os_live_text_disable | Disable Live Text | The user _MUST_ manually disable Settings/General/Language and Region/Live-Text. | |
| os_mail_block_remote_content | Block Remote Content | The user _MUST_ manually block remote content in Settings/Mail/Privacy/Block Remote Content. | |
| os_mail_maildrop_disable | Ensure Allow Mail Drop is Set to Disabled | Mail Drop _MUST_ be disabled. | |
| os_mail_move_messages_disable | Ensure Allow User to Move Messages from This Account is Set to Disabled | Mail from institutionally configured mail accounts _MUST_ not be allowed to move to personal mail accounts to prevent data leakage. | |
| os_mail_smart_reply_disable | Disable Apple Intelligence Mail Smart Replies | Apple Intelligence features such as Mail Smart Replies that use off device AI _MUST_ be disabled. | |
| os_mail_summary_disable | Disable Apple Intelligence Mail Summary | Apple Intelligence features such as Apple Mail Summary that use off device AI _MUST_ be disabled. | |
| os_marketplace_prevent | Prevent Third Party Marketplaces | The iOS device _MUST_ be configured to prevent third party marketplaces from being installed. | |
| os_modify_cellular_data_app_settings_disable | Ensure Allow Modifying Cellular Data App Settings is Set to Disabled | The ability to modify cellular data app settings _MUST_ be disabled. | |
| os_movie_content_allowed | Disable Movie Content | Movie Rating content _MUST_ be set to $ODV on the device. Possible values, with the U.S. description of the rating level: - `1000`: All - `500`: NC-17 - `400`: R - `300`: PG-13 - `200`: PG - `100`: G - `0`: None | |
| os_network_known_only | Only Allow Known Networks | The iOS device _MUST_ be configured to only allow known networks in case only trustworthy networks can be used. This can have a limitation on connectivity especially when devices are used in area with low or no network connectivity. | |
| os_new_device_proximity_disable | Ensure Allow Setting Up New Nearby Devices is Set to Disabled | The setting up of new nearby devices _MUST_ be disabled. | |
| os_notes_transcription_disable | Disable Apple Intelligence Notes Transcription | Apple Intelligence features such as Notes Transcription that use off device AI _MUST_ be disabled. | |
| os_notes_transcription_summary_disable | Disable Apple Intelligence Notes Transcription Summary | Apple Intelligence features such as Notes Transcription Summary that use off device AI _MUST_ be disabled. | |
| os_on_device_dictation_enforce | Ensure On Device Dictation is Enforced | The device _MUST_ be configured for on device dictation. By enforcing on device dictation this will mitigate the risk of unwanted data being sent to Apple. | |
| os_on_device_translation_enforce | Ensure On Device Translation is Enforced | The device _MUST_ be configured for on device translation. By enforcing on device translation this will mitigate the risk of unwanted data being sent to Apple. | |
| os_pairing_non_configurator_hosts_disable | Ensure Allow Pairing with Non-Configurator Hosts is Set to Disabled | Host pairing with a non-Configurator host _MUST_ be disabled. | |
| os_password_autofill_disable | Disable Password Autofill | Password Autofill _MUST_ be disabled. iOS allows users to save passwords and use the Password Autofill feature in Safari and compatible apps. To protect against malicious users gaining access to the device, this feature _MUST_ be disabled | |
| os_password_proximity_disable | Disable Proximity Based Password Sharing Requests | Proximity based password sharing requests _MUST_ be disabled. The default behavior of iOS is to allow users to request passwords from other known devices (macOS and iOS). This feature _MUST_ be disabled to prevent passwords from being shar | |
| os_password_sharing_disable | Disable Password Sharing | Password Sharing _MUST_ be disabled. The default behavior of iOS/iPadOS is to allow users to share a password over Airdrop between other macOS and iOS devices. This feature _MUST_ be disabled to prevent passwords from being shared. | |
| os_personalized_advertising_disable | Disable Personalized Advertising | Ad tracking and targeted ads _MUST_ be disabled. The information system _MUST_ be configured to provide only essential capabilities. Disabling ad tracking ensures that applications and advertisers are unable to track users' interests and | |
| os_personalized_handwriting_disable | Ensure the ability to Analyze Handwriting is Set to Disabled | AI handwriting analysis _MUST_ be disabled. | |
| os_predictive_keyboard_disable | Disable the Use of Predictable Keyboards | The device _MUST_ be configured that the usage of the predictable keyboard feature is not possible. | |
| os_rapid_security_responses_install_enable | Allow to Install Rapid Security Responses | The iOS device _MUST_ be configured to allow the user to install Rapid Security Responses to enable the user to be up to date with security fixes. | |
| os_rapid_security_responses_remove_disable | Disallow to Remove Rapid Security Responses | The iOS device _MUST_ be configured not to allow the user to remove rapid security responses. | |
| os_rcs_messaging_disable | Disable RCS messaging | This setting disables RCS messaging, supported on iOS 18.1 and later, to prevent enhanced messaging with non-iPhone users. RCS enables sending messages, photos, and videos via cellular data but is not available on all carriers. | |
| os_require_managed_pasteboard_enforce | Ensure Copy/Paste of Data from Managed to Unmanaged Applications is Disabled | The device _MUST_ be configured to disable copy/paste of data from managed to unmanaged applications. If 'true', copy and paste functionality respects the 'allowOpenFromManagedToUnmanaged' and 'allowOpenFromUnmanagedToManaged' restrictions | |
| os_safari_JavaScript_disable | Prevent JavaScript | The iOS device _MUST_ be configured to prevent JavaScript support in Safari to prevent malicious code execution on the device. | |
| os_safari_cookies_set | Ensure 'Accept cookies' is set to 'From websites I visit' or 'From current website only' | Acceptance of cookies _MUST_ be only from sites visited. | |
| os_safari_force_fraud_warning_enable | Ensure Force Fraud Warning is Set to Enabled | Force fraud warning _MUST_ be enabled in Safari. | |
| os_safari_password_autofill_disable | Disable Automatic Completion of Safari Browser Passcodes | The AutoFill functionality in the Safari web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing the use of the AutoFill functionality, an a | |
| os_safari_popups_disable | Disable Safari Popups | The iOS device _MUST_ be configured to automatically prevent popups on the device to protect users from malicious content. | |
| os_safari_reader_summary_disable | Disable Apple Intelligence Safari Reader Summary | Apple Intelligence features such as Safari Reader Summary that use off device AI _MUST_ be disabled. | |
| os_screen_observation_remote_disable | Prevent Remote Screen Observation | The iOS device _MUST_ be configured to prevent remote screen observation via the classroom app to prevent data leakage via the classroom app. | |
| os_screen_observation_unprompted_disable | Prevent Unprompted Screen Observation. | The iOS device _MUST_ be configured to prevent automatic acceptance for unprompted screen observations to prevent data leakage via the classroom app. | |
| os_screenshots_disable | Ensure Allow Screenshots and Screen Recording is Set to Disabled | Screenshots and screen recordings on iOS _MUST_ be disabled. | |
| os_show_calendar_lock_screen_disable | Ensure Calendar Notifications When the Device is Locked is Set to Disabled | Many mobile devices display notifications on the lock screen so users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are new notifications. However, in many cases, thes | |
| os_show_control_center_lock_screen_disable | Ensure Show Control Center in Lock Screen is Set to Disabled | Control Center _MUST_ be disabled in the lock screen. | |
| os_show_notification_center_lock_screen_disable | Ensure Show Notification Center in Lock Screen is Set to Disabled | Notification Center _MUST_ be disabled in the lock screen. | |
| os_siri_allow_dictation_disable | Disallow Dictation Feature | The iOS built-in Siri service _MUST_ be disabled to prevent organizational data from being synchronized to Apple servers. Apple's Siri service does not provide an organization with enough control over the storage and access of data, and, t | |
| os_siri_assistant_disable | Disable Siri service | The iOS built-in Siri service _MUST_ be disabled to prevent organizational data from being synchronized to Apple servers. Apple's Siri service does not provide an organization with enough control over the storage and access of data, and, t | |
| os_siri_server_logging_disable | Disallow Siri Server Side Logging | The iOS built-in Siri service _MUST_ be disabled to prevent organizational data from being synchronized to Apple servers. Apple's Siri service does not provide an organization with enough control over the storage and access of data, and, t | |
| os_siri_user_generated_content_disable | Disallow User Generated Content with Siri | The iOS built-in Siri service _MUST_ be disabled to prevent organizational data from being synchronized to Apple servers. Apple's Siri service does not provide an organization with enough control over the storage and access of data, and, t | |
| os_siri_when_locked_disabled | Ensure Allow Siri While Device is Locked is Set to Disabled | Accessing Siri while the device is locked _MUST_ be disabled. | |
| os_software_update_download_enforce | Enforce Software Update Downloads Automatically using DDM. | Software Update _MUST_ be configured to enforce automatic downloads of updates from Apple and that the user cannot modify the setting within Settings. | |
| os_software_update_install_enforce | Enforce iOS/iPadOS Updates are Automatically Installed using DDM. | Software Update _MUST_ be configured to enforce automatic installation of iOS/iPadOS updates and that the user cannot modify the setting within Settings. | |
| os_spell_check_disable | Disable Spell Check | The iOS device _MUST_ be configured to not use the spell check feature. | |
| os_ssl_for_exchange_activesync_enable | Ensure SSL for Exchange ActiveSync | Exchange email messages are a form of data in transit and thus are vulnerable to eavesdropping and man-in-the-middle attacks. Secure Sockets Layer (SSL), also referred to as Transport Layer Security (TLS), provides encryption and authentica | |
| os_supervised_mdm_require | Enforce Supervised Enrollment in Mobile Device Management | iOS/iPadOS _MUST_ be supervised by a Mobile Device Management (MDM) software. | |
| os_system_settings_find_my_device_disable | Disable Find My Device | The Find My service _MUST_ be disabled. A Mobile Device Management (MDM) solution _MUST_ be used to carry out remote locking and wiping instead of Apple's Find My service. Apple's Find My service uses a personal AppleID for authentication | |
| os_system_settings_find_my_friends_modification_disable | Disable Find My Friends Modification | The Find My service modification _MUST_ be disabled. | |
| os_tv_content_allowed | Disable TV Content | TV Rating content _MUST_ be set to $ODV on the device. Possible values, with the U.S. description of the rating level: - `1000`: All - `600`: TV-MA - `500`: TV-14 - `400`: TV-PG - `300`: TV-G - `200`: TV-Y7 - `100`: TV-Y - `0`: None | |
| os_unpaired_boot_disable | Disable the Option to Recover the Device via an Unpaired Host | The iOS device _MUST_ be configured to disable unpaired devices to boot devices into recovery. | |
| os_untrusted_tls_disable | Ensure Allow Users to Accept Untrusted TLS Certificates is Set to Disabled | Users _MUST_ not be allowed to accept self-signed or unverified certificates. | |
| os_update_OTAPKI_allow | Allow OTA Update of PKI | The device _MUST_ be configured that the OTA update of the PKI is allowed. | |
| os_update_auto_RSR_allow | Auto Install RSR Updates | The user _MUST_ manually enable the automatic install of RSR updates in Settings/General/Updates/Automatic Updates/Block Remote Content. | |
| os_update_enforced_software_update_delay | Enforce Software Update Delay | The iOS device _MUST_ be configured to enforce a software update delay by $ODV days in order to validate compatibility with required software and infrastructure. | |
| os_usb_accessories_when_locked_disable | Ensure Allow USB Accessories While the Device is Locked is Set to Disabled | USB devices _MUST_ not be allowed to connect while the device is locked. | |
| os_video_conferencing_remote_control_disable | Ensure the Remote Control of a System via Videoconferencing is Set to Disabled | Video conferencing remote control _MUST_ be disabled. | |
| os_visual_intelligence_summary | Disable Apple Intelligence Visual Intelligence Summary | Apple Intelligence Features such as Visual Intelligence Summary that use off device AI _MUST_ be disabled. | |
| os_voice_dialing_when_locked_disabled | Ensure Allow Voice Dialing While Device is Locked is Set to Disabled | Voice dialing while the device is locked _MUST_ be disabled. | |
| os_web_distribution_app_installation_disable | Ensure the Ability to Install Apps Directly from the Web is Set to Disabled | Web distribution of app installation _MUST_ be disabled. | |
| os_writing_tools_disable | Ensure the Ability to Use AI Writing Tools is Set to Disabled | AI writing tools _MUST_ be disabled. | |
| pwpolicy_account_lockout_enforce | Limit Consecutive Failed Login Attempts to $ODV | The iOS _MUST_ be configured to limit the number of failed login attempts to a maximum of $ODV. This rule protects against malicious users attempting to gain access to the system via brute-force hacking methods. | |
| pwpolicy_alpha_numeric_enforce | Require Passwords Contain a Minimum of One Numeric Character | The iOS _MUST_ be configured to require at least one numeric character be used when a password is created. This rule enforces password complexity by requiring users to set passwords that are less vulnerable to malicious users. | |
| pwpolicy_force_pin_enable | Ensure Force Pin is Set to Enabled | Passwords provide a form of access control that prevents unauthorized individuals from accessing computing resources and sensitive data. Passwords may also be a source of entropy for generation of key encryption or data encryption keys. If | |
| pwpolicy_history_enforce | Prohibit Password Reuse for a Minimum of $ODV Generations | The iOS _MUST_ be configured to enforce a password history of at least $ODV previous passwords when a password is created. | |
| pwpolicy_max_grace_period_enforce | Ensure Maximum Grace Period for Device Lock is Set to Immediately | The iOS grace period for device lock _MUST_ be configured to immediately. | |
| pwpolicy_max_inactivity_enforce | Ensure Maximum Auto-Lock is Set to $ODV Minutes or Less | The iOS _MUST_ be configured to auto-lock after $ODV minutes. | |
| pwpolicy_minimum_length_enforce | Require a Minimum Passcode Length of $ODV Characters | The iOS _MUST_ be configured to require a minimum of $ODV characters be used when a passcode is created. This rule enforces passcode complexity by requiring users to set passcode that are less vulnerable to malicious users. | |
| pwpolicy_simple_sequence_disable | Prohibit Repeating, Ascending, and Descending Character Sequences | The iOS device _MUST_ be configured to prohibit the use of repeating, ascending, and descending character sequences when a passcode is created. This rule enforces password complexity by requiring users to set passcodes that are less vulner | |
| supplemental_bsi | BSI Supplemental | These controls require additional considerations for your environment based on indigo, in accordance with the recommendations of BSI (Bundesamt für Sicherheit in der Informationstechnik, German Federal Office for Information Security). [c | |
| supplemental_cis_manual | CIS Manual Recommendations | List of CIS recommendations that are manual check in the CIS iOS Benchmark. [cols="15%h, 85%a"] |=== |Section |General |Recommendations |2.1.1 Ensure a Consent Message has been Configured + 2.1.2 Ensure Controls when the profile can be re | |
| supplemental_stig | DISA STIG Supplemental | These are controls that require additional considerations for your environment. [cols="20%h, 80%a"] |=== |STIG ID |Rule Title |AIOS-26-001000| Apple iOS/iPadOS 26 must allow the administrator (MDM) to perform the following management func |
152 of 152.