BaselineWatch
5 STIGs
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Mobile STIGs

5 STIGs followed · All platforms
All 88 CAT I 3CAT II 60CAT III 25 Browse in the Register

CAT I 3

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

  1. AIOS-26-006950 CAT I V-278752 · PP-MDF-993300

    Apple iOS/iPadOS 26 must be configured to enforce a passcode reuse prohibition of at least two generations.

    Maps to IA-5(1) via CCI-004061
    Check

    Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify the "Passcode History" value is set to two or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify "Number of unique recent passcodes required" is listed as "two" or greater. If the Apple iOS or iPadOS device does not enforce a passcode reuse prohibition of at least two generations, this is a finding.

    Fix

    Install a configuration profile to enforce a passcode reuse prohibition of at least two generations (passcode history). Configuration Profile Key: pinHistory

  2. AIOS-26-010400 CAT I V-278784 · PP-MDF-993300

    Apple iOS/iPadOS 26 must require a valid password be successfully entered before the mobile device data is unencrypted.

    Maps to SC-28 via CCI-001199
    Check

    Review configuration settings to confirm the device is set to require a passcode before use. This procedure is performed on the iOS and iPadOS device. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify "Passcode required" is set to "Yes". If "Passcode required" is not set to "Yes", this is a finding.

    Fix

    Install a configuration profile to require a password to unlock the device. Configuration Profile Key: forcePIN

  3. AIOS-26-011200 CAT I V-278793 · PP-MDF-993300

    iPhone and iPad must have the latest available iOS/iPadOS operating system installed.

    Maps to CM-7 via CCI-000381
    Check

    Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and determine the most current version of iOS released by Apple. In the MDM management console, review the version of iOS installed on a sample of managed devices. This procedure will vary depending on the MDM product. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "About" and view the installed version of iOS. 4. Go back to the "General" screen. Tap "Software Update" and verify the following message is shown on the screen: "Your software is up to date." If the installed version of iOS on any reviewed iOS/iPadOS devices is not the latest released by Apple, this is a finding.

    Fix

    Install the latest release version of Apple iOS/iPadOS on all managed iOS devices.