Mobile STIGs

CAT I 4

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

1. AIOS-27-006500 CAT I V-288363 · PP-MDF-994000

   Apple iOS/iPadOS 27 must be configured to enforce a passcode reuse prohibition of at least two generations.

   Maps to IA-5(1) via CCI-004061
   Check

   Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcodes" that the "Unique passcode requirement" value is set to "2" or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Unique passcode requirement" is listed as "2" or greater. If the MDM server or iOS or iPadOS device does not enforce a passcode reuse prohibition of at least two generations, this is a finding.

   Fix

   Install a DDM profile to enforce a passcode reuse prohibition of at least two generations (passcode history). In the MDM server, in the DDM configuration "Passcode", set "Unique passcode requirement" to "2" or greater.

2. AIOS-27-009400 CAT I V-288392 · PP-MDF-401780

   All mobile operating system (MOS) cryptography must be configured to be in FIPS 140-3-validated mode.

   Maps to SC-13 via CCI-002450
   Check

   Review configuration settings to confirm the device is set to require a passcode before use. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding.

   Fix

   Install a configuration profile to require a password to unlock the device. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes".

3. AIOS-27-009500 CAT I V-288393 · PP-MDF-994000

   Apple iOS/iPadOS 27 must require that a valid password be successfully entered before the mobile device data is unencrypted.

   Maps to SC-28 via CCI-001199
   Check

   Review configuration settings to require a passcode to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding.

   Fix

   Install a configuration profile to require a password to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes".

4. AIOS-27-010400 CAT I V-288402 · PP-MDF-994000

   iPhone and iPad must have the latest available iOS/iPadOS operating system installed.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and determine the most current version of iOS released by Apple. In the MDM management console, review the version of iOS installed on a sample of managed devices. This procedure will vary depending on the MDM product. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "About" and view the installed version of iOS. 4. Go back to the "General" screen. Tap "Software Update" and verify the following message is shown on the screen: "Your software is up to date." If the installed version of iOS on any reviewed iOS/iPadOS devices is not the latest released by Apple, this is a finding.

   Fix

   Install the latest release version of Apple iOS/iPadOS on all managed iOS devices.