Mobile STIGs

All 88 CAT I 3 CAT II 60 CAT III 25 Browse in the Register

CAT II 60

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

AIOS-26-003000 CAT II V-278718 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud).

Maps to SC-4 via CCI-001090

Check
Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. Review configuration settings to confirm iCloud Backup is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud backup" is unchecked. Alternatively, verify the text "allowCloudBackup " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "iCloud backup not allowed" is listed. If "Allow iCloud backup" is checked in the Apple iOS/iPadOS management tool, "allowCloudBackup" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud backup not allowed", this is a finding.

Fix
Install a configuration profile to disable iCloud backup. Configuration Profile Key: allowCloudBackup
AIOS-26-003200 CAT II V-278719 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud document and data synchronization).

Maps to SC-4 via CCI-001090

Check
Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow iCloud documents & data" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud documents & data" is unchecked. Alternatively, verify the text "allowCloudDocumentSync " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "Documents in the Cloud not allowed" is listed. Note: This also verifies that iCloud Drive and iCloud Photo Library are disabled. If "Allow iCloud documents & data" is checked in the Apple iOS/iPadOS management tool, "allowCloudDocumentSync " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Documents in the Cloud not allowed", this is a finding.

Fix
Install a configuration profile to disable iCloud documents and data. This is a supervised-only control. Configuration Profile Key: allowCloudDocumentSync
AIOS-26-003300 CAT II V-278720 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Keychain).

Maps to SC-4 via CCI-001090

Check
Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm iCloud keychain is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud keychain" is unchecked. Alternatively, verify the text "allowCloudKeychainSync" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Verify "iCloud Keychain not allowed" is listed. If "Allow iCloud keychain" is checked in the Apple iOS/iPadOS management tool, "allowCloudKeychainSync" appears in the configuration profile, or "iCloud Keychain not allowed" is not listed on the iPhone and iPad, this is a finding.

Fix
Install a configuration profile to disable iCloud keychain. This a supervised-only control. Configuration Profile Key: allowCloudKeychainSync
AIOS-26-003450 CAT II V-278721 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (Cloud Photo Library).

Maps to SC-4 via CCI-001090

Check
Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Cloud Photo Library" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Cloud Photo Library" is unchecked. Alternatively, verify the text "allowCloudPhotoLibrary" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iCloud Photos not allowed" is listed. If "Allow Cloud Photo Library" is checked in the Apple iOS/iPadOS management tool, "allowCloudPhotoLibrary " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud Photos not allowed", this is a finding.

Fix
Install a configuration profile to disable Cloud Photo Library. This is a supervised-only control. Configuration Profile Key: allowCloudPhotoLibrary
AIOS-26-003500 CAT II V-278722 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream).

Maps to SC-4 via CCI-001090

Check
Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Shared Stream" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Shared Stream" is unchecked. Alternatively, verify the text "allowSharedStream" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Shared Streams not allowed" is listed. If "AllowShared Photo Stream" is checked in the Apple iOS/iPadOS management tool, "allowSharedStream" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Shared Streams not allowed", this is a finding.

Fix
Install a configuration profile to disable "Allow Shared PhotoStream". This is a supervised-only control. Configuration Profile Key: allowSharedSteam
AIOS-26-003600 CAT II V-278723 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (managed applications data stored in iCloud).

Maps to SC-4 via CCI-001090

Check
Review configuration settings to confirm "Allow managed apps to store data in iCloud" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow managed apps to store data in iCloud" is unchecked. Alternatively, verify the text "allowManagedAppsCloudSync " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps cloud sync not allowed" is listed. If "Allow managed apps to store data in iCloud" is checked in the Apple iOS/iPadOS management tool, "allowManagedAppsCloudSync " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Managed apps cloud sync not allowed", this is a finding.

Fix
Install a configuration profile to prevent DOD applications from storing data in iCloud. Configuration Profile Key: allowManagedAppsCloudSync
AIOS-26-003700 CAT II V-278724 · PP-MDF-333250

Apple iOS/iPadOS 26 must not allow backup to remote systems (enterprise books).

Maps to SC-4 via CCI-001090

Check
Review configuration settings to confirm "Allow backup of enterprise books" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow backup of enterprise books" is unchecked. Alternatively, verify the text "allowEnterpriseBookBackup " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Backing up enterprise books not allowed" is listed. If "Allow backup of enterprise books" is checked in the Apple iOS/iPadOS management tool, "allowEnterpriseBookBackup " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Backing up enterprise books not allowed", this is a finding.

Fix
Install a configuration profile to prevent backup of enterprise books that could contain DOD sensitive information. Configuration Profile Key: allowEnterpriseBookBackup
AIOS-26-006500 CAT II V-278747 · PP-MDF-333024

Apple iOS/iPadOS 26 must be configured to enforce a minimum password length of six characters.

Maps to IA-5(1) via CCI-004066

Check
Review configuration settings to confirm the minimum passcode length is six or more characters. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify the "Minimum passcode length" value is set to six or greater. Alternatively, verify the text "minLength 6" appears in the configuration profile (.mobileconfig file). It also is acceptable for the integer value to be greater than six. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify "Minimum length" is listed as "six or greater". If the "Minimum passcode length" is less than six characters in the iOS management tool, "minLength " has an integer value of less than six, or the password policy on the iPhone and iPad from the Apple iOS/iPadOS management tool does not list "Minimum length" of six or more, this is a finding.

Fix
Install a configuration profile to enforce a minimum passcode length value of six or greater. Configuration Profile Key: minLength
AIOS-26-006600 CAT II V-278748 · PP-MDF-333025

Apple iOS/iPadOS 26 must be configured to not allow passwords that include more than four repeating or sequential characters.

Maps to IA-5(1) via CCI-004066

Check
Review configuration settings to confirm simple passcodes are not allowed. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow simple value" is unchecked. Alternatively, verify the text "allowSimple " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify "Simple passcodes allowed" is set to "No". If "Allow simple value" is checked in the Apple iOS/iPadOS management tool, "allowSimple " appears in the Configuration Profile, or the password policy on the iPhone and iPad does not have "Simple passcodes allowed" set to "No", this is a finding.

Fix
Install a configuration profile to disallow more than four sequential or repeating numbers or letters in the device unlock password. Configuration Profile Key: allowSimple
AIOS-26-006800 CAT II V-278750 · PP-MDF-333030

Apple iOS/iPadOS 26 must be configured to lock the display after 15 minutes (or less) of inactivity.

Maps to AC-11 via CCI-000057

Check
Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes. Alternatively, locate the text "maxGracePeriod" and "maxInactivity" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example: "maxGracePeriod 5 maxInactivity 5" Here, 5 + 5 = 10; this meets the requirement. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes. Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement. On the management server, if the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the iOS/iPadOS management tool or the sum of the values assigned to "maxGracePeriod" and "maxInactivity" is not between 1 and 15 minutes in the configuration profile, or if on the iPhone/iPad, the sum of the values assigned to "Max grace period" and "Max inactivity" is not between 1 and 15 minutes, this is a finding.

Fix
Install a configuration profile to lock the device display after 15 minutes (or less) of inactivity. This is done by setting "Maximum Auto-Lock time" and "Grace Period for device lock" so the sum of their values is between 1 and 15 minutes. Configuration Profile Key: maxInactivity, maxGracePeriod
AIOS-26-006900 CAT II V-278751 · PP-MDF-333040

Apple iOS/iPadOS 26 must be configured to not allow more than 10 consecutive failed authentication attempts.

Maps to AC-7 via CCI-000044

Check
Review configuration settings to confirm that consecutive failed authentication attempts is set to 10 or fewer. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify the "Maximum number of failed attempts" value is set to 10 or fewer. Alternatively, verify the text "maxFailedAttempts 10" appears in the configuration profile (.mobileconfig file). It also is acceptable for the integer value to be less than 10. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the password policy. 5. Tap "Restrictions". 6. Tap "Passcode". 7. Verify "Max failed attempts" is listed as "10" or fewer. If the "Maximum number of failed attempts" is more than 10 in the iOS management tool, "maxFailedAttempts " has an integer value of more than 10, or the password policy on the iPhone and iPad does not list "Max failed attempts" of 10 or fewer, this is a finding.

Fix
Install a configuration profile to allow only 10 or fewer consecutive failed authentication attempts. Configuration Profile Key: maxFailedAttempts
AIOS-26-007000 CAT II V-278753 · PP-MDF-333050

Apple iOS/iPadOS 26 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm "Allow Trusting New Enterprise App Authors" is disabled. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify "Allow Trusting New Enterprise App Authors" is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Trusting enterprise apps not allowed" is listed. If "Allow Trusting New Enterprise App Authors" is not disabled in the iOS/iPadOS management tool or on the iPhone and iPad "Trusting enterprise apps not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable "Allow Trusting New Enterprise App Authors". Configuration Profile Key: allowEnterpriseAppTrust
AIOS-26-007200 CAT II V-278755 · PP-MDF-333070

Apple iOS/iPadOS 26 must not include applications with the following characteristics: access to Siri when the device is locked.

Maps to IA-7 via CCI-000803

Check
Review configuration settings to confirm that Siri is disabled on the Lock screen. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Siri while device is locked" is unchecked. Alternatively, verify the text "allowAssistantWhileLocked" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Siri while locked not allowed" is listed. If "Allow Siri while device is locked" is checked in the Apple iOS/iPadOS management tool, or "allowAssistantWhileLocked" appears in the configuration profile, or the restrictions policy on the iPhone and iPad from the Apple iOS/iPadOS management tool does not list "Siri while locked not allowed", this is a finding. Note: If Siri use has been disabled, "Siri while locked not allowed" may not be listed and this requirement is Not Applicable.

Fix
Install a configuration profile to disable Siri while the device is locked. Configuration Profile Key: allowAssistantWhileLocked
AIOS-26-007400 CAT II V-278757 · PP-MDF-333070

Apple iOS/iPadOS 26 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a re…

Maps to IA-7 via CCI-000803

Check
Verify no apps with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. This check procedure is performed on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Listed App" (allowlistedAppBundleIDs) is configured and there are no apps with prohibited characteristics. If "Allow listed apps" is not configured and contains apps with prohibited characteristics, this is a finding.

Fix
Install a configuration profile with an allow list of approved apps (allowlistedAppBundleIDs). Ensure the allow list does not include apps with the following characteristics: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. Configuration Profile Key: allowListedAppBundleIDs
AIOS-26-007500 CAT II V-278758 · PP-MDF-333080

Apple iOS/iPadOS 26 must be configured to not display notifications when the device is locked.

Maps to AC-11(1) via CCI-000060

Check
Review configuration settings to confirm the display of notifications when the device is locked has been disabled. This check procedure is performed on the Apple iOS/iPadOS management tool and mobile device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to disable Notifications preview. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "Disallow notification view in locked screen" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to disable showing notification view on locked screen, this is a finding.

Fix
Install a configuration profile to disable the display of notifications when the device is locked. Install a configuration profile to disable Notification Center from the device Lock screen. Configure in each installed managed app.
AIOS-26-007600 CAT II V-278759 · PP-MDF-333080

Apple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked.

Maps to AC-11(1) via CCI-000060

Check
Review configuration settings to confirm "Show Today view in Lock screen" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Show Today view in Lock screen" is unchecked. Alternatively, verify the text "allowLockScreenTodayView" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "Profiles & Device Management" or Profiles". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Today view on lock screen not allowed" is present. If "Show Today view in Lock screen" is checked in the Apple iOS/iPadOS management tool, "allowLockScreenTodayView" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Today view on lock screen not allowed", this is a finding.

Fix
Install a configuration profile to disable "Show Today view in Lock screen" from the device Lock screen. Configuration Profile Key: allowLockScreenTodayView
AIOS-26-009200 CAT II V-278773 · PP-MDF-333240

Apple iOS/iPadOS 26 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

Maps to SC-4 via CCI-001090

Check
Review configuration settings to confirm backup in management apps is disabled and "Encrypt local backup" is enabled in iTunes (for Windows computer) and in Finder on Mac. Note: iTunes Backup/Finder backup is implemented by the configuration policy rule "Force encrypted backups", which is included in AIOS-26-010700 and therefore, not included in the procedure below. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify backing up app data is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Tap a managed app. 7. Verify "App data will not be backed up" is listed. Note: Steps 6 and 7 must be performed for each managed app. If backing up app data is not disabled in the Apple iOS/iPadOS management tool or "app data will not be backed up" is not listed for each managed app on the iPhone and iPad, this is a finding.

Fix
Install a configuration profile to disable backup of managed apps. Must be configured on the MDM server for each managed app.
AIOS-26-009700 CAT II V-278777 · PP-MDF-333280

Apple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data.

Maps to AC-6(8), SC-39 via CCI-002530, CCI-002233

Check
Review configuration settings to confirm "Allow documents from managed apps in unmanaged apps" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow documents from managed apps in unmanaged apps" is unchecked. Alternatively, verify the text "allowOpenFromManagedToUnmanaged" appears in the configuration profile (.mobileconfig file). On the iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Opening documents from managed to unmanaged apps not allowed" is listed. If "Allow documents from managed apps in unmanaged apps" is checked in the iOS management tool, "allowOpenFromManagedToUnmanaged" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Opening documents from managed to unmanaged apps not allowed", this is a finding.

Fix
Install a configuration profile to prevent non-DOD applications from accessing DOD data. Configuration Profile Key: allowOpenFromManagedToUnmanaged
AIOS-26-009800 CAT II V-278778 · PP-MDF-333290

Apple iPadOS 26 must be configured to disable multiuser modes.

Maps to AC-2 via CCI-002110

Check
Verify multiuser mode (shared iPad) is disabled in the MDM console for iPadOS devices. This requirement is not applicable for iOS devices. If multiuser mode is not disabled in the MDM console for iPadOS devices, this is a finding.

Fix
Disable multiuser mode (shared iPad) in the MDM console for iPadOS devices.
AIOS-26-009900 CAT II V-278779 · PP-MDF-333300

Apple iOS/iPadOS 26 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.

Maps to MP-6(3) via CCI-001033

Check
Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding.

Fix
Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app.
AIOS-26-010000 CAT II V-278780 · PP-MDF-333310

Apple iOS/iPadOS 26 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.

Maps to MP-6(3) via CCI-001033

Check
Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding.

Fix
Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app.
AIOS-26-010200 CAT II V-278782 · PP-MDF-333330

Apple iOS/iPadOS 26 must be configured to disable ad hoc wireless client-to-client connection capability.

Maps to SC-40 via CCI-002536

Check
Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirDrop" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirDrop not allowed" is listed. If "AirDrop not allowed" is not listed in the management tool and on the Apple device, this is a finding.

Fix
Install a configuration profile to disable the AllowAirDrop control in the management tool. This is a supervised-only control. Configuration Profile Key: allowAirDrop
AIOS-26-010700 CAT II V-278788 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: encrypt backups/Encrypt local backup.

Maps to CM-7 via CCI-000381

Check
Review configuration settings to confirm "Force encrypted backups" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Encrypt local backup" is checked. Alternatively, verify the text "forceEncryptedBackup" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Encrypt backups enforced" is listed. If "Encrypt local backup" is unchecked in the Apple iOS/iPadOS management tool, "forceEncryptedBackup" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Encrypt backups enforced", this is a finding.

Fix
Install a configuration profile to force encrypted backups to iCloud. Configuration Profile Key: forceEncryptedBackup
AIOS-26-011000 CAT II V-278792 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop.

Maps to AC-17(1), CM-6 via CCI-002314, CCI-000366

Check
Review configuration settings to confirm "Allow MailDrop" is disabled. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow MailDrop" is not checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Mail". 6. Tap the mail account. 7. Verify "Mail Drop Enabled" is set to "No". If "Allow MailDrop" is not disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Mail Drop Enabled" as "Yes", this is a finding.

Fix
Configure the Apple iOS/iPadOS configuration profile to disable "Allow MailDrop".
AIOS-26-011300 CAT II V-278794 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: use SSL for Exchange ActiveSync.

Maps to IA-2 via CCI-000764

Check
Review configuration settings to confirm "Use SSL" for the Exchange account is enabled for incoming mail. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Use SSL for incoming mail" is checked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "SSL for incoming mail" is set to "Yes". If "Use SSL for incoming mail" is unchecked in the Apple iOS/iPadOS management tool or the Exchange policy on the iPhone and iPad has "SSL for incoming mail" set to "No", this is a finding.

Fix
Install a configuration profile to use SSL for Exchange ActiveSync incoming mail. Configuration Profile Key: IncomingMailServerUseSSL
AIOS-26-011400 CAT II V-278795 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 26 Mail app.

Maps to IA-2 via CCI-000764

Check
Review configuration settings to confirm "Allow messages to be moved" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow messages to be moved" is unchecked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "Prevent Move" is set to "Yes". If "Allow messages to be moved" is checked in the Apple iOS/iPadOS management tool or the Exchange policy on the iPhone and iPad has "Prevent Move" set to "No", this is a finding.

Fix
Install a configuration profile to prevent Exchange messages from being moved or forwarded between email accounts. Configuration Profile Key: PreventMove
AIOS-26-011500 CAT II V-278796 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.

Maps to IA-5(13) via CCI-002007

Check
Review configuration settings to confirm "Treat AirDrop as an unmanaged destination" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Treat AirDrop as unmanaged destination" is checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Sharing managed documents using AirDrop not allowed" is listed. If "Treat AirDrop as unmanaged destination" is disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad does not list "Sharing managed documents using AirDrop not allowed", this is a finding.

Fix
Install a configuration profile to treat AirDrop as an unmanaged destination. Configuration Profile Key: forceAirDropUnmanaged
AIOS-26-011700 CAT II V-278798 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: not share location data through iCloud.

Maps to AC-8 via CCI-000048

Check
Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "Privacy & Security". 3. Tap "Location Services". 4. If the authorizing official (AO) has not approved use of personal iCloud accounts on the device, verify "Share My Location" is grayed out (cannot be selected). 5. If the AO has approved the use of personal iCloud accounts on the device, tap "Share My Location". 6. Verify "Share My Location" is off. If "Share My Location" is not grayed out (cannot be selected) when the AO has not approved use of personal iCloud accounts on the device, this is a finding. If "Share My Location" is toggled to the right and appears green on the iPhone and iPad when the AO has approved the use of personal iCloud accounts, this is a finding.

Fix
The user must configure Apple iOS/iPadOS to disable location sharing through iCloud.
AIOS-26-011900 CAT II V-278800 · PP-MDF-993300

Apple iOS/iPadOS 26 users must complete required training.

Maps to CM-7 via CCI-000381

Check
Review a sample of site User Agreements for iOS device users or similar training records and training course content. Verify iPhone and iPad users have completed required training. If any iPhone/iPad user has not completed required training, this is a finding.

Fix
Have all iPhone and iPad users complete training on the following topics. Users must acknowledge receipt of training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications, including applications using global positioning system (GPS) tracking. - Must ensure no DOD data is saved in an unmanaged app or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DOD PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn in, or reassignment, ensure a factory data reset is performed prior to device handoff. Follow mobility service provider decommissioning procedures as applicable. - How to configure the following UBE controls (users must configure the control) and other controls on the iPhone and iPad: **Remove Family Sharing. **Disable Shared Location. **Disable Wi-Fi Assist. **Use AirPrint only with AO-approved printers and print servers (see the Multifunction Device and Network Printers STIG for requirements). **Turn off "Apps" under "Automatic Downloads" in the "iTunes & App Store" section of the Settings app on the iPhone and iPad. **Secure use of Calendar Alarm. **Do not configure a DOD network (work) VPN profile on any third-party unmanaged VPN app. **Disable iPhone and iPad radios using controls under "Settings" instead of "Control Center". - AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.). -Do not accept connection requests from nearby devices (via AirDrop or Wi-Fi Aware).
AIOS-26-012000 CAT II V-278801 · PP-MDF-993300

A managed photo app must be used to take and store work-related photos.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the DOD Configuration Profile from the Apple iOS/iPadOS management tool. 5. Tap "Apps". 6. Verify a photo capture and management app is listed. 7. Verify the app is managed and stores photos as managed data. If a photo capture and management app is installed on the iPhone and iPad and the app is not managed and does not store photos as managed data, this is a finding. Note: The recommended app is Microsoft OneDrive. Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information. Note: If the Apple device camera is disabled (see AIOS-26-018100), with authorizing official (AO) approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app.

Fix
Install a managed photos app to take and manage work-related photos. Note: The recommended application is Microsoft OneDrive. Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information. Note: If the Apple device camera is disabled (see AIOS-26-018100), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app. Note: The app must be managed and must store photos as managed data.
AIOS-26-012200 CAT II V-278803 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: enable USB Restricted Mode.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB Restricted Mode" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB Restricted Mode" is checked (set to "True"). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify there is no listing for "USB Accessories while locked allowed". If "Allow USB Restricted Mode" is not enabled in the management tool and there is a restriction listed in the profile on the Apple device, this is a finding. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: "Allow USB Restricted Mode" may be called "Allow USB accessories while device is locked" in some MDM consoles. The required logic is to disable USB accessory connections when the device is locked.

Fix
Install a configuration profile to configure "Allow USB Restricted Mode" to "True" in the management tool. This is a supervised-only control. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: This control is called "Allow USB accessories while device is locked" in Apple Configurator, and the control logic is opposite to what is listed here. Ensure the MDM policy rule is set correctly (to disable USB accessory connections when the device is locked). Configuration Profile Key: allowUSBRestrictedMode
AIOS-26-012500 CAT II V-278806 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: disable AirDrop.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirDrop" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirDrop not allowed" is listed. If "AirDrop not allowed" is not listed in the management tool and on the Apple device, this is a finding.

Fix
Install a configuration profile to disable the AllowAirDrop control in the management tool. This is a supervised-only control. Configuration Profile Key: allowAirDrop
AIOS-26-012600 CAT II V-278807 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: disable paired Apple Watch.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm "Allow Paired Watch" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Paired Watch" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Paired Apple Watch not allowed" is listed. If "Paired Apple Watch not allowed" is not listed both in the management tool and on the Apple device, this is a finding.

Fix
Install a configuration profile to disable the Apple Watch control in the management tool. This is a supervised-only control. Configuration Profile Key: allowPairedWatch
AIOS-26-012700 CAT II V-278809 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable "Password AutoFill" in browsers and applications.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password AutoFill is not allowed" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password AutoFill is not allowed" is unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password AutoFill is not allowed" is listed. If "Password AutoFill is not allowed" is not enabled in the iOS/iPadOS management tool and on the Apple device, this is a finding.

Fix
Install a configuration profile to disable allow Password AutoFill in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordAutoFill
AIOS-26-012800 CAT II V-278810 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable "Allow setting up new nearby devices".

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow setting up new nearby devices" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow proximity setup to a new device" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity setup to a new device is not allowed" is listed. If "Allow proximity setup to a new device" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity setup to a new device is not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable allow setting up new nearby devices in the management tool. This is a supervised-only control. Configuration Profile Key: allowProximitySetupToNewDevice
AIOS-26-012900 CAT II V-278811 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable password proximity requests.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Password Proximity Requests" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Password Proximity Requests" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity password requests not allowed" is listed. If "Allow Password Proximity Requests" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity password requests not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable "allow password proximity requests" in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordProximityRequests
AIOS-26-013000 CAT II V-278812 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable password sharing.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password Sharing is not allowed" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password Sharing is not allowed" is checked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password Sharing is not allowed" is listed. If "Password Sharing is not allowed" is not enabled in the management tool and on the Apple device, this is a finding.

Fix
Install a configuration profile to disable allow password proximity sharing in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordSharing
AIOS-26-013200 CAT II V-278814 · PP-MDF-993300

The Apple iOS/iPadOS 26 must be supervised by the MDM.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify all managed Apple devices are supervised (verification procedure will vary by MDM product). Note: If the Apple device is not managed by an MDM and supervision is set up via Apple Configurator, this procedure is not applicable. On the iPhone and iPad: 1. Open the Settings app. 2. Verify a message similar to the following appears on the screen: "This iPad is supervised by (name of site DOD mobile service provider)." If site-managed iOS/iPadOS devices are not supervised, this is a finding.

Fix
Use one of the following methods to supervise iOS and iPadOS devices managed by the DOD mobile service provider. Method 1: - Register all current and new iOS and iPadOS devices in the DOD mobile service provider's Automated Device Management/Apple Business Manager (ABM) account. - Enable supervision of managed iOS/iPadOS devices in the MDM. Method 2: - Configure each iOS/iPadOS device using the Apple Configurator tool for Supervision. - This method is usually only appropriate when MDM management of the DOD Apple device is not appropriate or an older device cannot be registered in ABM.
AIOS-26-013300 CAT II V-278815 · PP-MDF-333240

Apple iOS/iPadOS 26 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DOD-approved USB storage drives with iOS/iPadOS devices.

Maps to SC-4 via CCI-001090

Check
This requirement is not applicable if the AO has approved the use of USB drives to load files to Apple devices. The approval must be in writing and include which USB storage devices are approved for use. If the AO has not approved the use of USB drives to load files to Apple devices, use the following procedures to verify compliance. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB drive access in Files app" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB drive access in Files app" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "USB drives not accessible in Files app" is listed. If "Allow USB drive access in Files app" is not disabled in the management tool and "USB drives not accessible in Files app" is not listed in the Restrictions profile on the Apple device, this is a finding.

Fix
If the AO has not approved the use of USB drives to load files to Apple devices, install a configuration profile to disable "Allow USB drive access in Files app". Configuration Profile Key: allowFilesUSBDriveAccess
AIOS-26-013500 CAT II V-278817 · PP-MDF-993300

Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm configuration profiles are not removable. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. The procedures below assume the site is not enrolled in Apple's Automatic Device Enrollment and are not applicable to devices under MDM management. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS management tool, verify "Security" is set to "Never" and "Automatically Remove Profile" is set to "Never". On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap each Configuration Profile from the Apple iOS management tool that contains the restrictions for the device. 5. Verify the "Remove Profile" button is not present. If on the Apple iOS management tool or the iOS device the "Remove Profile" button is available on the configuration profile, this is a finding.

Fix
Configure the Apple iOS configuration profile so that it can never be removed. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. When using Apple Configurator, under "General Security", configure "Security" to "Never" and "Automatically Remove Profile" to "Never". Configuration Profile Key: PayloadRemovalDisallowed
AIOS-26-014300 CAT II V-278818 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable "Allow network drive access in Files access".

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow network drive access in Files access" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Network drives not accessible in Files app" is listed. If "Allow network drive access in Files access" is not disabled in the management tool and "Network drives not accessible in Files app" is not listed in Profile Restrictions on the Apple device, this is a finding.

Fix
Install a configuration profile to disable "Allow network drive access in Files access". Configuration Profile Key: allowFilesNetworkDriveAccess
AIOS-26-014400 CAT II V-278819 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of dictation.

Maps to CM-6 via CCI-000366

Check
If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Disable connections to Siri servers for the purpose of dictation" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Disable connections to Siri servers for the purpose of dictation" is checked. If connections to Siri servers are not disabled for dictation, this is a finding.

Fix
Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of dictation. This is a supervised-only control. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, select "disable connections to Siri servers for the purpose of dictation". Configuration Profile Key: forceOnDeviceOnlyDictation
AIOS-26-014500 CAT II V-278820 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of translation.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Disable connections to Siri servers for the purpose of translation" is checked. If connections to Siri servers are not disabled for translation, this is a finding.

Fix
Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of translation. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, select "disable connections to Siri servers for the purpose of translation". Configuration Profile Key: forceOnDeviceOnlyTranslation
AIOS-26-014600 CAT II V-278821 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable copy/paste of data from managed to unmanaged applications.

Maps to CM-6 via CCI-000366

Check
Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Require managed pasteboard" is set to "True". If "Require managed pasteboard" is not set to "True", this is a finding.

Fix
Configure the Apple iOS configuration profile to disable copy/paste of data from managed to unmanaged applications. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Require managed pasteboard" to "True". Configuration Profile Key: requireManagedPasteboard
AIOS-26-014700 CAT II V-278822 · PP-MDF-333350

Apple iOS/iPadOS 26 must have DOD root and intermediate PKI certificates installed.

Maps to CM-6(1) via CCI-000370

Check
Verify DOD intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DOD intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "More Details". 6. Verify the DOD intermediate and root certificates are listed. If DOD intermediate and root certificates are not installed on the Apple device, this is a finding.

Fix
Install DOD intermediate and root certificates on managed mobile devices using the MDM.
AIOS-26-014800 CAT II V-278823 · PP-MDF-993300

Apple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

Maps to AC-6(10), IA-2(1) via CCI-000765, CCI-002235

Check
Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow auto unlock" is not checked. If Allow auto unlock is enabled, this is a finding. This requirement will become "Supervised only" in a future iOS/iPadOS release.

Fix
If the AO has not approved the use of Apple Watch with DOD-owned iPhones, configure the Apple iOS configuration profile to disable "Allow auto unlock". The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Allow auto unlock" to "False". Configuration Profile Key: allowAutoUnlock This requirement will become "Supervised only" in a future iOS/iPadOS release.
AIOS-26-014900 CAT II V-278824 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable the installation of alternative marketplace apps.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow marketplace app installation" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Marketplace app installation not allowed" is listed. If "Marketplace app installation" is not disabled in the management tool, this is a finding.

Fix
Install a configuration profile to disable the installation of alternative marketplace apps. This is a supervised-only control. Configuration Profile Key: allowMarketplaceAppInstallation
AIOS-26-015000 CAT II V-278825 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable app installation from a website.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow app installation from website" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Web app distribution not allowed" is listed. If "Allow app installation from website" is not disabled in the management tool or on the Apple device "Web app distribution not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable app installation from a website. Configuration Profile Key: allowWebDistributionAppInstallation
AIOS-26-015100 CAT II V-278826 · PP-MDF-993300

Apple iOS/iPadOS 26 must delete eSIM content when the device is erased.

Maps to MP-6(3) via CCI-001033

Check
This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Preserve eSIM content when device is erased" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Preserve eSIM content when device is erased" is not listed. If "Preserve eSIM content when device is erased" is not disabled in the management tool or on the Apple device "Preserve eSIM content when device is erased" is listed, this is a finding.

Fix
Install a configuration profile to delete eSIM content when the device is erased. Configuration Profile Key: forcePreserveESIMOnErase
AIOS-26-015400 CAT II V-278827 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable ChatGPT connection for Apple Intelligence.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow ChatGPT" is unchecked. Note: Each MDM/EMM server will define the exact label for the control to disable connections to cloud-based third-party artificial intelligence (AI) apps, including ChatGPT. If access to all cloud-based third-party AI apps, including ChatGPT is not disabled in the management tool, this is a finding.

Fix
Install a configuration profile to disable ChatGPT (and any other available third-party AI app) connection for Apple Intelligence. Configuration Profile Key: allowExternalIntelligenceIntegrations, allowExternalIntelligenceIntegrationsSignIn
AIOS-26-015500 CAT II V-278828 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable the download of iOS/iPadOS beta updates.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow installing configuration profiles (supervised only)" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Installing configuration profiles not allowed" is listed. If "Allow installing configuration profiles" is not disabled in the management tool or on the Apple device "Installing configuration profiles not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable the installation of new configuration profiles. This will block the download and installation of beta iOS and iPadOS updates. This is a supervised-only control. Configuration Profile Key: allowUIConfigurationProfileInstallation
AIOS-26-015600 CAT II V-278829 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable the ability to hide apps.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Apps to be hidden" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "Apps". 3. At the bottom of the list of Apps, tap "Hidden Apps". 4. Verify there are no hidden apps listed. If "Allow Apps to be hidden" is not disabled in the management tool or there are hidden apps installed on enterprise iPhones and iPads, this is a finding.

Fix
Install a configuration profile to disable hiding apps on iPhones and iPads. Configuration Profile Key: allowAppsToBeHidden
AIOS-26-015700 CAT II V-278830 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable recording cell phone calls on the iPhone.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow call recording" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "Apps". 3. Tap "Phone" 4. Tap "Call Recording". 5. Verify the "Call Recording" toggle is off and grayed out (cannot be set to "On"). If "Allow Call Recording" is not disabled in the management tool or "Call Recording" can be enabled on the iPhone, this is a finding.

Fix
Install a configuration profile to disable recording cell phone calls. Configuration Profile Key: allowCallRecording
AIOS-26-015800 CAT II V-278831 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable iPhone Mirroring on Mac.

Maps to CM-6 via CCI-000366

Check
This check procedure is performed on the device management tool and iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow iPhone Mirroring (supervised only)" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iPhone Mirroring not allowed" is listed. If "Allow iPhone Mirroring" is not disabled in the management tool or "iPhone Mirroring not allowed" is not listed on the iPhone, this is a finding.

Fix
Install a configuration profile to disable iPhone Mirroring on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneMirroring
AIOS-26-016000 CAT II V-278832 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable the ability of the user to wipe the device.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow erase all content and settings" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Erase content and settings not allowed" is listed. If "Allow erase all content and settings" is not disabled in the management tool or on the Apple device "Erase content and settings not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable "Allow Erase All Content and Settings". This is a supervised-only control. Configuration Profile Key: allowEraseCointentAndSettings
AIOS-26-016400 CAT II V-278836 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable automatic downloads of apps purchased on other Apple devices.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow automatic app downloads" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Automatic downloading apps not allowed" is listed. If "Automatic downloading apps" is not disabled in the management tool or on the Apple device "Automatic downloading apps not allowed" is not listed, this is a finding.

Fix
Install a configuration profile to disable "Allow automatic app downloads". This is a supervised-only control. Configuration Profile Key: allowAutomaticAppDownloads
AIOS-26-016500 CAT II V-278837 · PP-MDF-993300

Apple iOS/iPadOS 26 must disable pairing with a host Mac or PC.

Maps to CM-6 via CCI-000366

Check
Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow host pairing" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Pairing with iTunes not allowed" is listed. If "Host pairing" is not disabled in the management tool or on the Apple device, "Pairing with iTunes not allowed" is not listed, this is a finding. Note: Some applications used to remove iPhone and iPad data to meet the DOD data retention policy require host pairing be enabled. Host pairing may be temporarily enabled for this purpose only, with authorizing official (AO) approval.

Fix
Install a configuration profile to disable "Allow host pairing". This is a supervised-only control. Configuration Profile Key: allowHostPairing Note: Some applications used to remove iPhone and iPad data to meet the DOD data retention policy require host pairing be enabled. Host pairing may be temporarily enabled for this purpose only, with AO approval.
AIOS-26-017700 CAT II V-278847 · PP-MDF-993300

DOD Apple iOS/iPadOS 26 devices must have a Mobile Threat Detection (MTD) app installed.

Maps to CM-6 via CCI-000366

Check
Confirm an MTD app is installed on managed iPhones and iPads. This check procedure is performed on both the device management tool and the iPhone and iPad device. In the iOS/iPadOS management tool, verify an MTD app is listed as a managed app being deployed to site managed devices. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Verify a MTD app is listed. If an MTD app is not installed on the device, this is a finding.

Fix
Deploy a site-approved MTD app via the MDM server to managed iPhones and iPads.
AIOS-26-018100 CAT II V-278851 · PP-MDF-993300

Apple iOS/iPadOS 26 must implement the management setting: disable Camera.

Maps to CM-6 via CCI-000366

Check
This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding (if the AO has not approved the use of Apple device camera). If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: There are three possible use cases regarding camera use on a DOD iPhone or iPad: 1. Disable use of the camera devicewide – both unmanaged and managed use. 2. Allow camera use – both unmanaged and managed. In this case, the requirement is Not Applicable. 3. Disable camera use for unmanaged camera apps (e.g., iPhone camera app) but allow camera use for an approved managed camera app (e.g., Microsoft OneDrive). These check procedures are performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. **Use Case #1: In the iOS/iPadOS management tool, verify "Allow Camera" is unchecked. If the AO has not approved Apple device camera use and "Allow camera" is listed in the management tool, this is a finding. **Use Case #3: In the iOS/iPadOS management tool, verify "Allow Camera" is unchecked and "allowedCameraRestrictionBundleIDs" is configured with the Bundle ID of the approved managed camera app. If the AO has not approved Apple device camera use for unmanaged apps but has approved a specific managed camera app, and "Allow camera" is listed in the management tool or "allowedCameraRestrictionBundleIDs" is not configured with the approved managed camera app, this is a finding.

Fix
There are three possible use cases regarding camera use on a DOD iPhone or iPad: a. Disable use of the camera devicewide – both unmanaged and managed use. b. Allow camera use – both unmanaged and managed. c. Disable camera use for unmanaged camera apps (e.g., iPhone camera app) but allow camera use for an approved managed camera app (e.g., Microsoft OneDrive**). Procedure 1. Determine if the site AO has approved the use of Apple device cameras or the use of device cameras only with managed apps. Look for a document showing approval for a specific user or group of users and a list of approved managed camera apps (e.g., Microsoft OneDrive). 2. If the use of the camera is not approved for both unmanaged and managed apps, configure "Allow Camera" to "Disable". 3. If camera use is approved for all users and use cases (unmanaged and managed apps), this requirement is not applicable. 4. If camera use is not approved for unmanaged camera apps (e.g., iPhone camera app) but is approved for a managed camera app (e.g., Microsoft OneDrive), configure "Allow Camera" to "Disable" and "allowedCameraRestrictionBundleIDs" with the AO approved managed camera app ID. **Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for information on how to implement a managed photo and video capture and storage solution for work-related media. Configuration Profile Keys: allowCamera, allowedCameraRestrictionBundleIDs
AIOS-26-018300 CAT II V-278853 · PP-MDF-993300

Apple iOS/iPadOS 26 must be configured to disable Wi-Fi Aware.

Maps to CM-6 via CCI-000366

Check
Confirm required Wi-Fi Aware procedures have been implemented. 1. Verify required training has been received by site personal that have site managed iPhones and iPads (AIOS-26-0011900). 2. Verify the site reviewed all managed iOS/iPadOS apps installed on site managed iPhones and iPads for Wi-Fi Aware support and removed all apps that support Wi-Fi Aware. Discuss with the ISSO/ISSM. If the site also manages the deployment of unmanaged apps on site managed iPhones and iPads, verify unmanaged apps were also reviewed. 3. Review site app vetting procedures and verify they include review of Wi-Fi Aware capabilities in all apps. Verify apps with Wi-Fi Aware capability are disapproved for use. If the site has not reviewed current managed apps for Wi-Fi Aware capabilities or did not remove Wi-Fi Aware capable apps, this is a finding. If the site app vetting procedures do not include a review of Wi-Fi Aware capabilities in all apps or disapprove apps with Wi-Fi Aware capability, this is a finding.

Fix
Remove Wi-Fi Aware-capable apps on site managed Apple iOS/iPadOS 26 devices. There are three steps to implementing this control: 1. Train all users to not accept connection requests from nearby devices. This requirement is met by AIOS-26-0011900. 2a. Review all MDM managed apps deployed to site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. Note: There is currently no management API/key to disable Wi-Fi Aware on Apple devices. 2b. If a site manages unmanaged apps on site iPhones and iPads, review all unmanaged apps deployed on site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. 3a. For managed apps being reviewed for approval, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads. 3b. If a site manages unmanaged apps on site iPhones and iPads, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads.

Mobile STIGs

CAT II 60

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud).

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud document and data synchronization).

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Keychain).

Apple iOS/iPadOS 26 must not allow backup to remote systems (Cloud Photo Library).

Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream).

Apple iOS/iPadOS 26 must not allow backup to remote systems (managed applications data stored in iCloud).

Apple iOS/iPadOS 26 must not allow backup to remote systems (enterprise books).

Apple iOS/iPadOS 26 must be configured to enforce a minimum password length of six characters.

Apple iOS/iPadOS 26 must be configured to not allow passwords that include more than four repeating or sequential characters.

Apple iOS/iPadOS 26 must be configured to lock the display after 15 minutes (or less) of inactivity.

Apple iOS/iPadOS 26 must be configured to not allow more than 10 consecutive failed authentication attempts.

Apple iOS/iPadOS 26 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

Apple iOS/iPadOS 26 must not include applications with the following characteristics: access to Siri when the device is locked.

Apple iOS/iPadOS 26 must be configured to not display notifications when the device is locked.

Apple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked.

Apple iOS/iPadOS 26 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

Apple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data.

Apple iPadOS 26 must be configured to disable multiuser modes.

Apple iOS/iPadOS 26 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.

Apple iOS/iPadOS 26 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.

Apple iOS/iPadOS 26 must be configured to disable ad hoc wireless client-to-client connection capability.

Apple iOS/iPadOS 26 must implement the management setting: encrypt backups/Encrypt local backup.

Apple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop.

Apple iOS/iPadOS 26 must implement the management setting: use SSL for Exchange ActiveSync.

Apple iOS/iPadOS 26 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 26 Mail app.

Apple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.

Apple iOS/iPadOS 26 must implement the management setting: not share location data through iCloud.

Apple iOS/iPadOS 26 users must complete required training.

A managed photo app must be used to take and store work-related photos.

Apple iOS/iPadOS 26 must implement the management setting: enable USB Restricted Mode.

Apple iOS/iPadOS 26 must implement the management setting: disable AirDrop.

Apple iOS/iPadOS 26 must implement the management setting: disable paired Apple Watch.

Apple iOS/iPadOS 26 must disable "Password AutoFill" in browsers and applications.

Apple iOS/iPadOS 26 must disable "Allow setting up new nearby devices".

Apple iOS/iPadOS 26 must disable password proximity requests.

Apple iOS/iPadOS 26 must disable password sharing.

The Apple iOS/iPadOS 26 must be supervised by the MDM.

Apple iOS/iPadOS 26 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DOD-approved USB storage drives with iOS/iPadOS devices.

Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements.

Apple iOS/iPadOS 26 must disable "Allow network drive access in Files access".

Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of dictation.

Apple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of translation.

Apple iOS/iPadOS 26 must disable copy/paste of data from managed to unmanaged applications.

Apple iOS/iPadOS 26 must have DOD root and intermediate PKI certificates installed.

Apple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

Apple iOS/iPadOS 26 must disable the installation of alternative marketplace apps.

Apple iOS/iPadOS 26 must disable app installation from a website.

Apple iOS/iPadOS 26 must delete eSIM content when the device is erased.

Apple iOS/iPadOS 26 must disable ChatGPT connection for Apple Intelligence.

Apple iOS/iPadOS 26 must disable the download of iOS/iPadOS beta updates.

Apple iOS/iPadOS 26 must disable the ability to hide apps.

Apple iOS/iPadOS 26 must disable recording cell phone calls on the iPhone.

Apple iOS/iPadOS 26 must disable iPhone Mirroring on Mac.

Apple iOS/iPadOS 26 must disable the ability of the user to wipe the device.

Apple iOS/iPadOS 26 must disable automatic downloads of apps purchased on other Apple devices.

Apple iOS/iPadOS 26 must disable pairing with a host Mac or PC.

DOD Apple iOS/iPadOS 26 devices must have a Mobile Threat Detection (MTD) app installed.

Apple iOS/iPadOS 26 must implement the management setting: disable Camera.

Apple iOS/iPadOS 26 must be configured to disable Wi-Fi Aware.