Mobile STIGs

CAT III 25

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. AIOS-26-001000 CAT III V-278697 · PP-MDF-331090

   Apple iOS/iPadOS 26 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis].

   Maps to AC-17(2), CM-6(1) via CCI-000068, CCI-000370
   Check

   Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DOD network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DOD network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DOD network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement.

   Fix

   If a third-party unmanaged VPN app is installed on the iOS 26 device, do not configure the VPN app with a DOD network VPN profile.

2. AIOS-26-008400 CAT III V-278767 · PP-MDF-333160

   Apple iOS/iPadOS 26 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

   Maps to AC-8 via CCI-000048
   Check

   The DOD warning banner can be displayed by either of the following methods (required text is found in the Vulnerability Discussion): 1. By placing the DOD warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Determine which method is used at the iOS device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several iOS device users and verify the agreement includes the required DOD warning banner text. Validation Procedure for Method #2: In the Apple iOS/iPadOS management tool, verify a Lock Screen Message payload has been installed on each managed device. The LockScreenFootnote string should include required text. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed, or for Method #2, the DOD warning banner text is not set as the lock screen footnote, this is a finding.

   Fix

   Configure the DOD warning banner by either of the following methods (required text is found in the Vulnerability Discussion): 1. By placing the DOD warning banner text in the user agreement signed by each iOS device user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Configuration Profile Key: LockScreenFootnote

3. AIOS-26-010500 CAT III V-278786 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: limit Ad Tracking.

   Maps to SC-28 via CCI-001199
   Check

   Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Force limited ad tracking" is checked. Alternatively, verify the text "forceLimitAdTracking" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Requests to track from apps not allowed" is present. If "limited ad tracking enforced" is missing in the Apple iOS/iPadOS management tool, "forceLimitAdTracking" does not appear in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Requests to track from apps not allowed", this is a finding.

   Fix

   Install a configuration profile to limit advertisers' ability to track the user's web browsing preferences. Configuration Profile Key: forceLimitAdTracking

4. AIOS-26-010600 CAT III V-278787 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: not allow automatic completion of Safari browser passcodes.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Enable autofill" is unchecked. Alternatively, verify the text "safariAllowAutoFill" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Auto-fill in Safari not allowed" is present. If "Enable autofill" is checked in the Apple iOS/iPadOS management tool, "safariAllowAutoFill" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Auto-fill in Safari not allowed", this is a finding.

   Fix

   Install a configuration profile to disable the AutoFill capability in the Safari app. Configuration Profile Key: safariAllowAutoFill

5. AIOS-26-010800 CAT III V-278789 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: not allow use of Handoff.

   Maps to CM-7 via CCI-000381
   Check

   This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Handoff" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Handoff" is unchecked. Alternatively, verify the text "allowActivityContinuation " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Handoff not allowed" is listed. If "Allow Handoff" is checked in the Apple iOS/iPadOS management tool, "allowActivityContinuation " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Handoff not allowed", this is a finding.

   Fix

   Install a configuration profile to disable continuation of activities among devices and workstations. This is a supervised-only control. Configuration Profile Key: allowActivityContinuation

6. AIOS-26-010850 CAT III V-278790 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: not allow use of iPhone widgets on Mac.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check procedure is performed only on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "iPhone Widget on Mac" is unchecked. If "Allow iPhone Widget on Mac" is checked in the Apple iOS/iPadOS management tool, this is a finding.

   Fix

   Install a configuration profile to disable the installation of iPhone widgets on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneWidgetsOnMac

7. AIOS-26-010900 CAT III V-278791 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.

   Maps to AC-17(1) via CCI-000067
   Check

   Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Require passcode on outgoing AirPlay request" is checked. Alternatively, verify the text "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPlay outgoing requests pairing password enforced" is listed. If "Require passcode on outgoing AirPlay request" is unchecked in the Apple iOS/iPadOS management tool, "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "AirPlay outgoing requests pairing password enforced", this is a finding.

   Fix

   Install a configuration profile to require the user to enter a password when connecting to an AirPlay-enabled device. Configuration Profile Key: forceAirPlayOutgoingRequestsPairingPassword

8. AIOS-26-011600 CAT III V-278797 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing.

   Maps to IA-5(13) via CCI-002007
   Check

   Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. At the top of the screen, if "Sign in to your iPhone" is listed, this requirement has been met. 3. If the user profile is signed into iCloud, tap the username. 4. Tap "Family Sharing". 5. Verify no accounts are listed other than the "Organizer". Note: The iPhone and iPad must be connected to the internet to conduct this validation procedure. Otherwise, the device will display the notice "Family information is not available", in which case configuration compliance cannot be determined. If accounts (names or email addresses) are listed under "FAMILY MEMBERS" on the iPhone and iPad, this is a finding.

   Fix

   The user must either remove all members from the Family Group on the iPhone and iPad or associate the device with an Apple ID that is not a member of a Family Group.

9. AIOS-26-011800 CAT III V-278799 · PP-MDF-993300

   Apple iOS/iPadOS 26 must implement the management setting: force Apple Watch wrist detection.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Wrist detection enforced on Apple Watch" is enforced. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Wrist detection enforced on Apple Watch" is listed. If "Wrist detection enforced on Apple Watch" is not enforced in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad does not list "Wrist detection enforced on Apple Watch", this is a finding.

   Fix

   Install a configuration profile to force Apple Watch wrist detection. Configuration Profile Key: forceWatchWristDetection

10. AIOS-26-012300 CAT III V-278804 · PP-MDF-993300

    Apple iOS/iPadOS 26 must not allow managed apps to write contacts to unmanaged contacts accounts.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow managed apps to write contacts to unmanaged contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow managed apps to write contacts to unmanaged contacts accounts" is not listed. If "Allow managed apps to write contacts to unmanaged contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Allow managed apps to write contacts to unmanaged contacts accounts", this is a finding.

    Fix

    Install a configuration profile to prevent managed apps from writing contacts to unmanaged contacts accounts. Configuration Profile Key: allowManagedToWriteUnmanagedContacts This payload can only be installed via an MDM.

11. AIOS-26-012400 CAT III V-278805 · PP-MDF-993300

    Apple iOS/iPadOS 26 must not allow unmanaged apps to read contacts from managed contacts accounts.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow unmanaged apps to read contacts from managed contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow unmanaged apps to read contacts from managed contacts accounts" is not listed. If "Allow unmanaged apps to read contacts from managed contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Allow unmanaged apps to read contacts from managed contacts accounts", this is a finding.

    Fix

    Install a configuration profile to prevent unmanaged apps from reading contacts from managed contacts accounts. Configuration Profile Key: allowunmanagedToReadManagedContacts This payload can only be installed via an MDM.

12. AIOS-26-013100 CAT III V-278813 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable "Find My Friends" in the "Find My" app.

    Maps to CM-6 via CCI-000366
    Check

    This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Find My Friends" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow Find My Friends" and "Allow modifying Find My Friends" are unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow Find My Friends" is not listed and "Changing Find My Friends settings not allowed" is listed. If "Allow Find My Friends" and "Allow modifying Find My Friends" are not disabled in the management tool and on the Apple device "Allow Find My Friends" is listed and "Changing Find My Friends settings not allowed" is not listed, this is a finding.

    Fix

    Install a configuration profile to disable "Find My Friends" in the Find My app and "Allow modifying Find My Friends" in the management tool. This is a supervised-only control. Configuration Profile Key: allowFindMyFriends, allowFindMyFriendsModification

13. AIOS-26-013400 CAT III V-278816 · PP-MDF-993300

    The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.

    Maps to SC-28 via CCI-001199
    Check

    Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow sending diagnostic and usage data to Apple" is unchecked. Alternatively, verify the text "allowDiagnosticSubmission" appears in the configuration profile (.mobileconfig file). On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Diagnostic submission not allowed". Note: This setting also disables "Share With App Developers". If "Allow sending diagnostic and usage data to Apple" is checked in the iOS management tool, "allowDiagnosticSubmission" appears in the configuration profile, or the restrictions policy on the Apple iOS device from the Apple iOS management tool does not list "Diagnostic submission not allowed", this is a finding.

    Fix

    Install a configuration profile to disable sending diagnostic data to an organization other than DOD. Configuration Profile Key: allowDiagnosticSubmission

14. AIOS-26-016600 CAT III V-278838 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable AirPrint.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPrint not allowed" is listed. If AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow AirPrint". This is a supervised-only control. Configuration Profile Key: AllowAirPrint

15. AIOS-26-016700 CAT III V-278839 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow discovery of AirPrint printers using iBeacons" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Discovery of AirPrint printers using iBeacons not allowed" or "AirPrint not allowed" is listed. If "Discovery of AirPrint printers using iBeacons" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow discovery of AirPrint printers using iBeacons". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintiBeaconDiscovery

16. AIOS-26-016800 CAT III V-278840 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable AirPrint: Allow storage of AirPrint credentials in Keychain.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow storage of AirPrint credentials in Keychain" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Storage of AirPrint credentials in Keychain not allowed" or "AirPrint not allowed" is listed. If "Storage of AirPrint credentials in Keychain" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow storage of AirPrint credentials in Keychain". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintCredentialsStorage

17. AIOS-26-016900 CAT III V-278841 · PP-MDF-993300

    Apple iOS/iPadOS 26 must allow AirPrint feature: Disallow AirPrint to destinations with untrusted certificates.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Disallow AirPrint to destinations with untrusted certificates" is checked or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow AirPrint to destinations with untrusted certificates" is not listed or "AirPrint not allowed" is listed. If "Disallow AirPrint to destinations with untrusted certificates" is disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to enable "Disallow AirPrint to destinations with untrusted certificates". This is a supervised-only control. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: forceAirPrintTrustedTLSRequirement

18. AIOS-26-017000 CAT III V-278842 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable Allowed Content Ratings (Movies).

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Movie ratings" is set to "0" (disable all movies). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Movie ratings enforced" is listed. If "Movie ratings" is not set to "0" in the management tool and Movie ratings are not enforced on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allowed Content Ratings (Movies)" (ratingMovies key value = 0). This is a supervised-only control. Configuration Profile Key: ratingMovies

19. AIOS-26-017100 CAT III V-278843 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable Allowed Content Ratings (TV Shows).

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "TV Shows ratings" is set to "0" (disable all TV Shows). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "TV show ratings enforced" is listed. If "TV show ratings" is not set to "0" in the management tool and TV show ratings are not enforced on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allowed Content Ratings (TV Shows)" (ratingTVShows key value = 0). This is a supervised-only control. Configuration Profile Key: ratingTVShows

20. AIOS-26-017200 CAT III V-278844 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Wand.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify the Apple Intelligence feature: Image Wand is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Image Wand not allowed" is listed. If Image Wand is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable Apple Intelligence feature: Image Wand. This is a supervised-only control. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. Configuration Profile Key: allowImagewand

21. AIOS-26-017300 CAT III V-278845 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Generation.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify the Apple Intelligence feature: Image Generation is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Image Playground not allowed" is listed. If Image Generation is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable Apple Intelligence feature: Image Generation. This is a supervised-only control. Note: this control is only applicable to Apple Intelligence capable iPhones and iPads. Configuration Profile Key: allowImagePlayground

22. AIOS-26-017400 CAT III V-278846 · PP-MDF-993300

    Apple iOS/iPadOS 26 must disable Apple Intelligence feature: generate new Genmoji.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm it is disabled. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify the Apple Intelligence feature: generate new Genmoji is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Genmoji not allowed" is listed. If generate new Genmoji is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable Apple Intelligence feature: generate new Genmoji. This is a supervised-only control. Note: This control is only applicable to Apple Intelligence capable iPhones and iPads. Configuration Profile Key: allowGenmoji

23. AIOS-26-017800 CAT III V-278848 · PP-MDF-993300

    DOD Apple iOS/iPadOS 26 devices must disable FaceTime.

    Maps to CM-6 via CCI-000366
    Check

    This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow FaceTime" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "FaceTime not allowed" is listed. If "Allow FaceTime" is listed in the management tool or "FaceTime not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable FaceTime. This is a supervised-only control. Configuration Profile Key: allowVideoConferencing

24. AIOS-26-017900 CAT III V-278849 · PP-MDF-993300

    DOD Apple iOS/iPadOS 26 devices must disable eSIM transfers.

    Maps to CM-6 via CCI-000366
    Check

    Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow outgoing eSIM transfers" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Outgoing eSIM transfers not allowed" is listed. If the AO has not approved eSIM transfers and "Allow eSIM outgoing transfers" is listed in the management tool or "Outgoing eSIM transfers not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable the transfer of an eSIM from one DOD phone to another, unless the service has been approved by the AO. This is a supervised-only control. Configuration Profile Key: allowESIMOutgoingTransfers

25. AIOS-26-018000 CAT III V-278850 · PP-MDF-993300

    DOD Apple iOS/iPadOS 26 devices must disable screenshots and screen recordings.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow screenshot and screen recording" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Screen capture not allowed" is listed. If "Allow screenshot and screen recording" is listed in the management tool or "Screen capture not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable the screenshot and screen recording. Configuration Profile Key: allowScreenShot