Mobile STIGs

CAT III 25

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. AIOS-27-000400 CAT III V-288302 · PP-MDF-401030

   Apple iOS/iPadOS 27 must allow the administrator (MDM) and/or the user to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].

   Maps to CM-6 via CCI-000366
   Check

   Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DoW network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DoW network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DoW network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement.

   Fix

   If a third-party unmanaged VPN app is installed on the iOS 27 device, do not configure the VPN app with a DoW network VPN profile.

2. AIOS-27-008100 CAT III V-288379 · PP-MDF-401650

   Apple iOS/iPadOS 27 (MOS) must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

   Maps to AC-8 via CCI-000048
   Check

   The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Determine which method is used at the iOS device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several iOS device users and verify the agreement includes the required DoW warning banner text. Validation Procedure for Method #2: In the Apple iOS/iPadOS management tool, verify a Lock Screen Message payload has been installed on each managed device. The LockScreenFootnote string should include required text. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed, or for Method #2, the DoW warning banner text is not set as the lock screen footnote, this is a finding.

   Fix

   Configure the DoW warning banner by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iOS device user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Configuration Profile Key: LockScreenFootnote

3. AIOS-27-009700 CAT III V-288395 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: limit Ad Tracking.

   Maps to SC-28 via CCI-001199
   Check

   Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Force limited ad tracking" is checked. Alternatively, verify the text "forceLimitAdTracking" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Requests to track from apps not allowed" is present. If "limited ad tracking enforced" is missing in the Apple iOS/iPadOS management tool, "forceLimitAdTracking" does not appear in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Requests to track from apps not allowed", this is a finding.

   Fix

   Install a configuration profile to limit advertisers' ability to track the user's web browsing preferences. Configuration Profile Key: forceLimitAdTracking

4. AIOS-27-009800 CAT III V-288396 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: not allow automatic completion of Safari browser passcodes.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Enable autofill" is unchecked. Alternatively, verify the text "safariAllowAutoFill" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Auto-fill in Safari not allowed" is present. If "Enable autofill" is checked in the Apple iOS/iPadOS management tool, "safariAllowAutoFill" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Auto-fill in Safari not allowed", this is a finding.

   Fix

   Install a configuration profile to disable the AutoFill capability in the Safari app. Configuration Profile Key: safariAllowAutoFill

5. AIOS-27-010000 CAT III V-288398 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: not allow use of Handoff.

   Maps to CM-7 via CCI-000381
   Check

   This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Handoff" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Handoff" is unchecked. Alternatively, verify the text "allowActivityContinuation " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Handoff not allowed" is listed. If "Allow Handoff" is checked in the Apple iOS/iPadOS management tool, "allowActivityContinuation " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Handoff not allowed", this is a finding.

   Fix

   Install a configuration profile to disable continuation of activities among devices and workstations. This is a supervised-only control. Configuration Profile Key: allowActivityContinuation

6. AIOS-27-010100 CAT III V-288399 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: not allow use of iPhone widgets on Mac.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check procedure is performed only on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "iPhone Widget on Mac" is unchecked. If "Allow iPhone Widget on Mac" is checked in the Apple iOS/iPadOS management tool, this is a finding.

   Fix

   Install a configuration profile to disable the installation of iPhone widgets on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneWidgetsOnMac

7. AIOS-27-010200 CAT III V-288400 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.

   Maps to AC-17(1) via CCI-000067
   Check

   Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Require passcode on outgoing AirPlay request" is checked. Alternatively, verify the text "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPlay outgoing requests pairing password enforced" is listed. If "Require passcode on outgoing AirPlay request" is unchecked in the Apple iOS/iPadOS management tool, "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "AirPlay outgoing requests pairing password enforced", this is a finding.

   Fix

   Install a configuration profile to require the user to enter a password when connecting to an AirPlay-enabled device. Configuration Profile Key: forceAirPlayOutgoingRequestsPairingPassword

8. AIOS-27-010800 CAT III V-288406 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: not have any Family Members in Family Sharing.

   Maps to IA-5(13) via CCI-002007
   Check

   Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. At the top of the screen, if "Sign in to your iPhone" is listed, this requirement has been met. 3. If the user profile is signed into iCloud, tap the username. 4. Tap "Family Sharing". 5. Verify no accounts are listed other than the "Organizer". Note: The iPhone and iPad must be connected to the internet to conduct this validation procedure. Otherwise, the device will display the notice "Family information is not available", in which case configuration compliance cannot be determined. If accounts (names or email addresses) are listed under "FAMILY MEMBERS" on the iPhone and iPad, this is a finding.

   Fix

   The user must either remove all members from the Family Group on the iPhone and iPad or associate the device with an Apple ID that is not a member of a Family Group.

9. AIOS-27-011000 CAT III V-288408 · PP-MDF-994000

   Apple iOS/iPadOS 27 must implement the management setting: force Apple Watch wrist detection.

   Maps to CM-7 via CCI-000381
   Check

   Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Wrist detection enforced on Apple Watch" is enforced. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Wrist detection enforced on Apple Watch" is listed. If "Wrist detection enforced on Apple Watch" is not enforced in the Apple iOS/iPadOS management tool, or the restrictions policy on the iPhone and iPad does not list "Wrist detection enforced on Apple Watch", this is a finding.

   Fix

   Install a configuration profile to force Apple Watch wrist detection. Configuration Profile Key: forceWatchWristDetection

10. AIOS-27-011500 CAT III V-288413 · PP-MDF-994000

    Apple iOS/iPadOS 27 must not allow managed apps to write contacts to unmanaged contacts accounts.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow managed apps to write contacts to unmanaged contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps write to unmanaged contacts allowed" is not listed. If "Allow managed apps to write contacts to unmanaged contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Managed apps write to unmanaged contacts allowed", this is a finding.

    Fix

    Install a configuration profile to prevent managed apps from writing contacts to unmanaged contacts accounts. Configuration Profile Key: allowManagedToWriteUnmanagedContacts This payload can only be installed via an MDM.

11. AIOS-27-011600 CAT III V-288414 · PP-MDF-994000

    Apple iOS/iPadOS 27 must not allow unmanaged apps to read contacts from managed contacts accounts.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow unmanaged apps to read contacts from managed contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow unmanaged apps to read contacts from managed contacts accounts" is not listed. If "Allow unmanaged apps to read contacts from managed contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Allow unmanaged apps to read contacts from managed contacts accounts", this is a finding.

    Fix

    Install a configuration profile to prevent unmanaged apps from reading contacts from managed contacts accounts. Configuration Profile Key: allowunmanagedToReadManagedContacts This payload can only be installed via an MDM.

12. AIOS-27-012400 CAT III V-288422 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable "Find My Friends" in the "Find My" app.

    Maps to CM-6 via CCI-000366
    Check

    This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Find My Friends" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow Find My Friends" and "Allow modifying Find My Friends" are unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow Find My Friends" is not listed and "Changing Find My Friends settings not allowed" is listed. If "Allow Find My Friends" and "Allow modifying Find My Friends" are not disabled in the management tool, and on the Apple device "Allow Find My Friends" is listed and "Changing Find My Friends settings not allowed" is not listed, this is a finding.

    Fix

    Install a configuration profile to disable "Find My Friends" in the Find My app and "Allow modifying Find My Friends" in the management tool. This is a supervised-only control. Configuration Profile Key: allowFindMyFriends, allowFindMyFriendsModification

13. AIOS-27-012700 CAT III V-288425 · PP-MDF-994000

    The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.

    Maps to SC-28 via CCI-001199
    Check

    Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow sending diagnostic and usage data to Apple" is unchecked. Alternatively, verify the text "allowDiagnosticSubmission" appears in the configuration profile (.mobileconfig file). On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Diagnostic submission not allowed". Note: This setting also disables "Share With App Developers". If "Allow sending diagnostic and usage data to Apple" is checked in the iOS management tool, "allowDiagnosticSubmission" appears in the configuration profile, or the restrictions policy on the Apple iOS device from the Apple iOS management tool does not list "Diagnostic submission not allowed", this is a finding.

    Fix

    Install a configuration profile to disable sending diagnostic data to an organization other than DoW. Configuration Profile Key: allowDiagnosticSubmission

14. AIOS-27-014900 CAT III V-288444 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable AirPrint.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow AirPrint" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPrint not allowed" is listed. If AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow AirPrint". This is a supervised-only control. Configuration Profile Key: AllowAirPrint

15. AIOS-27-015000 CAT III V-288445 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow discovery of AirPrint printers using iBeacons" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow discovery of AirPrint printers using iBeacons" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Discovery of AirPrint printers using iBeacons not allowed" or "AirPrint not allowed" is listed. If "Discovery of AirPrint printers using iBeacons" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow discovery of AirPrint printers using iBeacons". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintiBeaconDiscovery

16. AIOS-27-015100 CAT III V-288446 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable AirPrint: Allow storage of AirPrint credentials in Keychain.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allow storage of AirPrint credentials in Keychain" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow storage of AirPrint credentials in Keychain" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Storage of AirPrint credentials in Keychain not allowed" or "AirPrint not allowed" is listed. If "Storage of AirPrint credentials in Keychain" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allow storage of AirPrint credentials in Keychain". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintCredentialsStorage

17. AIOS-27-015200 CAT III V-288447 · PP-MDF-994000

    Apple iOS/iPadOS 27 must allow the AirPrint feature: Disallow AirPrint to destinations with untrusted certificates.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Disallow AirPrint to destinations with untrusted certificates" is enabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Disallow AirPrint to destinations with untrusted certificates" is checked or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow AirPrint to destinations with untrusted certificates" is not listed or "AirPrint not allowed" is listed. If "Disallow AirPrint to destinations with untrusted certificates" is disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

    Fix

    Install a configuration profile to enable "Disallow AirPrint to destinations with untrusted certificates". This is a supervised-only control. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: forceAirPrintTrustedTLSRequirement

18. AIOS-27-015300 CAT III V-288448 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable Allowed Content Ratings (Movies).

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allowed Content Ratings (Movies)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Movie ratings" is set to "0" (disable all movies). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Movie ratings enforced" is listed. If "Movie ratings" is not set to "0" in the management tool, and Movie ratings are not enforced on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allowed Content Ratings (Movies)" (ratingMovies key value = 0). This is a supervised-only control. Configuration Profile Key: ratingMovies

19. AIOS-27-015400 CAT III V-288449 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable Allowed Content Ratings (TV Shows).

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm "Allowed Content Ratings (TV Shows)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "TV Shows ratings" is set to "0" (disable all TV Shows). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "TV show ratings enforced" is listed. If "TV show ratings" is not set to "0" in the management tool, and TV show ratings are not enforced on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable "Allowed Content Ratings (TV Shows)" (ratingTVShows key value = 0). This is a supervised-only control. Configuration Profile Key: ratingTVShows

20. AIOS-27-015500 CAT III V-288450 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Wand.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm the Apple Intelligence feature "Image Wand" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Wand" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Wand" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Wand" is not set to "No", this is a finding.

    Fix

    Install a configuration profile to disable the Apple Intelligence feature "Image Wand". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Wand" to "No" in the DDM configuration "Intelligence Settings".

21. AIOS-27-015600 CAT III V-288451 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Generation.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm the Apple Intelligence feature "Image Generation" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Playground" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Playground" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Playground" is not set to "No", this is a finding.

    Fix

    Install a configuration profile to disable the Apple Intelligence feature "Image Generation". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Playground" to "No" in the DDM configuration "Intelligence Settings".

22. AIOS-27-015700 CAT III V-288452 · PP-MDF-994000

    Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: generate new Genmoji.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm the Apple Intelligence feature "generate new Genmoji" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Genmoji" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Genmoji" is set to "No". If in the MDM server or iPhone/iPad "Allow Genmoji" is not set to "No", this is a finding.

    Fix

    Install a configuration profile to disable the Apple Intelligence feature "generate new Genmoji". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Genmoji" to "No" in the DDM configuration "Intelligence Settings".

23. AIOS-27-015900 CAT III V-288454 · PP-MDF-994000

    DoW Apple iOS/iPadOS 27 devices must disable FaceTime.

    Maps to CM-6 via CCI-000366
    Check

    This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow FaceTime" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "FaceTime not allowed" is listed. If "Allow FaceTime" is listed in the management tool or "FaceTime not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable FaceTime. This is a supervised-only control. Configuration Profile Key: allowVideoConferencing

24. AIOS-27-016000 CAT III V-288455 · PP-MDF-994000

    DoW Apple iOS/iPadOS 27 devices must disable eSIM transfers.

    Maps to CM-6 via CCI-000366
    Check

    Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow outgoing eSIM transfers" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Outgoing eSIM transfers not allowed" is listed. If the AO has not approved eSIM transfers and "Allow eSIM outgoing transfers" is listed in the management tool or "Outgoing eSIM transfers not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable the transfer of an eSIM from one DoW phone to another unless the service has been approved by the AO. This is a supervised-only control. Configuration Profile Key: allowESIMOutgoingTransfers

25. AIOS-27-016100 CAT III V-288456 · PP-MDF-994000

    DoW Apple iOS/iPadOS 27 devices must disable screenshots and screen recordings.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow screenshot and screen recording" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Screen capture not allowed" is listed. If "Allow screenshot and screen recording" is listed in the management tool or "Screen capture not allowed" is not listed on the Apple device, this is a finding.

    Fix

    Install a configuration profile to disable the screenshot and screen recording. Configuration Profile Key: allowScreenShot