Mobile STIGs

Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcodes" that the "Unique passcode requirement" value is set to "2" or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Unique passcode requirement" is listed as "2" or greater. If the MDM server or iOS or iPadOS device does not enforce a passcode reuse prohibition of at least two generations, this is a finding.

Install a DDM profile to enforce a passcode reuse prohibition of at least two generations (passcode history). In the MDM server, in the DDM configuration "Passcode", set "Unique passcode requirement" to "2" or greater.

Review configuration settings to confirm the device is set to require a passcode before use. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding.

Install a configuration profile to require a password to unlock the device. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes".

Review configuration settings to require a passcode to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding.

Install a configuration profile to require a password to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes".

Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and determine the most current version of iOS released by Apple. In the MDM management console, review the version of iOS installed on a sample of managed devices. This procedure will vary depending on the MDM product. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "About" and view the installed version of iOS. 4. Go back to the "General" screen. Tap "Software Update" and verify the following message is shown on the screen: "Your software is up to date." If the installed version of iOS on any reviewed iOS/iPadOS devices is not the latest released by Apple, this is a finding.

Install the latest release version of Apple iOS/iPadOS on all managed iOS devices.

Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. Review configuration settings to confirm iCloud Backup is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud backup" is unchecked. Alternatively, verify the text "allowCloudBackup " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "iCloud backup not allowed" is listed. If "Allow iCloud backup" is checked in the Apple iOS/iPadOS management tool, "allowCloudBackup" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud backup not allowed", this is a finding.

Install a configuration profile to disable iCloud backup. Configuration Profile Key: allowCloudBackup

Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow iCloud documents & data" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud documents & data" is unchecked. Alternatively, verify the text "allowCloudDocumentSync " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "Documents in the Cloud not allowed" is listed. Note: This also verifies that iCloud Drive and iCloud Photo Library are disabled. If "Allow iCloud documents & data" is checked in the Apple iOS/iPadOS management tool, "allowCloudDocumentSync " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Documents in the Cloud not allowed", this is a finding.

Install a configuration profile to disable iCloud documents and data. This is a supervised-only control. Configuration Profile Key: allowCloudDocumentSync

Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm iCloud keychain is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud keychain" is unchecked. Alternatively, verify the text "allowCloudKeychainSync" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Verify "iCloud Keychain not allowed" is listed. If "Allow iCloud keychain" is checked in the Apple iOS/iPadOS management tool, "allowCloudKeychainSync" appears in the configuration profile, or "iCloud Keychain not allowed" is not listed on the iPhone and iPad, this is a finding.

Install a configuration profile to disable iCloud keychain. This is a supervised-only control. Configuration Profile Key: allowCloudKeychainSync

Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Cloud Photo Library" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Cloud Photo Library" is unchecked. Alternatively, verify the text "allowCloudPhotoLibrary" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iCloud Photos not allowed" is listed. If "Allow Cloud Photo Library" is checked in the Apple iOS/iPadOS management tool, "allowCloudPhotoLibrary " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud Photos not allowed", this is a finding.

Install a configuration profile to disable Cloud Photo Library. This is a supervised-only control. Configuration Profile Key: allowCloudPhotoLibrary

Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Shared Stream" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Shared Stream" is unchecked. Alternatively, verify the text "allowSharedStream" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Shared Streams not allowed" is listed. If "AllowShared Photo Stream" is checked in the Apple iOS/iPadOS management tool, "allowSharedStream" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Shared Streams not allowed", this is a finding.

Install a configuration profile to disable "Allow Shared PhotoStream". This is a supervised-only control. Configuration Profile Key: allowSharedStream

Review configuration settings to confirm "Allow managed apps to store data in iCloud" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow managed apps to store data in iCloud" is unchecked. Alternatively, verify the text "allowManagedAppsCloudSync " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps cloud sync not allowed" is listed. If "Allow managed apps to store data in iCloud" is checked in the Apple iOS/iPadOS management tool, "allowManagedAppsCloudSync " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Managed apps cloud sync not allowed", this is a finding.

Install a configuration profile to prevent DoW applications from storing data in iCloud. Configuration Profile Key: allowManagedAppsCloudSync

Review configuration settings to confirm "Allow backup of enterprise books" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow backup of enterprise books" is unchecked. Alternatively, verify the text "allowEnterpriseBookBackup " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Backing up enterprise books not allowed" is listed. If "Allow backup of enterprise books" is checked in the Apple iOS/iPadOS management tool, "allowEnterpriseBookBackup " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Backing up enterprise books not allowed", this is a finding.

Install a configuration profile to prevent backup of enterprise books that could contain DoW sensitive information. Configuration Profile Key: allowEnterpriseBookBackup

Review configuration settings to confirm the minimum passcode length is six or more characters. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify the Declarative Device Management (DDM) configuration "Passcode" is set to "Minimum length" of "6" or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Minimum length" is listed as "6" or greater. If the minimum passcode length is less than six characters in the MDM server or on the iPhone and iPad, this is a finding.

Install a DDM profile to enforce a minimum passcode length value of six or greater. In the MDM server, in the DDM configuration "Passcode", set "Minimum length" to "6" or greater.

Review configuration settings to confirm simple passcodes are not allowed. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify that in the Declarative Device Management (DDM) configuration "Passcode", "Require Complex Passcode" is set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Require Complex Passcode" is set to "Yes". If "Require Complex Passcode" is not set to "Yes" in the MDM server or on the iPhone/iPad, this is a finding.

Install a DDM profile to disallow more than four sequential or repeating numbers or letters in the device unlock password. In the MDM server, in the DDM configuration "Passcode", set "Require Complex Passcode" to "Yes".

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, in the Declarative Device Management (DDM) configuration "Passcode", verify the sum of the values assigned to "Max grace period" and "Max inactivity" is between 1 and 15 minutes. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes. Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement. If the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the MDM server or on the iPhone/iPad, this is a finding.

Install a DDM profile to lock the device display after 15 minutes (or less) of inactivity. This is done by setting "Max grace period" and "Max inactivity" so the sum of their values is between 1 and 15 minutes. In the MDM server, in the DDM configuration "Passcode", set "Max grace period" and "Max inactivity" to a combined period of 15 minutes or less. For example, if "Max grace period" is set to "Immediately" and "Max inactivity" is set to "5 minutes", the requirement is met.

Review configuration settings to confirm that consecutive failed authentication attempts is set to 10 or fewer. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Maximum failed attempts" has been set to "10" or fewer. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Maximum failed attempts" is listed as "10" or fewer. If the "Maximum failed attempts" is more than 10 in the MDM server or on the iPhone and iPad, this is a finding.

Install a DDM profile to allow only 10 or fewer consecutive failed authentication attempts. In the MDM server, in the DDM configuration "Passcode", set "Maximum failed attempts" to "10" or fewer.

Review configuration settings to confirm "Allow Trusting New Enterprise App Authors" is disabled. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify "Allow Trusting New Enterprise App Authors" is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Trusting enterprise apps not allowed" is listed. If "Allow Trusting New Enterprise App Authors" is not disabled in the iOS/iPadOS management tool, or on the iPhone and iPad "Trusting enterprise apps not allowed" is not listed, this is a finding.

Install a configuration profile to disable "Allow Trusting New Enterprise App Authors". Configuration Profile Key: allowEnterpriseAppTrust

Verify no apps or app clips with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. This check procedure is performed on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool: 1. Verify the Declarative Device Management (DDM) configuration "Bundle ID" (BundleID) is configured and there are no apps with prohibited characteristics. 2. Verify the Restrictions "allowAppClips" is disabled. If DDM "Bundle ID" or Restrictions "allowAppClips" is not configured and contains apps with prohibited characteristics, this is a finding.

Install a DDM profile to enforce a list of approved apps (bundleID). Install a configuration profile to block app clips of prohibited apps (Configuration Key: allowAppClips). Ensure the allow list does not include apps with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system.

Review configuration settings to confirm that Siri is disabled on the Lock screen. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Siri Settings" that "Allow while locked" has been set to "No". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Siri Settings". 6. Verify "Allow while locked" is listed and set to "No". If in the MDM server or iPhone/iPad the DDM configuration "Siri Settings", "Allow while locked" has not been set to "No", this is a finding.

Install a DDM profile to disable Siri while the device is locked. In the MDM server, in the DDM configuration "Siri Settings", set "Allow while locked" to "No".

Review configuration settings to confirm the display of notifications when the device is locked has been disabled. This check procedure is performed on the Apple iOS/iPadOS management tool and mobile device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to disable Notifications preview. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "Disallow notification view in locked screen" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to disable showing notification view in locked screen, this is a finding.

Install a configuration profile to disable the display of notifications when the device is locked. Install a configuration profile to disable Notification Center from the device Lock screen. Configure in each installed managed app.

Review configuration settings to confirm "Show Today view in Lock screen" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Show Today view in Lock screen" is unchecked. Alternatively, verify the text "allowLockScreenTodayView" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "Profiles & Device Management" or Profiles". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Today view on lock screen not allowed" is present. If "Show Today view in Lock screen" is checked in the Apple iOS/iPadOS management tool, "allowLockScreenTodayView" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Today view on lock screen not allowed", this is a finding.

Install a configuration profile to disable "Show Today view in Lock screen" from the device Lock screen. Configuration Profile Key: allowLockScreenTodayView

Review configuration settings to confirm backup in management apps is disabled and "Encrypt local backup" is enabled in iTunes (for Windows computer) and in Finder on Mac. Note: iTunes Backup/Finder backup is implemented by the configuration policy rule "Force encrypted backups", which is included in AIOS-27-009900 and therefore not included in the procedure below. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify backing up app data is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Tap a managed app. 7. Verify "App data will not be backed up" is listed. Note: Steps 6 and 7 must be performed for each managed app. If backing up app data is not disabled in the Apple iOS/iPadOS management tool or "app data will not be backed up" is not listed for each managed app on the iPhone and iPad, this is a finding.

Install a configuration profile to disable backup of managed apps. Profiles must be configured on the MDM server for each managed app.

Review configuration settings to confirm "Allow documents from managed apps in unmanaged apps" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow documents from managed apps in unmanaged apps" is unchecked. Alternatively, verify the text "allowOpenFromManagedToUnmanaged" appears in the configuration profile (.mobileconfig file). On the iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Opening documents from managed to unmanaged apps not allowed" is listed. If "Allow documents from managed apps in unmanaged apps" is checked in the iOS management tool, "allowOpenFromManagedToUnmanaged" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Opening documents from managed to unmanaged apps not allowed", this is a finding.

Install a configuration profile to prevent non-DoW applications from accessing DoW data. Configuration Profile Key: allowOpenFromManagedToUnmanaged

Verify multiuser mode (shared iPad) is disabled in the MDM console for iPadOS devices. This requirement is not applicable for iOS devices. If multiuser mode is not disabled in the MDM console for iPadOS devices, this is a finding.

Disable multiuser mode (shared iPad) in the MDM console for iPadOS devices.

Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding.

Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app.

Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding.

Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app.

Review configuration settings to confirm "Force encrypted backups" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Encrypt local backup" is checked. Alternatively, verify the text "forceEncryptedBackup" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Encrypt backups enforced" is listed. If "Encrypt local backup" is unchecked in the Apple iOS/iPadOS management tool, "forceEncryptedBackup" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Encrypt backups enforced", this is a finding.

Install a configuration profile to force encrypted backups to iCloud. Configuration Profile Key: forceEncryptedBackup

Review configuration settings to confirm "Allow MailDrop" is disabled. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow MailDrop" is not checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Mail". 6. Tap the mail account. 7. Verify "Mail Drop Enabled" is set to "No". If "Allow MailDrop" is not disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Mail Drop Enabled" as "Yes", this is a finding.

Configure the Apple iOS/iPadOS configuration profile to disable "Allow MailDrop".

Review configuration settings to confirm "Use SSL" for the Exchange account is enabled for incoming mail. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Use SSL for incoming mail" is checked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "SSL for incoming mail" is set to "Yes". If "Use SSL for incoming mail" is unchecked in the Apple iOS/iPadOS management tool or the Exchange policy on the iPhone and iPad has "SSL for incoming mail" set to "No", this is a finding.

Install a configuration profile to use SSL for Exchange ActiveSync incoming mail. Configuration Profile Key: IncomingMailServerUseSSL

Review configuration settings to confirm "Allow messages to be moved" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow messages to be moved" is unchecked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "Prevent Move" is set to "Yes". If "Allow messages to be moved" is checked in the Apple iOS/iPadOS management tool, or the Exchange policy on the iPhone and iPad has "Prevent Move" set to "No", this is a finding.

Install a configuration profile to prevent Exchange messages from being moved or forwarded between email accounts. Configuration Profile Key: PreventMove

Review configuration settings to confirm "Treat AirDrop as an unmanaged destination" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Treat AirDrop as unmanaged destination" is checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Sharing managed documents using AirDrop not allowed" is listed. If "Treat AirDrop as unmanaged destination" is disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad does not list "Sharing managed documents using AirDrop not allowed", this is a finding.

Install a configuration profile to treat AirDrop as an unmanaged destination. Configuration Profile Key: forceAirDropUnmanaged

Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "Privacy & Security". 3. Tap "Location Services". 4. If the authorizing official (AO) has not approved use of personal iCloud accounts on the device, verify "Share My Location" is grayed out (cannot be selected). 5. If the AO has approved the use of personal iCloud accounts on the device, tap "Share My Location". 6. Verify "Share My Location" is off. If "Share My Location" is not grayed out (cannot be selected) when the AO has not approved use of personal iCloud accounts on the device, this is a finding. If "Share My Location" is toggled to the right and appears green on the iPhone and iPad when the AO has approved the use of personal iCloud accounts, this is a finding.

The user must configure Apple iOS/iPadOS to disable location sharing through iCloud.

Review a sample of site User Agreements for iOS device users or similar training records and training course content. Verify iPhone and iPad users have completed required training. If any iPhone/iPad user has not completed required training, this is a finding.

Have all iPhone and iPad users complete training on the following topics. Users must acknowledge receipt of training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications, including applications using global positioning system (GPS) tracking. - Must ensure no DoW data is saved in an unmanaged app or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn in, or reassignment, ensure a factory data reset is performed prior to device handoff. Follow mobility service provider decommissioning procedures as applicable. - How to configure the following UBE controls (users must configure the control) and other controls on the iPhone and iPad: **Remove Family Sharing. **Disable Shared Location. **Disable Wi-Fi Assist. **Use AirPrint only with AO-approved printers and print servers. **Turn off "Apps" under "Automatic Downloads" in the "iTunes & App Store" section of the Settings app on the iPhone and iPad. **Secure use of Calendar Alarm. **Do not configure a DoW network (work) VPN profile on any third-party unmanaged VPN app. **Disable iPhone and iPad radios using controls under "Settings" instead of "Control Center". - AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.). - Do not accept connection requests from nearby devices (via AirDrop or Wi-Fi Aware).

Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the DoW Configuration Profile from the Apple iOS/iPadOS management tool. 5. Tap "Apps". 6. Verify a photo capture and management app is listed. 7. Verify the app is managed and stores photos as managed data. If a managed photo capture and management app is not installed on the iPhone and iPad and/or the app is not managed and does not store photos as managed data, this is a finding. Note: The recommended app is Microsoft OneDrive. (Refer to the DoW Mobility Unclassified Capability [DMUC] "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.) Note: If the Apple device camera is disabled (refer to AIOS-27-016200), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app.

Install a managed photos app to take and manage work-related photos. Note: The recommended app is Microsoft OneDrive. (Refer to the DoW Mobility Unclassified Capability [DMUC] "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.) Note: If the Apple device camera is disabled (refer to AIOS-27-016200), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app. Note: The app must be managed and must store photos as managed data.

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB Restricted Mode" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB Restricted Mode" is checked (set to "True"). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify there is no listing for "USB Accessories while locked allowed". If "Allow USB Restricted Mode" is not enabled in the management tool and a restriction is listed in the profile on the Apple device, this is a finding. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: "Allow USB Restricted Mode" may be called "Allow USB accessories while device is locked" in some MDM consoles. The required logic is to disable USB accessory connections when the device is locked.

Install a configuration profile to configure "Allow USB Restricted Mode" to "True" in the management tool. This is a supervised-only control. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: This control is called "Allow USB accessories while device is locked" in Apple Configurator, and the control logic is opposite to what is listed here. Ensure the MDM policy rule is set correctly (to disable USB accessory connections when the device is locked). Configuration Profile Key: allowUSBRestrictedMode

Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirDrop" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirDrop not allowed" is listed. If "AirDrop not allowed" is not listed in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable the AllowAirDrop control in the management tool. This is a supervised-only control. Configuration Profile Key: allowAirDrop

Review configuration settings to confirm "Allow Paired Watch" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Paired Watch" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Paired Apple Watch not allowed" is listed. If "Paired Apple Watch not allowed" is not listed both in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable the Apple Watch control in the management tool. This is a supervised-only control. Configuration Profile Key: allowPairedWatch

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password AutoFill is not allowed" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password AutoFill is not allowed" is unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password AutoFill is not allowed" is listed. If "Password AutoFill is not allowed" is not enabled in the iOS/iPadOS management tool and on the Apple device, this is a finding.

Install a configuration profile to disable allow Password AutoFill in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordAutoFill

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow setting up new nearby devices" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow proximity setup to a new device" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity setup to a new device is not allowed" is listed. If "Allow proximity setup to a new device" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity setup to a new device is not allowed" is not listed, this is a finding.

Install a configuration profile to disable allow setting up new nearby devices in the management tool. This is a supervised-only control. Configuration Profile Key: allowProximitySetupToNewDevice

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Password Proximity Requests" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Password Proximity Requests" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity password requests not allowed" is listed. If "Allow Password Proximity Requests" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity password requests not allowed" is not listed, this is a finding.

Install a configuration profile to disable "allow password proximity requests" in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordProximityRequests

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password Sharing is not allowed" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password Sharing is not allowed" is checked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password Sharing is not allowed" is listed. If "Password Sharing is not allowed" is not enabled in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable allow password proximity sharing in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordSharing

Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify all managed Apple devices are supervised (verification procedure will vary by MDM product). Note: If the Apple device is not managed by an MDM and supervision is set up via Apple Configurator, this procedure is not applicable. On the iPhone and iPad: 1. Open the Settings app. 2. Verify a message similar to the following appears on the screen: "This iPad is supervised by (name of site DoW mobile service provider)." If site-managed iOS/iPadOS devices are not supervised, this is a finding.

Use one of the following methods to supervise iOS and iPadOS devices managed by the DoW mobile service provider. Method 1: 1. Register all current and new iOS and iPadOS devices in the DoW mobile service provider's Automated Device Management/Apple Business Manager (ABM) account. 2. Enable supervision of managed iOS/iPadOS devices in the MDM. Method 2: 1. Configure each iOS/iPadOS device using the Apple Configurator tool for Supervision. 2. This method is usually only appropriate when MDM management of the DoW Apple device is not appropriate or an older device cannot be registered in ABM.

This requirement is not applicable if the AO has approved the use of USB drives to load files to Apple devices. The approval must be in writing and include which USB storage devices are approved for use. If the AO has not approved the use of USB drives to load files to Apple devices, use the following procedures to verify compliance. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB drive access in Files app" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB drive access in Files app" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "USB drives not accessible in Files app" is listed. If "Allow USB drive access in Files app" is not disabled in the management tool and "USB drives not accessible in Files app" is not listed in the Restrictions profile on the Apple device, this is a finding.

If the AO has not approved the use of USB drives to load files to Apple devices, install a configuration profile to disable "Allow USB drive access in Files app". Configuration Profile Key: allowFilesUSBDriveAccess

Review configuration settings to confirm configuration profiles are not removable. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. The procedures below assume the site is not enrolled in Apple's Automatic Device Enrollment and are not applicable to devices under MDM management. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS management tool, verify "Security" is set to "Never" and "Automatically Remove Profile" is set to "Never". On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap each Configuration Profile from the Apple iOS management tool that contains the restrictions for the device. 5. Verify the "Remove Profile" button is not present. If on the Apple iOS management tool or the iOS device the "Remove Profile" button is available on the configuration profile, this is a finding.

Configure the Apple iOS configuration profile so that it can never be removed. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. When using Apple Configurator, under "General Security", configure "Security" to "Never" and "Automatically Remove Profile" to "Never". Configuration Profile Key: PayloadRemovalDisallowed

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow network drive access in Files access" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Network drives not accessible in Files app" is listed. If "Allow network drive access in Files access" is not disabled in the management tool and "Network drives not accessible in Files app" is not listed in Profile Restrictions on the Apple device, this is a finding.

Install a configuration profile to disable "Allow network drive access in Files access". Configuration Profile Key: allowFilesNetworkDriveAccess

Review configuration settings to confirm connections to Siri servers for the purpose of dictation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Intelligence Settings" that "Force On-Device Only Dictation" is set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Force On-Device Only Dictation" is listed and set to "Yes". If in the MDM server or the iPhone/iPad "Force On-Device Only Dictation" is not set to "Yes", this is a finding.

Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of dictation. This is a supervised-only control. In the MDM server, set "Force On-Device Only Dictation" to "Yes" in the DDM configuration "Intelligence Settings".

Review configuration settings to confirm connections to Siri servers for the purpose of translation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Intelligence Settings" that "Force On-Device Only Translation" to set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Force On-Device Only Translation" is listed and set to "Yes". If in the MDM server or iPhone/iPad "Force On-Device Only Translation" is not set to "Yes", this is a finding.

Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of translation. In the MDM server, set "Force On-Device Only Translation" to "Yes" in the DDM category "Intelligence Settings".

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Require managed pasteboard" is set to "True". If "Require managed pasteboard" is not set to "True", this is a finding.

Configure the Apple iOS configuration profile to disable copy/paste of data from managed to unmanaged applications. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Require managed pasteboard" to "True". Configuration Profile Key: requireManagedPasteboard

Verify DoW intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DoW intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "More Details". 6. Verify the DoW intermediate and root certificates are listed. If DoW intermediate and root certificates are not installed on the Apple device, this is a finding.

Install DoW intermediate and root certificates on managed mobile devices using the MDM.

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow auto unlock" is not checked. If Allow auto unlock is enabled, this is a finding.

If the AO has not approved the use of Apple Watch with DoW-owned iPhones, configure the Apple iOS configuration profile to disable "Allow auto unlock". This is a supervised-only control. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Allow auto unlock" to "False". Configuration Profile Key: allowAutoUnlock

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow marketplace app installation" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Marketplace app installation not allowed" is listed. If "Marketplace app installation" is not disabled in the management tool, this is a finding.

Install a configuration profile to disable the installation of alternative marketplace apps. This is a supervised-only control. Configuration Profile Key: allowMarketplaceAppInstallation

This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow app installation from website" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Web app distribution not allowed" is listed. If "Allow app installation from website" is not disabled in the management tool, or on the Apple device "Web app distribution not allowed" is not listed, this is a finding.

Install a configuration profile to disable app installation from a website. Configuration Profile Key: allowWebDistributionAppInstallation

This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Preserve eSIM content when device is erased" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Preserve eSIM content when device is erased" is not listed. If "Preserve eSIM content when device is erased" is not disabled in the management tool, or on the Apple device "Preserve eSIM content when device is erased" is listed, this is a finding.

Install a configuration profile to delete eSIM content when the device is erased. Configuration Profile Key: forcePreserveESIMOnErase

Review configuration settings to confirm third-party AI app connections to Apple Intelligence are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the DDM configuration "External Intelligence Settings" that "Allow Integrations" and "Allow Sign In" are both set to "No". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "External Intelligence Settings". 6. Verify "Allow Integrations" and "Allow Sign In" are both set to "No". If in the MDM server or iPhone/iPad both "Allow Integrations" and "Allow Sign In" are not set to "Yes", this is a finding.

Install a configuration profile to disable all third-party AI app connections for Apple Intelligence. In the MDM server, set both "Allow Integrations" and "Allow Sign In" to "No" in the Declarative Device Management (DDM) configuration "External Intelligence Settings".

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow installing configuration profiles (supervised only)" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Installing configuration profiles not allowed" is listed. If "Allow installing configuration profiles" is not disabled in the management tool, or on the Apple device "Installing configuration profiles not allowed" is not listed, this is a finding.

Install a configuration profile to disable the installation of new configuration profiles. This will block the download and installation of beta iOS and iPadOS updates. This is a supervised-only control. Configuration Profile Key: allowUIConfigurationProfileInstallation

This check procedure is performed on the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Apps to be hidden" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "Apps". 3. At the bottom of the list of Apps, tap "Hidden Apps". 4. Verify no hidden apps are listed. If "Allow Apps to be hidden" is not disabled in the management tool or hidden apps are installed on enterprise iPhones and iPads, this is a finding.

Install a configuration profile to disable hiding apps on iPhones and iPads. Configuration Profile Key: allowAppsToBeHidden

This check procedure is performed on the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow call recording" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "Apps". 3. Tap "Phone". 4. Verify "Audio Call Recording" is not shown. If "Allow Call Recording" is not disabled in the management tool or "Audio Call Recording" is available in Settings on the iPhone, this is a finding.

Install a configuration profile to disable recording cellphone calls. Configuration Profile Key: allowCallRecording

This check procedure is performed on the device management tool and iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow iPhone Mirroring (supervised only)" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iPhone Mirroring not allowed" is listed. If "Allow iPhone Mirroring" is not disabled in the management tool, or "iPhone Mirroring not allowed" is not listed on the iPhone, this is a finding.

Install a configuration profile to disable iPhone Mirroring on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneMirroring

Review configuration settings to confirm "Allow Erase All Content and Settings" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow erase all content and settings" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Erase content and settings not allowed" is listed. If "Allow erase all content and settings" is not disabled in the management tool, or on the Apple device "Erase content and settings not allowed" is not listed, this is a finding.

Install a configuration profile to disable "Allow Erase All Content and Settings". This is a supervised-only control. Configuration Profile Key: allowEraseContentAndSettings

Review configuration settings to confirm "Allow automatic app downloads" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow automatic app downloads" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Automatic downloading apps not allowed" is listed. If "Automatic downloading apps" is not disabled in the management tool, or on the Apple device "Automatic downloading apps not allowed" is not listed, this is a finding.

Install a configuration profile to disable "Allow automatic app downloads". This is a supervised-only control. Configuration Profile Key: allowAutomaticAppDownloads

Review configuration settings to confirm "Allow host pairing" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow host pairing" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Pairing with iTunes not allowed" is listed. If "Host pairing" is not disabled in the management tool, or on the Apple device "Pairing with iTunes not allowed" is not listed, this is a finding. Note: Some applications used to remove iPhone and iPad data to meet the DoW data retention policy require that host pairing be enabled. Host pairing may be temporarily enabled for this purpose only, with authorizing official (AO) approval.

Install a configuration profile to disable "Allow host pairing". This is a supervised-only control. Configuration Profile Key: allowHostPairing Note: Some applications used to remove iPhone and iPad data to meet the DoW data retention policy require that host pairing be enabled. Host pairing may be temporarily enabled for this purpose only with AO approval.

Confirm an MTD app is installed on managed iPhones and iPads. This check procedure is performed on both the device management tool and the iPhone and iPad device. In the iOS/iPadOS management tool, verify an MTD app is listed as a managed app being deployed to site-managed devices. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Verify an MTD app is listed. If an MTD app is not installed on the device, this is a finding.

Deploy a site-approved MTD app via the MDM server to managed iPhones and iPads.

Determine if the site AO has approved the use of Apple device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding (if the AO has not approved the use of Apple device cameras). If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Camera" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Camera not allowed" is listed. If the AO has not approved Apple device camera use and "Allow camera" is listed in the management tool and "Camera not allowed" is not listed on the Apple device, this is a finding.

If the AO has not approved the use of Apple device camera, install a configuration profile to disable camera use. This is a supervised-only control. Configuration Profile Key: allowCamera

Confirm required Wi-Fi Aware procedures have been implemented. 1. Verify site personal that have site-managed iPhones and iPads have completed required training (AIOS-27-011100). 2. Verify the site reviewed all managed iOS/iPadOS apps installed on site-managed iPhones and iPads for Wi-Fi Aware support and removed all apps that support Wi-Fi Aware. Discuss with the information system security officer (ISSO)/information system security manager (ISSM). If the site also manages the deployment of unmanaged apps on site-managed iPhones and iPads, verify unmanaged apps were also reviewed. 3. Review site app vetting procedures and verify they include review of Wi-Fi Aware capabilities in all apps. Verify apps with Wi-Fi Aware capability are disapproved for use. If the site has not reviewed current managed apps for Wi-Fi Aware capabilities or did not remove Wi-Fi Aware-capable apps, this is a finding. If the site app vetting procedures do not include a review of Wi-Fi Aware capabilities in all apps or disapprove apps with Wi-Fi Aware capability, this is a finding.

Remove Wi-Fi Aware-capable apps on site-managed Apple iOS/iPadOS 27 devices. Follow these steps to implement this control: 1. Train all users to not accept connection requests from nearby devices. This requirement is met by AIOS-27-011100. 2a. Review all MDM managed apps deployed to site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. Note: At the current time, there is no management API/key to disable Wi-Fi Aware on Apple devices. 2b. If a site manages unmanaged apps on site iPhones and iPads, review all unmanaged apps deployed on site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. 3a. For managed apps being reviewed for approval, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads. 3b. If a site manages unmanaged apps on site iPhones and iPads, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads.

On the mobile device, try to browse unauthorized AI URLs. Examples to input: chatgpt.com, claude.ai, gemini.google.com, v0.dev. Verify the unauthorized AI websites cannot be reached. If the iPhone/iPad has not been configured to disable web-based AI interactions, this is a finding.

Configure the Apple iOS/iPadOS 27 device to disable web-based AI interactions. ***Method 1: 1. In the MDM server, navigate to the iOS/iPadOS Device Configuration Profiles. 2. Locate the Web Content filter payload. 3. Select the Blacklist (or "Never Allow" or Blocklist") option. 4. Enter specific domain names of AI websites to be blocked, e.g., chatgpt.com, claude.ai, gemini.google.com, v0.dev. 5. Deploy the profile to managed devices. This prevents Safari, Chrome, and third-party browsers from loading the listed URLs. ***Method 2: Chrome-Specific URL Policies If the site manages Chrome at the enterprise level, direct Chrome policies can be pushed to restrict browsing. 1. Navigate to the MDM server Web Content Filter settings. 2. Select Google Chrome for iOS. 3. Apply the URLBlocklist policy. 4. Enter the AI website domains in the policy payload to block them within the Chrome app exclusively.

Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DoW network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DoW network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DoW network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement.

If a third-party unmanaged VPN app is installed on the iOS 27 device, do not configure the VPN app with a DoW network VPN profile.

The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Determine which method is used at the iOS device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several iOS device users and verify the agreement includes the required DoW warning banner text. Validation Procedure for Method #2: In the Apple iOS/iPadOS management tool, verify a Lock Screen Message payload has been installed on each managed device. The LockScreenFootnote string should include required text. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed, or for Method #2, the DoW warning banner text is not set as the lock screen footnote, this is a finding.

Configure the DoW warning banner by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iOS device user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Configuration Profile Key: LockScreenFootnote

Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Force limited ad tracking" is checked. Alternatively, verify the text "forceLimitAdTracking" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Requests to track from apps not allowed" is present. If "limited ad tracking enforced" is missing in the Apple iOS/iPadOS management tool, "forceLimitAdTracking" does not appear in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Requests to track from apps not allowed", this is a finding.

Install a configuration profile to limit advertisers' ability to track the user's web browsing preferences. Configuration Profile Key: forceLimitAdTracking

Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Enable autofill" is unchecked. Alternatively, verify the text "safariAllowAutoFill" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Auto-fill in Safari not allowed" is present. If "Enable autofill" is checked in the Apple iOS/iPadOS management tool, "safariAllowAutoFill" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Auto-fill in Safari not allowed", this is a finding.

Install a configuration profile to disable the AutoFill capability in the Safari app. Configuration Profile Key: safariAllowAutoFill

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Handoff" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Handoff" is unchecked. Alternatively, verify the text "allowActivityContinuation " appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Handoff not allowed" is listed. If "Allow Handoff" is checked in the Apple iOS/iPadOS management tool, "allowActivityContinuation " appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Handoff not allowed", this is a finding.

Install a configuration profile to disable continuation of activities among devices and workstations. This is a supervised-only control. Configuration Profile Key: allowActivityContinuation

Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check procedure is performed only on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "iPhone Widget on Mac" is unchecked. If "Allow iPhone Widget on Mac" is checked in the Apple iOS/iPadOS management tool, this is a finding.

Install a configuration profile to disable the installation of iPhone widgets on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneWidgetsOnMac

Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Require passcode on outgoing AirPlay request" is checked. Alternatively, verify the text "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPlay outgoing requests pairing password enforced" is listed. If "Require passcode on outgoing AirPlay request" is unchecked in the Apple iOS/iPadOS management tool, "forceAirPlayOutgoingRequestsPairingPassword" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "AirPlay outgoing requests pairing password enforced", this is a finding.

Install a configuration profile to require the user to enter a password when connecting to an AirPlay-enabled device. Configuration Profile Key: forceAirPlayOutgoingRequestsPairingPassword

Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. At the top of the screen, if "Sign in to your iPhone" is listed, this requirement has been met. 3. If the user profile is signed into iCloud, tap the username. 4. Tap "Family Sharing". 5. Verify no accounts are listed other than the "Organizer". Note: The iPhone and iPad must be connected to the internet to conduct this validation procedure. Otherwise, the device will display the notice "Family information is not available", in which case configuration compliance cannot be determined. If accounts (names or email addresses) are listed under "FAMILY MEMBERS" on the iPhone and iPad, this is a finding.

The user must either remove all members from the Family Group on the iPhone and iPad or associate the device with an Apple ID that is not a member of a Family Group.

Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Wrist detection enforced on Apple Watch" is enforced. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Wrist detection enforced on Apple Watch" is listed. If "Wrist detection enforced on Apple Watch" is not enforced in the Apple iOS/iPadOS management tool, or the restrictions policy on the iPhone and iPad does not list "Wrist detection enforced on Apple Watch", this is a finding.

Install a configuration profile to force Apple Watch wrist detection. Configuration Profile Key: forceWatchWristDetection

Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow managed apps to write contacts to unmanaged contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps write to unmanaged contacts allowed" is not listed. If "Allow managed apps to write contacts to unmanaged contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Managed apps write to unmanaged contacts allowed", this is a finding.

Install a configuration profile to prevent managed apps from writing contacts to unmanaged contacts accounts. Configuration Profile Key: allowManagedToWriteUnmanagedContacts This payload can only be installed via an MDM.

Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow unmanaged apps to read contacts from managed contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow unmanaged apps to read contacts from managed contacts accounts" is not listed. If "Allow unmanaged apps to read contacts from managed contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Allow unmanaged apps to read contacts from managed contacts accounts", this is a finding.

Install a configuration profile to prevent unmanaged apps from reading contacts from managed contacts accounts. Configuration Profile Key: allowunmanagedToReadManagedContacts This payload can only be installed via an MDM.

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Find My Friends" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow Find My Friends" and "Allow modifying Find My Friends" are unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow Find My Friends" is not listed and "Changing Find My Friends settings not allowed" is listed. If "Allow Find My Friends" and "Allow modifying Find My Friends" are not disabled in the management tool, and on the Apple device "Allow Find My Friends" is listed and "Changing Find My Friends settings not allowed" is not listed, this is a finding.

Install a configuration profile to disable "Find My Friends" in the Find My app and "Allow modifying Find My Friends" in the management tool. This is a supervised-only control. Configuration Profile Key: allowFindMyFriends, allowFindMyFriendsModification

Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow sending diagnostic and usage data to Apple" is unchecked. Alternatively, verify the text "allowDiagnosticSubmission" appears in the configuration profile (.mobileconfig file). On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Diagnostic submission not allowed". Note: This setting also disables "Share With App Developers". If "Allow sending diagnostic and usage data to Apple" is checked in the iOS management tool, "allowDiagnosticSubmission" appears in the configuration profile, or the restrictions policy on the Apple iOS device from the Apple iOS management tool does not list "Diagnostic submission not allowed", this is a finding.

Install a configuration profile to disable sending diagnostic data to an organization other than DoW. Configuration Profile Key: allowDiagnosticSubmission

Review configuration settings to confirm "Allow AirPrint" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPrint not allowed" is listed. If AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable "Allow AirPrint". This is a supervised-only control. Configuration Profile Key: AllowAirPrint

Review configuration settings to confirm "Allow discovery of AirPrint printers using iBeacons" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow discovery of AirPrint printers using iBeacons" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Discovery of AirPrint printers using iBeacons not allowed" or "AirPrint not allowed" is listed. If "Discovery of AirPrint printers using iBeacons" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable "Allow discovery of AirPrint printers using iBeacons". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintiBeaconDiscovery

Review configuration settings to confirm "Allow storage of AirPrint credentials in Keychain" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow storage of AirPrint credentials in Keychain" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Storage of AirPrint credentials in Keychain not allowed" or "AirPrint not allowed" is listed. If "Storage of AirPrint credentials in Keychain" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

Install a configuration profile to disable "Allow storage of AirPrint credentials in Keychain". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintCredentialsStorage

Review configuration settings to confirm "Disallow AirPrint to destinations with untrusted certificates" is enabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Disallow AirPrint to destinations with untrusted certificates" is checked or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow AirPrint to destinations with untrusted certificates" is not listed or "AirPrint not allowed" is listed. If "Disallow AirPrint to destinations with untrusted certificates" is disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding.

Install a configuration profile to enable "Disallow AirPrint to destinations with untrusted certificates". This is a supervised-only control. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: forceAirPrintTrustedTLSRequirement

Review configuration settings to confirm "Allowed Content Ratings (Movies)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Movie ratings" is set to "0" (disable all movies). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Movie ratings enforced" is listed. If "Movie ratings" is not set to "0" in the management tool, and Movie ratings are not enforced on the Apple device, this is a finding.

Install a configuration profile to disable "Allowed Content Ratings (Movies)" (ratingMovies key value = 0). This is a supervised-only control. Configuration Profile Key: ratingMovies

Review configuration settings to confirm "Allowed Content Ratings (TV Shows)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "TV Shows ratings" is set to "0" (disable all TV Shows). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "TV show ratings enforced" is listed. If "TV show ratings" is not set to "0" in the management tool, and TV show ratings are not enforced on the Apple device, this is a finding.

Install a configuration profile to disable "Allowed Content Ratings (TV Shows)" (ratingTVShows key value = 0). This is a supervised-only control. Configuration Profile Key: ratingTVShows

Review configuration settings to confirm the Apple Intelligence feature "Image Wand" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Wand" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Wand" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Wand" is not set to "No", this is a finding.

Install a configuration profile to disable the Apple Intelligence feature "Image Wand". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Wand" to "No" in the DDM configuration "Intelligence Settings".

Review configuration settings to confirm the Apple Intelligence feature "Image Generation" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Playground" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Playground" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Playground" is not set to "No", this is a finding.

Install a configuration profile to disable the Apple Intelligence feature "Image Generation". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Playground" to "No" in the DDM configuration "Intelligence Settings".

Review configuration settings to confirm the Apple Intelligence feature "generate new Genmoji" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Genmoji" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Genmoji" is set to "No". If in the MDM server or iPhone/iPad "Allow Genmoji" is not set to "No", this is a finding.

Install a configuration profile to disable the Apple Intelligence feature "generate new Genmoji". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Genmoji" to "No" in the DDM configuration "Intelligence Settings".

This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow FaceTime" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "FaceTime not allowed" is listed. If "Allow FaceTime" is listed in the management tool or "FaceTime not allowed" is not listed on the Apple device, this is a finding.

Install a configuration profile to disable FaceTime. This is a supervised-only control. Configuration Profile Key: allowVideoConferencing

Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow outgoing eSIM transfers" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Outgoing eSIM transfers not allowed" is listed. If the AO has not approved eSIM transfers and "Allow eSIM outgoing transfers" is listed in the management tool or "Outgoing eSIM transfers not allowed" is not listed on the Apple device, this is a finding.

Install a configuration profile to disable the transfer of an eSIM from one DoW phone to another unless the service has been approved by the AO. This is a supervised-only control. Configuration Profile Key: allowESIMOutgoingTransfers

Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow screenshot and screen recording" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Screen capture not allowed" is listed. If "Allow screenshot and screen recording" is listed in the management tool or "Screen capture not allowed" is not listed on the Apple device, this is a finding.

Install a configuration profile to disable the screenshot and screen recording. Configuration Profile Key: allowScreenShot