AIOS-16-001000 - Apple iOS/iPadOS 16 must allow the Administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: other methods] - MDM to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].

800-53|AC-17b.

800-53|CM-6(1)

800-53|CM-6b.

CAT|III

CCI|CCI-000066

CCI|CCI-000366

CCI|CCI-000370

Rule-ID|SV-254578r959010_rule

STIG-ID|AIOS-16-001000

Vuln-ID|V-254578

AIOS-16-003000 - Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud) - iCloud.

800-53|SC-4

CAT|II

CCI|CCI-001090

Rule-ID|SV-254579r959010_rule

STIG-ID|AIOS-16-003000

Vuln-ID|V-254579

AIOS-16-003200 - Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud document and data synchronization) - iCloud document and data synchronization.

800-53|AC-20(2)

CCI|CCI-000097

Rule-ID|SV-254580r959010_rule

STIG-ID|AIOS-16-003200

Vuln-ID|V-254580

AIOS-16-003300 - Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud Keychain) - iCloud Keychain.

Rule-ID|SV-254581r959010_rule

STIG-ID|AIOS-16-003300

Vuln-ID|V-254581

AIOS-16-003400 - Apple iOS/iPadOS 16 must not allow backup to remote systems (My Photo Stream) - My Photo Stream.

Rule-ID|SV-254582r959010_rule

STIG-ID|AIOS-16-003400

Vuln-ID|V-254582

AIOS-16-003500 - Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Photo Streams) - iCloud Photo Sharing, also known as Shared Photo Streams.

Rule-ID|SV-254583r959010_rule

STIG-ID|AIOS-16-003500

Vuln-ID|V-254583

AIOS-16-003600 - Apple iOS/iPadOS 16 must not allow backup to remote systems (managed applications data stored in iCloud) - managed applications data stored in iCloud.

Rule-ID|SV-254584r959010_rule

STIG-ID|AIOS-16-003600

Vuln-ID|V-254584

AIOS-16-003700 - Apple iOS/iPadOS 16 must not allow backup to remote systems (enterprise books) - enterprise books.

800-53|AC-2a.

CCI|CCI-002110

Rule-ID|SV-254585r959010_rule

STIG-ID|AIOS-16-003700

Vuln-ID|V-254585

AIOS-16-004900 - Apple iOS/iPadOS 16 must [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.

800-53|MP-6(3)

CCI|CCI-001033

Rule-ID|SV-254586r959010_rule

STIG-ID|AIOS-16-004900

Vuln-ID|V-254586

AIOS-16-005000 - Apple iOS/iPadOS 16 must [selection: remove Enterprise application, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM - any nonfactory-installed application] upon unenrollment from MDM.

Rule-ID|SV-254587r959010_rule

STIG-ID|AIOS-16-005000

Vuln-ID|V-254587

AIOS-16-006500 - Apple iOS/iPadOS 16 must be configured to enforce a minimum password length of six characters.

800-53|IA-5(1)(a)

CCI|CCI-004066

Rule-ID|SV-254588r1015678_rule

STIG-ID|AIOS-16-006500

Vuln-ID|V-254588

AIOS-16-006600 - Apple iOS/iPadOS 16 must be configured to not allow passwords that include more than four repeating or sequential characters.

Rule-ID|SV-254589r959010_rule

STIG-ID|AIOS-16-006600

Vuln-ID|V-254589

AIOS-16-006700 - Apple iOS/iPadOS 16 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.

800-53|AC-11a.

CCI|CCI-000057

Rule-ID|SV-254590r958402_rule

STIG-ID|AIOS-16-006700

Vuln-ID|V-254590

AIOS-16-006800 - Apple iOS/iPadOS 16 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

Rule-ID|SV-254591r958402_rule

STIG-ID|AIOS-16-006800

Vuln-ID|V-254591

AIOS-16-006900 - Apple iOS/iPadOS 16 must be configured to not allow more than 10 consecutive failed authentication attempts.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-254592r958388_rule

STIG-ID|AIOS-16-006900

Vuln-ID|V-254592

AIOS-16-007000 - Apple iOS/iPadOS 16 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoD-approved commercial app repository, MDM server, mobile application store].

Rule-ID|SV-254593r959010_rule

STIG-ID|AIOS-16-007000

Vuln-ID|V-254593

AIOS-16-007200 - Apple iOS/iPadOS 16 must not include applications with the following characteristics: access to Siri when the device is locked.

Rule-ID|SV-254594r959010_rule

STIG-ID|AIOS-16-007200

Vuln-ID|V-254594

AIOS-16-007300 - Apple iOS/iPadOS 16 allow list must be configured to not include applications with the following characteristics: allow voice dialing when MD is locked.

Rule-ID|SV-254595r959010_rule

STIG-ID|AIOS-16-007300

Vuln-ID|V-254595

AIOS-16-007400 - Apple iOS/iPadOS 16 allowlist must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoD servers; - Allows synchronization of data or applications between devices associated with user; and - Allows unencrypted (or encrypted but not FIPS 140-2/FIPS 140-3 validated) data sharing with other MDs or printers - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.

Rule-ID|SV-254596r959010_rule

STIG-ID|AIOS-16-007400

Vuln-ID|V-254596

AIOS-16-007500 - Apple iOS/iPadOS 16 must be configured to not display notifications when the device is locked.

800-53|AC-11(1)

CCI|CCI-000060

Rule-ID|SV-254597r959010_rule

STIG-ID|AIOS-16-007500

Vuln-ID|V-254597

AIOS-16-007600 - Apple iOS/iPadOS 16 must not display notifications (calendar information) when the device is locked - calendar information when the device is locked.

Rule-ID|SV-254598r959010_rule

STIG-ID|AIOS-16-007600

Vuln-ID|V-254598

AIOS-16-008400 - Apple iOS/iPadOS 16 must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-254599r958390_rule

STIG-ID|AIOS-16-008400

Vuln-ID|V-254599

AIOS-16-009200 - Apple iOS/iPadOS 16 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

Rule-ID|SV-254600r959010_rule

STIG-ID|AIOS-16-009200

Vuln-ID|V-254600

AIOS-16-009700 - Apple iOS/iPadOS 16 must not allow non-DoD applications to access DoD data.

800-53|AC-6(8)

800-53|SC-39

CCI|CCI-002233

CCI|CCI-002530

Rule-ID|SV-254601r959010_rule

STIG-ID|AIOS-16-009700

Vuln-ID|V-254601

AIOS-16-009800 - Apple iOS/iPadOS 16 must be configured to disable multiuser modes.

Rule-ID|SV-254602r959010_rule

STIG-ID|AIOS-16-009800

Vuln-ID|V-254602

AIOS-16-009900 - Apple iOS/iPadOS 16 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.

Rule-ID|SV-254603r959010_rule

STIG-ID|AIOS-16-009900

Vuln-ID|V-254603

AIOS-16-010000 - Apple iOS/iPadOS 16 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory installed application)] upon unenrollment from MDM - any nonfactory installed application] upon unenrollment from MDM.

Rule-ID|SV-254604r959010_rule

STIG-ID|AIOS-16-010000

Vuln-ID|V-254604

AIOS-16-010200 - Apple iOS/iPadOS 16 must be configured to disable ad hoc wireless client-to-client connection capability.

800-53|SC-40

CCI|CCI-002536

Rule-ID|SV-254605r987886_rule

STIG-ID|AIOS-16-010200

Vuln-ID|V-254605

AIOS-16-010400 - Apple iOS/iPadOS 16 must require a valid password be successfully entered before the mobile device data is unencrypted.

800-53|SC-28

CAT|I

CCI|CCI-001199

Rule-ID|SV-254606r959010_rule

STIG-ID|AIOS-16-010400

Vuln-ID|V-254606

AIOS-16-010500 - Apple iOS/iPadOS 16 must implement the management setting: limit Ad Tracking.

Rule-ID|SV-254607r959010_rule

STIG-ID|AIOS-16-010500

Vuln-ID|V-254607

AIOS-16-010600 - Apple iOS/iPadOS 16 must implement the management setting: Not allow automatic completion of Safari browser passcodes.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-254608r959010_rule

STIG-ID|AIOS-16-010600

Vuln-ID|V-254608

AIOS-16-010700 - Apple iOS/iPadOS 16 must implement the management setting: Encrypt iTunes backups/Encrypt local backup.

Rule-ID|SV-254609r959010_rule

STIG-ID|AIOS-16-010700

Vuln-ID|V-254609

AIOS-16-010800 - Apple iOS/iPadOS 16 must implement the management setting: not allow use of Handoff.

Rule-ID|SV-254610r959010_rule

STIG-ID|AIOS-16-010800

Vuln-ID|V-254610

AIOS-16-010900 - Apple iOS/iPadOS 16 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device for the first time.

800-53|AC-17a.

CCI|CCI-000063

Rule-ID|SV-254611r959010_rule

STIG-ID|AIOS-16-010900

Vuln-ID|V-254611

AIOS-16-011000 - Apple iOS/iPadOS 16 must implement the management setting: Disable Allow MailDrop.

800-53|AC-17(1)

CCI|CCI-002314

Rule-ID|SV-254612r959010_rule

STIG-ID|AIOS-16-011000

Vuln-ID|V-254612

AIOS-16-011100 - Apple iOS/iPadOS 16 must implement the management setting: Disable Allow Shared Albums.

Rule-ID|SV-254613r959010_rule

STIG-ID|AIOS-16-011100

Vuln-ID|V-254613

AIOS-16-011200 - iPhone and iPad must have the latest available iOS/iPadOS operating system installed.

Rule-ID|SV-254614r959010_rule

STIG-ID|AIOS-16-011200

Vuln-ID|V-254614

AIOS-16-011300 - Apple iOS/iPadOS 16 must implement the management setting: use SSL for Exchange ActiveSync.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-254615r959010_rule

STIG-ID|AIOS-16-011300

Vuln-ID|V-254615

AIOS-16-011400 - Apple iOS/iPadOS 16 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 16 Mail app.

Rule-ID|SV-254616r959010_rule

STIG-ID|AIOS-16-011400

Vuln-ID|V-254616

AIOS-16-011500 - Apple iOS/iPadOS 16 must implement the management setting: Treat AirDrop as an unmanaged destination.

800-53|IA-5(14)

Detections

Analytics

AirWatch - DISA Apple iOS-iPadOS 16 STIG v2r2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous