2.4.4 Ensure 'Maximum grace period for device lock' is set to 'Immediately'

Information

This recommendation pertains to the amount of time after the device has been locked that it may be unlocked without entering a passcode. Devices with TouchID enabled do not allow a grace period.

Rationale:

Setting the maximum grace period to immediately ensures that a locked device will never be accessible without TouchID or entering a passcode.

Solution

1. Open Apple Configurator.
2. Open the Configuration Profile.
3. In the left windowpane, click on the 'Passcode' tab.
4. In the right windowpane, set the 'Maximum grace period for device lock' to 'Immediately'.
5. Deploy the Configuration Profile.

Impact:

None.

See Also

https://workbench.cisecurity.org/files/1688

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(d), CSCv6|16.5

Plugin: MDM

Control ID: 6611894ecfb01e1dbe325c96546f659e7622d73580111eb4bcc5f79228623d15