STIGhub
STIGs
RMF Controls
Compare
← CM-6 — Configuration Settings
CCI-000366
Definition
Implement the security configuration settings.
Parent Control
CM-6
Configuration Settings
Configuration Management
Linked STIG Checks (200)
V-237060
CAT II
The A10 Networks ADC, when used for load balancing web servers, must deploy the WAF in active mode.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237061
CAT II
If the Data Owner requires it, the A10 Networks ADC must be configured to perform CCN Mask, SSN Mask, and PCRE Mask Request checks.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237063
CAT II
The A10 Networks ADC must protect against TCP SYN floods by using TCP SYN Cookies.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237064
CAT I
The A10 Networks ADC must be a FIPS-compliant version.
A10 Networks ADC ALG Security Technical Implementation Guide
V-264425
CAT I
The A10 Networks ALG must be using a version supported by the vendor.
A10 Networks ADC ALG Security Technical Implementation Guide
V-255590
CAT II
The A10 Networks ADC must allow only the ISSM (or individuals or roles appointed by the ISSM) Root, Read Write, or Read Only privileges.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255593
CAT III
The A10 Networks ADC must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255594
CAT III
The A10 Networks ADC must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255596
CAT II
The A10 Networks ADC must not have any shared accounts (other than the emergency administration account).
A10 Networks ADC NDM Security Technical Implementation Guide
V-255597
CAT I
The A10 Networks ADC must not use the default admin account.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255601
CAT II
The A10 Networks ADC must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
A10 Networks ADC NDM Security Technical Implementation Guide
V-255602
CAT I
The A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are created.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255603
CAT II
The A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are modified.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255604
CAT II
The A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are disabled.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255605
CAT II
The A10 Networks ADC must generate alerts to the administrators and ISSO when accounts are removed.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255607
CAT II
The A10 Networks ADC must notify System Administrators (SAs) and Information System Security Officers (ISSMs) when accounts are created, or enabled when previously disabled.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255608
CAT II
The A10 Networks ADC must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255610
CAT III
The A10 Networks ADC must compare internal information system clocks at least every 24 hours with an authoritative time server.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255611
CAT III
The A10 Networks ADC must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255612
CAT II
The A10 Networks ADC must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255618
CAT II
The A10 Networks ADC must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and IAW CJCSM 6510.01B.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255619
CAT II
The A10 Networks ADC must employ centrally managed authentication server(s).
A10 Networks ADC NDM Security Technical Implementation Guide
V-255620
CAT II
The A10 Networks ADC must use DoD-approved PKI rather than proprietary or self-signed device certificates.
A10 Networks ADC NDM Security Technical Implementation Guide
V-255623
CAT I
The A10 Networks ADC must not use the default enable password.
A10 Networks ADC NDM Security Technical Implementation Guide
V-264426
CAT I
The A10 Networks NDM must be using a version supported by the vendor.
A10 Networks ADC NDM Security Technical Implementation Guide
V-204697
CAT III
AAA Services must be configured to use their loopback or OOB management interface address as the source address when originating NTP traffic.
AAA Services Security Requirements Guide
V-204698
CAT II
AAA Services used for 802.1x must be configured to use secure Extensible Authentication Protocol (EAP), such as EAP-TLS, EAP-TTLS, and PEAP.
AAA Services Security Requirements Guide
V-204699
CAT II
AAA Services must not be configured with shared accounts.
AAA Services Security Requirements Guide
V-204700
CAT II
AAA Services used to authenticate privileged users for device management must be configured to connect to the management network.
AAA Services Security Requirements Guide
V-204701
CAT II
AAA Services must be configured to use a unique shared secret for communication (i.e. RADIUS, TACACS+) with clients requesting authentication services.
AAA Services Security Requirements Guide
V-204702
CAT II
AAA Services must be configured to use IP segments separate from production VLAN IP segments.
AAA Services Security Requirements Guide
V-204703
CAT II
AAA Services must be configured to place non-authenticated network access requests in the Unauthorized VLAN or the Guest VLAN with limited access.
AAA Services Security Requirements Guide
V-204704
CAT II
AAA Services must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
AAA Services Security Requirements Guide
V-243466
CAT I
Membership to the Enterprise Admins group must be restricted to accounts used only to manage the Active Directory Forest.
Active Directory Domain Security Technical Implementation Guide
V-243467
CAT I
Membership to the Domain Admins group must be restricted to accounts used only to manage the Active Directory domain and domain controllers.
Active Directory Domain Security Technical Implementation Guide
V-243468
CAT II
Administrators must have separate accounts specifically for managing domain member servers.
Active Directory Domain Security Technical Implementation Guide
V-243469
CAT II
Administrators must have separate accounts specifically for managing domain workstations.
Active Directory Domain Security Technical Implementation Guide
V-243470
CAT I
Delegation of privileged accounts must be prohibited.
Active Directory Domain Security Technical Implementation Guide
V-243472
CAT II
Separate smart cards must be used for Enterprise Admin (EA) and Domain Admin (DA) accounts from smart cards used for other accounts.
Active Directory Domain Security Technical Implementation Guide
V-243473
CAT II
Separate domain accounts must be used to manage public facing servers from any domain accounts used to manage internal servers.
Active Directory Domain Security Technical Implementation Guide
V-243475
CAT II
Domain controllers must be blocked from Internet access.
Active Directory Domain Security Technical Implementation Guide
V-243476
CAT II
All accounts, privileged and unprivileged, that require smart cards must have the underlying NT hash rotated at least every 60 days.
Active Directory Domain Security Technical Implementation Guide
V-243477
CAT II
User accounts with domain level administrative privileges must be members of the Protected Users group in domains with a domain functional level of Windows 2012 R2 or higher.
Active Directory Domain Security Technical Implementation Guide
V-243478
CAT II
Domain-joined systems (excluding domain controllers) must not be configured for unconstrained delegation.
Active Directory Domain Security Technical Implementation Guide
V-243479
CAT II
The Directory Service Restore Mode (DSRM) passwords must be changed on each Domain Controller (DC) at least annually.
Active Directory Domain Security Technical Implementation Guide
V-243480
CAT II
The domain functional level must be at a Windows Server version still supported by Microsoft.
Active Directory Domain Security Technical Implementation Guide
V-243481
CAT II
Access to need-to-know information must be restricted to an authorized community of interest.
Active Directory Domain Security Technical Implementation Guide
V-243482
CAT I
Interconnections between DoD directory services of different classification levels must use a cross-domain solution that is approved for use with inter-classification trusts.
Active Directory Domain Security Technical Implementation Guide
V-243483
CAT I
A controlled interface must have interconnections among DoD information systems operating between DoD and non-DoD systems or networks.
Active Directory Domain Security Technical Implementation Guide
V-243487
CAT II
Membership in the Group Policy Creator Owners and Incoming Forest Trust Builders groups must be limited.
Active Directory Domain Security Technical Implementation Guide
V-243488
CAT III
User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.
Active Directory Domain Security Technical Implementation Guide
V-243489
CAT II
Read-only Domain Controller (RODC) architecture and configuration must comply with directory services requirements.
Active Directory Domain Security Technical Implementation Guide
V-243490
CAT II
Usage of administrative accounts must be monitored for suspicious and anomalous activity.
Active Directory Domain Security Technical Implementation Guide
V-243491
CAT II
Systems must be monitored for attempts to use local accounts to log on remotely from other systems.
Active Directory Domain Security Technical Implementation Guide
V-243492
CAT II
Systems must be monitored for remote desktop logons.
Active Directory Domain Security Technical Implementation Guide
V-243493
CAT II
Active Directory data must be backed up daily for systems with a Risk Management Framework categorization for Availability of moderate or high. Systems with a categorization of low must be backed up weekly.
Active Directory Domain Security Technical Implementation Guide
V-243494
CAT III
Each cross-directory authentication configuration must be documented.
Active Directory Domain Security Technical Implementation Guide
V-243496
CAT II
Accounts from outside directories that are not part of the same organization or are not subject to the same security policies must be removed from all highly privileged groups.
Active Directory Domain Security Technical Implementation Guide
V-243497
CAT II
Inter-site replication must be enabled and configured to occur at least daily.
Active Directory Domain Security Technical Implementation Guide
V-243499
CAT III
Active Directory implementation information must be added to the organization contingency plan where the Risk Management Framework categorization for Availability is moderate or high.
Active Directory Domain Security Technical Implementation Guide
V-243500
CAT II
Active Directory must be supported by multiple domain controllers where the Risk Management Framework categorization for Availability is moderate or high.
Active Directory Domain Security Technical Implementation Guide
V-243501
CAT III
The impact of CPCON changes on the cross-directory authentication configuration must be considered and procedures documented.
Active Directory Domain Security Technical Implementation Guide
V-269097
CAT II
Windows Server domain controllers must have Kerberos logging enabled with servers hosting Active Directory Certificate Services (AD CS).
Active Directory Domain Security Technical Implementation Guide
V-243502
CAT II
Membership to the Schema Admins group must be limited.
Active Directory Forest Security Technical Implementation Guide
V-243503
CAT II
Anonymous Access to AD forest data above the rootDSE level must be disabled.
Active Directory Forest Security Technical Implementation Guide
V-243505
CAT III
Changes to the AD schema must be subject to a documented configuration management process.
Active Directory Forest Security Technical Implementation Guide
V-269098
CAT I
Windows Server hosting Active Directory Certificate Services (AD CS) must enforce Certificate Authority (CA) certificate management approval for certificate requests.
Active Directory Forest Security Technical Implementation Guide
V-269099
CAT I
Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.
Active Directory Forest Security Technical Implementation Guide
V-279050
CAT II
ColdFusion must be configured with secure and approved server settings to enforce application hardening, input validation, error handling, and protection against common web vulnerabilities.
Adobe ColdFusion Security Technical Implementation Guide
V-279060
CAT II
ColdFusion must transmit only encrypted representations of passwords to the mail server.
Adobe ColdFusion Security Technical Implementation Guide
V-279065
CAT II
ColdFusion must have sandboxes enabled and defined.
Adobe ColdFusion Security Technical Implementation Guide
V-279072
CAT II
The ColdFusion error messages must be restricted to only authorized users.
Adobe ColdFusion Security Technical Implementation Guide
V-279075
CAT I
ColdFusion must control remote access to Exposed Services.
Adobe ColdFusion Security Technical Implementation Guide
V-279089
CAT II
ColdFusion must set an organization defined maximum number of cached templates.
Adobe ColdFusion Security Technical Implementation Guide
V-279102
CAT II
Installed versions of ColdFusion must be supported by the vendor.
Adobe ColdFusion Security Technical Implementation Guide
V-279103
CAT II
ColdFusion must execute as a nonprivileged user.
Adobe ColdFusion Security Technical Implementation Guide
V-279104
CAT II
The ColdFusion Root Administrator account must have a unique username.
Adobe ColdFusion Security Technical Implementation Guide
V-279105
CAT II
ColdFusion must protect newly created objects.
Adobe ColdFusion Security Technical Implementation Guide
V-279106
CAT II
ColdFusion must be configured to set the cookie settings.
Adobe ColdFusion Security Technical Implementation Guide
V-279107
CAT II
ColdFusion must be configured to enable Cross-Origin Resource Sharing (CORS) to allow mobile applications to access resources from different origins securely.
Adobe ColdFusion Security Technical Implementation Guide
V-279108
CAT II
ColdFusion must be configured to set the HTTPOnly attribute on session cookies to prevent client-side scripts from accessing the cookies.
Adobe ColdFusion Security Technical Implementation Guide
V-279109
CAT II
ColdFusion must be configured to set the Secure attribute on session cookies to ensure that cookies are only transmitted over secure HTTPS connections.
Adobe ColdFusion Security Technical Implementation Guide
V-279110
CAT II
ColdFusion must have the Java Runtime Environment (JRE) updated to the latest version.
Adobe ColdFusion Security Technical Implementation Guide
V-279111
CAT II
ColdFusion must have CFIDE blocked in the uriworkermap.properties file.
Adobe ColdFusion Security Technical Implementation Guide
V-76425
CAT II
Kona Site Defender that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
Akamai KSD Service Impact Level 2 ALG Security Technical Implementation Guide
V-76457
CAT II
Upon successful login, the Akamai Luna Portal must notify the administrator of the date and time of the last login.
Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide
V-76459
CAT II
The Akamai Luna Portal must notify the administrator of the number of successful login attempts.
Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide
V-76501
CAT I
The Akamai Luna Portal must employ Security Assertion Markup Language (SAML) to automate central management of administrators.
Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide
V-76503
CAT I
The Akamai Luna Portal must employ Single Sign On (SSO) with Security Assertion Markup Language (SAML) integration to verify authentication settings.
Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide
V-274016
CAT II
Amazon Linux 2023 must require users to provide a password for privilege escalation.
Amazon Linux 2023 Security Technical Implementation Guide
V-274027
CAT II
Amazon Linux 2023 must have the firewalld package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274028
CAT II
Amazon Linux 2023 must have the firewalld service active.
Amazon Linux 2023 Security Technical Implementation Guide
V-274048
CAT II
Amazon Linux 2023 SSHD must not allow blank passwords.
Amazon Linux 2023 Security Technical Implementation Guide
V-274140
CAT II
Amazon Linux 2023 must prevent the use of dictionary words for passwords.
Amazon Linux 2023 Security Technical Implementation Guide
V-274144
CAT II
Amazon Linux 2023 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Amazon Linux 2023 Security Technical Implementation Guide
V-274145
CAT II
Amazon Linux 2023 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
Amazon Linux 2023 Security Technical Implementation Guide
V-268078
CAT II
NixOS must enable the built-in firewall.
Anduril NixOS Security Technical Implementation Guide
V-268155
CAT II
NixOS must require users to reauthenticate for privilege escalation.
Anduril NixOS Security Technical Implementation Guide
V-268156
CAT II
NixOS must require users to reauthenticate when changing roles.
Anduril NixOS Security Technical Implementation Guide
V-268169
CAT II
NixOS must prevent the use of dictionary words for passwords.
Anduril NixOS Security Technical Implementation Guide
V-268170
CAT II
NixOS must enable the use of pwquality.
Anduril NixOS Security Technical Implementation Guide
V-268171
CAT II
NixOS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Anduril NixOS Security Technical Implementation Guide
V-268172
CAT I
NixOS must not allow an unattended or automatic logon to the system via the console.
Anduril NixOS Security Technical Implementation Guide
V-268173
CAT II
NixOS must be configured to use AppArmor.
Anduril NixOS Security Technical Implementation Guide
V-268181
CAT II
NixOS must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.
Anduril NixOS Security Technical Implementation Guide
V-214231
CAT II
The Apache web server must have system logging enabled.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214271
CAT I
The account used to run the Apache web server must not have a valid login shell and password defined.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214272
CAT III
The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214273
CAT I
The Apache web server software must be a vendor-supported version.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214274
CAT II
The Apache web server htpasswd files (if present) must reflect proper ownership and permissions.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214304
CAT III
The Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Apache Server 2.4 UNIX Site Security Technical Implementation Guide
V-214309
CAT II
System logging must be enabled.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214357
CAT I
All accounts installed with the Apache web server software and tools must have passwords assigned and default passwords changed.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214359
CAT I
The Apache web server software must be a vendor-supported version.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214360
CAT II
The Apache web server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214390
CAT II
The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-223002
CAT III
STRICT_SERVLET_COMPLIANCE must be set to true.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223003
CAT III
RECYCLE_FACADES must be set to true.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223004
CAT II
ALLOW_BACKSLASH must be set to false.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223005
CAT II
ENFORCE_ENCODING_IN_GET_WRITER must be set to true.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223006
CAT II
Tomcat users in a management role must be approved by the ISSO.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223007
CAT III
Hosted applications must be documented in the system security plan.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223008
CAT III
Connectors must be approved by the ISSO.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-223009
CAT III
Connector address attribute must be set.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-254578
CAT III
Apple iOS/iPadOS 16 must allow the Administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254580
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud document and data synchronization).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254581
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud Keychain).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254582
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (My Photo Stream).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254583
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Photo Streams).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254584
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (managed applications data stored in iCloud).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254585
CAT II
Apple iOS/iPadOS 16 must not allow backup to remote systems (enterprise books).
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254586
CAT II
Apple iOS/iPadOS 16 must [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254587
CAT II
Apple iOS/iPadOS 16 must [selection: remove Enterprise application, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254589
CAT II
Apple iOS/iPadOS 16 must be configured to not allow passwords that include more than four repeating or sequential characters.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254593
CAT II
Apple iOS/iPadOS 16 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoD-approved commercial app repository, MDM server, mobile application store].
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254594
CAT II
Apple iOS/iPadOS 16 must not include applications with the following characteristics: access to Siri when the device is locked.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254595
CAT II
Apple iOS/iPadOS 16 allow list must be configured to not include applications with the following characteristics: allow voice dialing when MD is locked.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254596
CAT II
Apple iOS/iPadOS 16 allowlist must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoD servers; - Allows synchronization of data or applications between devices associated with user; and - Allows unencrypted (or encrypted but not FIPS 140-2/FIPS 140-3 validated) data sharing with other MDs or printers.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254602
CAT II
Apple iOS/iPadOS 16 must be configured to disable multiuser modes.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254603
CAT II
Apple iOS/iPadOS 16 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254604
CAT II
Apple iOS/iPadOS 16 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory installed application)] upon unenrollment from MDM.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254607
CAT III
Apple iOS/iPadOS 16 must implement the management setting: limit Ad Tracking.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254608
CAT III
Apple iOS/iPadOS 16 must implement the management setting: Not allow automatic completion of Safari browser passcodes.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254609
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Encrypt iTunes backups/Encrypt local backup.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254610
CAT III
Apple iOS/iPadOS 16 must implement the management setting: not allow use of Handoff.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254612
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Disable Allow MailDrop.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254614
CAT I
iPhone and iPad must have the latest available iOS/iPadOS operating system installed.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254616
CAT II
Apple iOS/iPadOS 16 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 16 Mail app.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254617
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Treat AirDrop as an unmanaged destination.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254618
CAT III
Apple iOS/iPadOS 16 must implement the management setting: Not have any Family Members in Family Sharing.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254621
CAT II
Apple iOS/iPadOS 16 users must complete required training.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254623
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Enable USB Restricted Mode.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254624
CAT III
Apple iOS/iPadOS 16 must not allow managed apps to write contacts to unmanaged contacts accounts.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254625
CAT III
Apple iOS/iPadOS 16 must not allow unmanaged apps to read contacts from managed contacts accounts.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254626
CAT III
Apple iOS/iPadOS 16 must implement the management setting: Disable AirDrop.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254627
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Disable paired Apple Watch.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254628
CAT II
Apple iOS/iPadOS 16 must disable Password AutoFill in browsers and applications.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254629
CAT II
Apple iOS/iPadOS 16 must disable allow setting up new nearby devices.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254630
CAT II
Apple iOS/iPadOS 16 must disable password proximity requests.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254631
CAT II
Apple iOS/iPadOS 16 must disable password sharing.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254632
CAT III
Apple iOS/iPadOS 16 must disable Find My Friends in the Find My app.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254633
CAT II
The Apple iOS/iPadOS 16 must be supervised by the MDM.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254634
CAT II
Apple iOS/iPadOS 16 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DoD-approved USB storage drives with iOS/iPadOS devices.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254636
CAT II
Apple iOS must implement the management setting: Not allow a user to remove Apple iOS configuration profiles that enforce DoD security requirements.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254637
CAT II
Apple iOS/iPadOS 16 must disable "Allow network drive access in Files access".
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254638
CAT II
Apple iOS/iPadOS 16 must disable connections to Siri servers for the purpose of dictation.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254639
CAT II
Apple iOS/iPadOS 16 must disable connections to Siri servers for the purpose of translation.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254640
CAT II
Apple iOS/iPadOS 16 must disable copy/paste of data from managed to unmanaged applications.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-274441
CAT I
All Apple iOS/iPadOS 16 installations must be removed.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-257085
CAT II
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured for autonomous monitoring, compliance, and validation to ensure security/configuration settings of mobile devices do not deviate from the approved configuration baseline.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257086
CAT II
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to initiate autonomous monitoring, compliance, and validation prior to granting the BYOAD access to DOD information and IT resources.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257087
CAT II
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to detect if the BYOAD native security controls are disabled.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257088
CAT II
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to detect if known malicious, blocked, or prohibited applications are installed on the BYOAD (DOD-managed segment only).
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257089
CAT II
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to detect if the BYOAD is configured to access nonapproved third-party applications stores (DOD-managed segment only).
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257090
CAT II
The EMM detection/monitoring system must use continuous monitoring of enrolled iOS/iPadOS 16 BYOAD.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257091
CAT II
The iOS/iPadOS 16 BYOAD must be configured to either disable access to DOD data, IT systems, and user accounts or wipe managed data and apps if the EMM system detects native security controls are disabled.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257092
CAT II
The iOS/iPadOS 16 BYOAD must be configured to either disable access to DOD data, IT systems, and user accounts or wipe managed data and apps if the EMM system detects the BYOAD device has known malicious, blocked, or prohibited applications or is configured to access nonapproved managed third-party applications stores.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257093
CAT II
The iOS/iPadOS 16 BYOAD must be configured so that managed data and apps are removed if the device is no longer receiving security or software updates.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257095
CAT III
The iOS/iPadOS 16 BYOAD must be configured to protect users' privacy, personal information, and applications.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257096
CAT III
The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to only wipe managed data and apps and not unmanaged data and apps when the user's access is revoked or terminated, the user no longer has the need to access DOD data or IT, or the user reports a registered device as lost, stolen, or showing indicators of compromise.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257100
CAT I
The EMM system supporting the iOS/iPadOS 16 BYOAD must be NIAP validated (included on the NIAP list of compliant products or products in evaluation) unless the DOD CIO has granted an approved Exception to Policy (E2P).
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257101
CAT III
The User Agreement must include a description of what personal data and information is being monitored, collected, or managed by the EMM system or deployed agents or tools.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-257136
CAT I
The mobile device used for BYOAD must be NIAP validated.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-274443
CAT I
All Apple iOS/iPadOS 16 BYOAD installations must be removed.
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-250919
CAT III
Apple iOS/iPadOS 15 must provide the capability for the Administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: other methods].
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250927
CAT II
Apple iOS/iPadOS 15 must [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250928
CAT II
Apple iOS/iPadOS 15 must [selection: remove Enterprise application, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250930
CAT II
Apple iOS/iPadOS 15 must be configured to not allow passwords that include more than two repeating or sequential characters.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250934
CAT II
Apple iOS/iPadOS 15 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoD-approved commercial app repository, MDM server, mobile application store].
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250935
CAT II
Apple iOS/iPadOS 15 must not include applications with the following characteristics: access to Siri when the device is locked.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250936
CAT II
Apple iOS/iPadOS 15 allow list must be configured to not include applications with the following characteristics: voice dialing application if available when MD is locked.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250937
CAT II
Apple iOS/iPadOS 15 allowlist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services);- transmit MD diagnostic data to non-DoD servers; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250943
CAT II
Apple iOS/iPadOS 15 must be configured to disable multiuser modes.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250944
CAT II
Apple iOS/iPadOS 15 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250945
CAT II
Apple iOS/iPadOS 15 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory installed application)] upon unenrollment from MDM.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250947
CAT I
Apple iOS/iPadOS 15 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250948
CAT III
Apple iOS/iPadOS 15 must implement the management setting: limit Ad Tracking.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250949
CAT III
Apple iOS/iPadOS 15 must implement the management setting: not allow automatic completion of Safari browser passcodes.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250950
CAT II
Apple iOS/iPadOS 15 must implement the management setting: Encrypt iTunes backups/Encrypt local backup.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-250951
CAT III
Apple iOS/iPadOS 15 must implement the management setting: not allow use of Handoff.
Apple iOS/iPadOS 15 Security Technical Implementation Guide