V-282809

Discussion

Sharing of location data is an operational security risk because it potentially allows an adversary to determine a DOD user's location, movements, and patterns in those movements over time. An adversary could use this information to target the user or gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk. SFR ID: FMT_SMF.1.1 #47

Check Content

Review configuration settings to confirm "Location Services" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server.

This check procedure is performed on the iPhone and iPad only.

On the iPhone and iPad:
1. Open the Settings app.
2. Tap "Privacy & Security".
3. Tap "Location Services".
4. If the authorizing official (AO) has not approved use of personal iCloud accounts on the device, verify "Location Services" is disabled.
5. If the AO has approved the use of personal iCloud accounts on the device, enable tap "Location Services".

If "Location Services" is not disabled when the AO has not approved use of personal iCloud accounts on the device, this is a finding.

If "Share My Location" is toggled to the right and appears green on the iPhone and iPad when the AO has approved the use of personal iCloud accounts, this is a finding.