STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Jamf Pro v10.x EMM Security Technical Implementation Guide

Version

V3R1

Release Date

May 31, 2024

SCAP Benchmark ID

Jamf_Pro_v10-x_EMM_STIG

Total Checks

29

Tags

other
CAT I: 2CAT II: 26CAT III: 1

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (29)

V-241790MEDIUMWhen the Jamf Pro EMM server cannot establish a connection to determine the validity of a certificate, the server must not have the option to accept the certificate.V-241791MEDIUMThe Jamf Pro EMM server or platform must be configured to initiate a session lock after a 15-minute period of inactivity.V-241792MEDIUMThe Jamf Pro EMM server must be configured with an enterprise certificate for signing policies (if function is not automatically implemented during Jamf Pro EMM server install).V-241793MEDIUMThe Jamf Pro EMM server must be configured to transfer Jamf Pro EMM server logs to another server for storage, analysis, and reporting. Note: Jamf Pro EMM server logs include logs of MDM events and logs transferred to the Jamf Pro EMM server by MDM agents of managed devices.V-241794LOWThe Jamf Pro EMM server must be configured to display the required DoD warning banner upon administrator logon. Note: This requirement is not applicable if the TOE platform is selected in FTA_TAB.1.1 in the Security Target (ST).V-241795MEDIUMThe Jamf Pro EMM server must be configured to have at least one user in the following Administrator roles: Server primary administrator, security configuration administrator, device user group administrator, auditor.V-241796MEDIUMThe Jamf Pro EMM server must be configured to leverage the MDM platform user accounts and groups for Jamf Pro EMM server user identification and CAC authentication.V-241797MEDIUMAuthentication of Jamf Pro EMM server accounts must be configured so they are implemented either via an Authentication Gateway Service (AGS) which connects to the site DoD Identity Access Management (IdAM) environment that utilizes CAC authentication or via strong password controls for the administrator local accounts.V-241798HIGHJamf Pro EMM must be maintained at a supported version.V-241799MEDIUMThe default mysql_secure_installation must be installed.V-241800MEDIUMA unique database name and a unique MySQL user with a secure password must be created for use in Jamf Pro EMM.V-241801MEDIUMSeparate MySQL user accounts with limited privileges must be created within Jamf Pro EMM.V-241802MEDIUMMySQL database backups must be scheduled in Jamf Pro EMM.V-241803MEDIUMThe MySQL DatabasePassword key must be removed or set to a blank value in the database configuration file in Jamf Pro EMM.V-241804MEDIUMThe Jamf Pro EMM local accounts password must be configured with length of 15 characters.V-241805MEDIUMThe Jamf Pro EMM local accounts must be configured with at least one lowercase character.V-241806MEDIUMThe Jamf Pro EMM local accounts must be configured with at least one uppercase character.V-241807MEDIUMThe Jamf Pro EMM local accounts must be configured with at least one number.V-241808MEDIUMThe Jamf Pro EMM local accounts must be configured with at least one special character.V-241809MEDIUMThe Jamf Pro EMM local accounts must be configured with password minimum lifetime of 24 hours.V-241810MEDIUMThe Jamf Pro EMM local accounts must be configured with password maximum lifetime of 3 months.V-241811MEDIUMThe Jamf Pro EMM local accounts must prohibit password reuse for a minimum of five generations.V-241812MEDIUMThe Jamf Pro EMM must automatically disable accounts after a 35 day period of account inactivity (local accounts).V-241813MEDIUMThe Jamf Pro EMM must enforce the limit of three consecutive invalid logon attempts by a user.V-241814MEDIUMThe Jamf Pro EMM server platform must be protected by a DoD-approved firewall.V-241815MEDIUMThe firewall protecting the Jamf Pro EMM server platform must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support Jamf Pro EMM server and platform functions.V-241816MEDIUMThe firewall protecting the Jamf Pro EMM server platform must be configured so that only DoD-approved ports, protocols, and services are enabled. (See the DoD Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoD-approved ports, protocols, and services).V-241817MEDIUMAll Jamf Pro EMM server local accounts created during application installation and configuration must be disabled.V-241818HIGHThe Jamf Pro EMM server must connect to [Authentication Gateway Service (AGS)] with an authenticated and secure (encrypted) connection to protect the confidentiality and integrity of transmitted information.