None Computing title Apple iOS/iPadOS 27 Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-288302 Rule_ID SV-288302r1294299_rule Severity low Rule_Title Apple iOS/iPadOS 27 must allow the administrator (MDM) and/or the user to perform the following management function: enable/disable VPN protection across the device and [selection: other methods]. Vuln_Discuss The system administrator (SA) and/or user must have the capability to configure VPN access to meet organization-specific policies based on mission needs. SFR ID: FMT_SMF_EXT.1.1 #3 Check_Content Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DoW network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DoW network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DoW network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement. Fix_Text If a third-party unmanaged VPN app is installed on the iOS 27 device, do not configure the VPN app with a DoW network VPN profile. Not_Reviewed Vuln_Num V-288325 Rule_ID SV-288325r1287390_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. Review configuration settings to confirm iCloud Backup is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud backup" is unchecked. Alternatively, verify the text "<key>allowCloudBackup</key> <false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "iCloud backup not allowed" is listed. If "Allow iCloud backup" is checked in the Apple iOS/iPadOS management tool, "<key>allowCloudBackup</key><true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud backup not allowed", this is a finding. Fix_Text Install a configuration profile to disable iCloud backup. Configuration Profile Key: allowCloudBackup Not_Reviewed Vuln_Num V-288326 Rule_ID SV-288326r1287393_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud document and data synchronization). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow iCloud documents & data" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud documents & data" is unchecked. Alternatively, verify the text "<key>allowCloudDocumentSync</key> <false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Restrictions". 6. Verify "Documents in the Cloud not allowed" is listed. Note: This also verifies that iCloud Drive and iCloud Photo Library are disabled. If "Allow iCloud documents & data" is checked in the Apple iOS/iPadOS management tool, "<key>allowCloudDocumentSync</key> <true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Documents in the Cloud not allowed", this is a finding. Fix_Text Install a configuration profile to disable iCloud documents and data. This is a supervised-only control. Configuration Profile Key: allowCloudDocumentSync Not_Reviewed Vuln_Num V-288327 Rule_ID SV-288327r1287396_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Keychain). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm iCloud keychain is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow iCloud keychain" is unchecked. Alternatively, verify the text "<key>allowCloudKeychainSync</key><false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Verify "iCloud Keychain not allowed" is listed. If "Allow iCloud keychain" is checked in the Apple iOS/iPadOS management tool, "<key>allowCloudKeychainSync</key><true/>" appears in the configuration profile, or "iCloud Keychain not allowed" is not listed on the iPhone and iPad, this is a finding. Fix_Text Install a configuration profile to disable iCloud keychain. This is a supervised-only control. Configuration Profile Key: allowCloudKeychainSync Not_Reviewed Vuln_Num V-288328 Rule_ID SV-288328r1287845_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (Cloud Photo Library). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Cloud Photo Library" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Cloud Photo Library" is unchecked. Alternatively, verify the text "<key>allowCloudPhotoLibrary</key><false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iCloud Photos not allowed" is listed. If "Allow Cloud Photo Library" is checked in the Apple iOS/iPadOS management tool, "<key>allowCloudPhotoLibrary</key> <true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "iCloud Photos not allowed", this is a finding. Fix_Text Install a configuration profile to disable Cloud Photo Library. This is a supervised-only control. Configuration Profile Key: allowCloudPhotoLibrary Not_Reviewed Vuln_Num V-288329 Rule_ID SV-288329r1287402_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Note: This requirement is not applicable if the authorizing official (AO) has approved users' full access to the Apple App Store for downloading unmanaged (personal) apps and syncing personal data on the device with personal cloud data storage accounts. The site must have an AO-signed document showing the AO has assumed the risk for users' full access to the Apple App Store. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Shared Stream" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Shared Stream" is unchecked. Alternatively, verify the text "<key>allowSharedStream</key><false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Shared Streams not allowed" is listed. If "AllowShared Photo Stream" is checked in the Apple iOS/iPadOS management tool, "<key>allowSharedStream</key><true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Shared Streams not allowed", this is a finding. Fix_Text Install a configuration profile to disable "Allow Shared PhotoStream". This is a supervised-only control. Configuration Profile Key: allowSharedStream Not_Reviewed Vuln_Num V-288330 Rule_ID SV-288330r1287405_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (managed applications data stored in iCloud). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Review configuration settings to confirm "Allow managed apps to store data in iCloud" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow managed apps to store data in iCloud" is unchecked. Alternatively, verify the text "<key>allowManagedAppsCloudSync</key> <false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps cloud sync not allowed" is listed. If "Allow managed apps to store data in iCloud" is checked in the Apple iOS/iPadOS management tool, "<key>allowManagedAppsCloudSync</key> <true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Managed apps cloud sync not allowed", this is a finding. Fix_Text Install a configuration profile to prevent DoW applications from storing data in iCloud. Configuration Profile Key: allowManagedAppsCloudSync Not_Reviewed Vuln_Num V-288331 Rule_ID SV-288331r1287408_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow backup to remote systems (enterprise books). Vuln_Discuss If a user can configure the security setting, they could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #40 Check_Content Review configuration settings to confirm "Allow backup of enterprise books" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow backup of enterprise books" is unchecked. Alternatively, verify the text "<key>allowEnterpriseBookBackup</key> <false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Backing up enterprise books not allowed" is listed. If "Allow backup of enterprise books" is checked in the Apple iOS/iPadOS management tool, "<key>allowEnterpriseBookBackup</key> <true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Backing up enterprise books not allowed", this is a finding. Fix_Text Install a configuration profile to prevent backup of enterprise books that could contain DoW sensitive information. Configuration Profile Key: allowEnterpriseBookBackup Not_Reviewed Vuln_Num V-288358 Rule_ID SV-288358r1287489_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to enforce a minimum password length of six characters. Vuln_Discuss Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting device and data compromise. SFR ID: FMT_SMF_EXT.1.1 #1 Check_Content Review configuration settings to confirm the minimum passcode length is six or more characters. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify the Declarative Device Management (DDM) configuration "Passcode" is set to "Minimum length" of "6" or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Minimum length" is listed as "6" or greater. If the minimum passcode length is less than six characters in the MDM server or on the iPhone and iPad, this is a finding. Fix_Text Install a DDM profile to enforce a minimum passcode length value of six or greater. In the MDM server, in the DDM configuration "Passcode", set "Minimum length" to "6" or greater. Not_Reviewed Vuln_Num V-288359 Rule_ID SV-288359r1287492_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to not allow passwords that include more than four repeating or sequential characters. Vuln_Discuss Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Passwords that contain repeating or sequential characters are significantly easier to guess than those that do not contain repeating or sequential characters. Therefore, disallowing repeating or sequential characters increases password strength and decreases risk. SFR ID: FMT_SMF_EXT.1.1 #1 Check_Content Review configuration settings to confirm simple passcodes are not allowed. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify that in the Declarative Device Management (DDM) configuration "Passcode", "Require Complex Passcode" is set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Require Complex Passcode" is set to "Yes". If "Require Complex Passcode" is not set to "Yes" in the MDM server or on the iPhone/iPad, this is a finding. Fix_Text Install a DDM profile to disallow more than four sequential or repeating numbers or letters in the device unlock password. In the MDM server, in the DDM configuration "Passcode", set "Require Complex Passcode" to "Yes". Not_Reviewed Vuln_Num V-288361 Rule_ID SV-288361r1287498_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to lock the display after 15 minutes (or less) of inactivity. Vuln_Discuss The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #2 Check_Content Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, in the Declarative Device Management (DDM) configuration "Passcode", verify the sum of the values assigned to "Max grace period" and "Max inactivity" is between 1 and 15 minutes. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes. Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement. If the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the MDM server or on the iPhone/iPad, this is a finding. Fix_Text Install a DDM profile to lock the device display after 15 minutes (or less) of inactivity. This is done by setting "Max grace period" and "Max inactivity" so the sum of their values is between 1 and 15 minutes. In the MDM server, in the DDM configuration "Passcode", set "Max grace period" and "Max inactivity" to a combined period of 15 minutes or less. For example, if "Max grace period" is set to "Immediately" and "Max inactivity" is set to "5 minutes", the requirement is met. Not_Reviewed Vuln_Num V-288362 Rule_ID SV-288362r1287501_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to not allow more than 10 consecutive failed authentication attempts. Vuln_Discuss The more attempts an adversary has to guess a password, the more likely the adversary will enter the correct password and gain access to resources on the device. Setting a limit on the number of attempts mitigates this risk. Setting the limit at 10 or less gives authorized users the ability to make a few mistakes when entering the password but still provides adequate protection against dictionary or brute force attacks on the password. SFR ID: FMT_SMF_EXT.1.1 #2 Check_Content Review configuration settings to confirm that consecutive failed authentication attempts is set to 10 or fewer. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Maximum failed attempts" has been set to "10" or fewer. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Maximum failed attempts" is listed as "10" or fewer. If the "Maximum failed attempts" is more than 10 in the MDM server or on the iPhone and iPad, this is a finding. Fix_Text Install a DDM profile to allow only 10 or fewer consecutive failed authentication attempts. In the MDM server, in the DDM configuration "Passcode", set "Maximum failed attempts" to "10" or fewer. Not_Reviewed Vuln_Num V-288363 Rule_ID SV-288363r1287504_rule Severity high Rule_Title Apple iOS/iPadOS 27 must be configured to enforce a passcode reuse prohibition of at least two generations. Vuln_Discuss iOS/iPadOS 17 and later versions include a feature that allows the previous passcode to be valid for 72 hours after a passcode change. If the previous passcode has been compromised and the attacker has access to it and the Apple device, enterprise data and the enterprise network can be compromised. Currently there is no MDM control to force the old passcode to expire immediately after a passcode change. The previous passcode will expire immediately after a passcode change if the MDM password history control is implemented. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcodes" that the "Unique passcode requirement" value is set to "2" or greater. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Passcode". 6. Verify "Unique passcode requirement" is listed as "2" or greater. If the MDM server or iOS or iPadOS device does not enforce a passcode reuse prohibition of at least two generations, this is a finding. Fix_Text Install a DDM profile to enforce a passcode reuse prohibition of at least two generations (passcode history). In the MDM server, in the DDM configuration "Passcode", set "Unique passcode requirement" to "2" or greater. Not_Reviewed Vuln_Num V-288364 Rule_ID SV-288364r1287507_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoW-approved commercial app repository, MDM server, mobile application store]. Vuln_Discuss Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoW data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF_EXT.1.1 #8 Check_Content Review configuration settings to confirm "Allow Trusting New Enterprise App Authors" is disabled. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Management tool, verify "Allow Trusting New Enterprise App Authors" is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Trusting enterprise apps not allowed" is listed. If "Allow Trusting New Enterprise App Authors" is not disabled in the iOS/iPadOS management tool, or on the iPhone and iPad "Trusting enterprise apps not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable "Allow Trusting New Enterprise App Authors". Configuration Profile Key: allowEnterpriseAppTrust Not_Reviewed Vuln_Num V-288366 Rule_ID SV-288366r1287513_rule Severity medium Rule_Title The Apple iOS/iPadOS 27 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. Vuln_Discuss Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DoW data or have features with no known application in the DoW environment. Note: Apple controls for app allow and block lists do not control app clips. App clips must be managed separately. Application note: The application allow list, in addition to controlling the installation of applications on the mobile device (MD), must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the operating system (OS) by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFR ID: FMT_SMF_EXT.1.1 #8 Check_Content Verify no apps or app clips with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. This check procedure is performed on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool: 1. Verify the Declarative Device Management (DDM) configuration "Bundle ID" (BundleID) is configured and there are no apps with prohibited characteristics. 2. Verify the Restrictions "allowAppClips" is disabled. If DDM "Bundle ID" or Restrictions "allowAppClips" is not configured and contains apps with prohibited characteristics, this is a finding. Fix_Text Install a DDM profile to enforce a list of approved apps (bundleID). Install a configuration profile to block app clips of prohibited apps (Configuration Key: allowAppClips). Ensure the allow list does not include apps with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system. Not_Reviewed Vuln_Num V-288367 Rule_ID SV-288367r1287516_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not include applications with the following characteristics: access to Siri when the device is locked. Vuln_Discuss Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DoW data or have features with no known application in the DoW environment. Application note: The application allow list, in addition to controlling the installation of applications on the mobile device (MD), must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the operating system (OS) by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFR ID: FMT_SMF_EXT.1.1 #8 Check_Content Review configuration settings to confirm that Siri is disabled on the Lock screen. This check procedure is performed on both the MDM server and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Siri Settings" that "Allow while locked" has been set to "No". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Siri Settings". 6. Verify "Allow while locked" is listed and set to "No". If in the MDM server or iPhone/iPad the DDM configuration "Siri Settings", "Allow while locked" has not been set to "No", this is a finding. Fix_Text Install a DDM profile to disable Siri while the device is locked. In the MDM server, in the DDM configuration "Siri Settings", set "Allow while locked" to "No". Not_Reviewed Vuln_Num V-288369 Rule_ID SV-288369r1287522_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must be configured to not display notifications when the device is locked. Vuln_Discuss Many mobile devices display notifications on the lock screen so users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are new notifications. However, in many cases, these notifications can contain sensitive information. When they are available on the lock screen, an adversary can see them merely by being in close physical proximity to the device. Configuring the mobile operating system to not send notifications to the lock screen mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #18 Check_Content Review configuration settings to confirm the display of notifications when the device is locked has been disabled. This check procedure is performed on the Apple iOS/iPadOS management tool and mobile device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to disable Notifications preview. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "Disallow notification view in locked screen" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to disable showing notification view in locked screen, this is a finding. Fix_Text Install a configuration profile to disable the display of notifications when the device is locked. Install a configuration profile to disable Notification Center from the device Lock screen. Configure in each installed managed app. Not_Reviewed Vuln_Num V-288370 Rule_ID SV-288370r1287525_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not display notifications (calendar information) when the device is locked. Vuln_Discuss Many mobile devices display notifications on the lock screen so users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are new notifications. However, in many cases, these notifications can contain sensitive information. When they are available on the lock screen, an adversary can see them merely by being in close physical proximity to the device. Configuring the mobile operating system to not send notifications to the lock screen mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #18 Check_Content Review configuration settings to confirm "Show Today view in Lock screen" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Show Today view in Lock screen" is unchecked. Alternatively, verify the text "<key>allowLockScreenTodayView</key><false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "Profiles & Device Management" or Profiles". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Today view on lock screen not allowed" is present. If "Show Today view in Lock screen" is checked in the Apple iOS/iPadOS management tool, "<key>allowLockScreenTodayView</key><true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Today view on lock screen not allowed", this is a finding. Fix_Text Install a configuration profile to disable "Show Today view in Lock screen" from the device Lock screen. Configuration Profile Key: allowLockScreenTodayView Not_Reviewed Vuln_Num V-288379 Rule_ID SV-288379r1287552_rule Severity low Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device. Vuln_Discuss Before granting access to the system, Apple iOS/iPadOS 27 is required to display the DoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DoW can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner must be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click-through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". The approved DoW text must be used exactly as required in the Knowledge Service referenced in DoDI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. For devices with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The administrator must configure the banner text exactly as written without any changes. SFR ID: FMT_SMF_EXT.1.1 #36 Check_Content The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Determine which method is used at the iOS device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several iOS device users and verify the agreement includes the required DoW warning banner text. Validation Procedure for Method #2: In the Apple iOS/iPadOS management tool, verify a Lock Screen Message payload has been installed on each managed device. The LockScreenFootnote string should include required text. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed, or for Method #2, the DoW warning banner text is not set as the lock screen footnote, this is a finding. Fix_Text Configure the DoW warning banner by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each iOS device user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Configuration Profile Key: LockScreenFootnote Not_Reviewed Vuln_Num V-288382 Rule_ID SV-288382r1287561_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must be configured to not allow backup of [all applications, configuration data] to locally connected systems. Vuln_Discuss Data on mobile devices is protected by numerous mechanisms, including user authentication, access control, and cryptography. When the data is backed up to an external system (either locally connected or cloud based), many if not all of these mechanisms are no longer present. This leaves the backed-up data vulnerable to attack. Disabling backup to external systems mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #40 Check_Content Review configuration settings to confirm backup in management apps is disabled and "Encrypt local backup" is enabled in iTunes (for Windows computer) and in Finder on Mac. Note: iTunes Backup/Finder backup is implemented by the configuration policy rule "Force encrypted backups", which is included in AIOS-27-009900 and therefore not included in the procedure below. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify backing up app data is disabled. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Tap a managed app. 7. Verify "App data will not be backed up" is listed. Note: Steps 6 and 7 must be performed for each managed app. If backing up app data is not disabled in the Apple iOS/iPadOS management tool or "app data will not be backed up" is not listed for each managed app on the iPhone and iPad, this is a finding. Fix_Text Install a configuration profile to disable backup of managed apps. Profiles must be configured on the MDM server for each managed app. Not_Reviewed Vuln_Num V-288386 Rule_ID SV-288386r1287573_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must not allow non-DoW applications to access DoW data. Vuln_Discuss App data sharing gives apps the ability to access the data of other apps for enhanced user functionality. However, sharing also poses a significant risk that unauthorized users or apps will obtain access to sensitive DoW information. Data sharing restrictions mitigate this risk. If a user is allowed to make exceptions to the data sharing restriction policy, the user could enable unauthorized sharing of data, leaving it vulnerable to breach. Limiting the granting of exceptions to either the administrator or common application developer mitigates this risk. Copy/paste of data between applications in different application processes or groups of application processes is considered an exception to the access control policy; therefore, the administrator must be able to enable/disable the feature. Other exceptions include allowing any data or application sharing between process groups. SFR ID: FMT_SMF_EXT.1.1 #42, FDP_ACF_EXT.1.2 Check_Content Review configuration settings to confirm "Allow documents from managed apps in unmanaged apps" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow documents from managed apps in unmanaged apps" is unchecked. Alternatively, verify the text "<key>allowOpenFromManagedToUnmanaged</key><false/>" appears in the configuration profile (.mobileconfig file). On the iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Opening documents from managed to unmanaged apps not allowed" is listed. If "Allow documents from managed apps in unmanaged apps" is checked in the iOS management tool, "<key>allowOpenFromManagedToUnmanaged</key><true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Opening documents from managed to unmanaged apps not allowed", this is a finding. Fix_Text Install a configuration profile to prevent non-DoW applications from accessing DoW data. Configuration Profile Key: allowOpenFromManagedToUnmanaged Not_Reviewed Vuln_Num V-288387 Rule_ID SV-288387r1287576_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to disable multiuser modes. Vuln_Discuss Multiuser mode allows multiple users to share a mobile device by providing a degree of separation between user data. To date, no mobile device with multiuser mode features meets DoW requirements for access control, data separation, and nonrepudiation for user accounts. In addition, the MDFPP does not include design requirements for multiuser account services. Disabling multiuser mode mitigates the risk of not meeting DoW multiuser account security policies. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Verify multiuser mode (shared iPad) is disabled in the MDM console for iPadOS devices. This requirement is not applicable for iOS devices. If multiuser mode is not disabled in the MDM console for iPadOS devices, this is a finding. Fix_Text Disable multiuser mode (shared iPad) in the MDM console for iPadOS devices. Not_Reviewed Vuln_Num V-288388 Rule_ID SV-288388r1287579_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM. Vuln_Discuss When a mobile device is no longer managed by MDM technologies, its protected/sensitive data must be sanitized because it will no longer be protected by the MDM software, putting it at much greater risk of unauthorized access and disclosure. At least one of the two options must be selected. SFR ID: FMT_SMF_EXT.2.1 Check_Content Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding. Fix_Text Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app. Not_Reviewed Vuln_Num V-288389 Rule_ID SV-288389r1287582_rule Severity medium Rule_Title Apple iOS/iPadOS 27 (MOS) must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory installed application)] upon unenrollment from MDM. Vuln_Discuss When a mobile device is no longer managed by MDM technologies, its protected/sensitive data must be sanitized because it will no longer be protected by the MDM software, putting it at much greater risk of unauthorized access and disclosure. At least one of the two options must be selected. SFR ID: FMT_SMF_EXT.2.1 Check_Content Note: Not all Apple iOS/iPadOS deployments involve MDM. If the site uses an authorized alternative to MDM for distribution of configuration profiles (Apple Configurator), this check procedure is not applicable. This check procedure is performed on the Apple iOS/iPadOS management tool or on the iOS device. In the Apple iOS/iPadOS management tool, for each managed app, verify the app is configured to be removed when the MDM profile is removed. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Apps". 6. Tap an app and verify "App and data will be removed when device is no longer managed" is listed. Repeat steps 5 and 6 for each managed app in the list. If one or more managed apps are not set to be removed upon device MDM unenrollment, this is a finding. Fix_Text Install a configuration profile to delete all managed apps upon device unenrollment. Configure in each installed managed app. Not_Reviewed Vuln_Num V-288392 Rule_ID SV-288392r1287842_rule Severity high Rule_Title All mobile operating system (MOS) cryptography must be configured to be in FIPS 140-3-validated mode. Vuln_Discuss Unapproved cryptographic algorithms cannot be relied on to provide confidentiality or integrity, and DoW data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140-3 validation provides assurance that the relevant cryptography has been implemented correctly. FIPS 140-3 validation is also a strict requirement for use of cryptography in the federal government for protecting unclassified data. SFR ID: FCS Check_Content Review configuration settings to confirm the device is set to require a passcode before use. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding. Fix_Text Install a configuration profile to require a password to unlock the device. When an iPhone/iPad is configured to use a passcode, the device is automatically in FIPS 140-3 validated mode. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes". Not_Reviewed Vuln_Num V-288393 Rule_ID SV-288393r1287594_rule Severity high Rule_Title Apple iOS/iPadOS 27 must require that a valid password be successfully entered before the mobile device data is unencrypted. Vuln_Discuss Passwords provide a form of access control that prevents unauthorized individuals from accessing computing resources and sensitive data. Passwords may also be a source of entropy for generation of key encryption or data encryption keys. If a password is not required to access data, this data is accessible to any adversary who obtains physical possession of the device. Requiring that a password be successfully entered before the mobile device data is unencrypted mitigates this risk. Note: The MDFPP requires a Password Authentication Factor and requires management of its length and complexity. It leaves open whether the existence of a password is subject to management. This requirement addresses the configuration to require a password, which is critical to the cybersecurity posture of the device. SFR ID: FIA_UAU_EXT.1.1 Check_Content Review configuration settings to require a passcode to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Passcode" that "Require passcode" has been set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations". 6. Tap "Passcode". 7. Verify "Require passcode" is set to "Yes". If "Passcode required" is not set to "Yes" in the MDM server or on the iPhone or iPad, this is a finding. Fix_Text Install a configuration profile to require a password to unencrypt device data. Data saved on an iPhone or iPad will not be unencrypted until a passcode is successfully entered. In the MDM server, in the DDM configuration "Passcode", set "Require passcode" to "Yes". Not_Reviewed Vuln_Num V-288395 Rule_ID SV-288395r1287600_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: limit Ad Tracking. Vuln_Discuss Ad Tracking refers to the advertisers' ability to categorize the device and spam the user with ads that are most relevant to the user's preferences. By not "Force limiting ad tracking", advertising companies are able to gather information about the user and device's browsing habits. If "Limit Ad Tracking" is not limited, a database of browsing habits of DoW devices can be gathered and stored under no supervision of the DoW. Limiting ad tracking does not completely mitigate the risk but does limit the amount of information gathering. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Force limited ad tracking" is checked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Force limited ad tracking" is checked. Alternatively, verify the text "<key>forceLimitAdTracking</key><true/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Requests to track from apps not allowed" is present. If "limited ad tracking enforced" is missing in the Apple iOS/iPadOS management tool, "<key>forceLimitAdTracking</key><false/>" does not appear in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Requests to track from apps not allowed", this is a finding. Fix_Text Install a configuration profile to limit advertisers' ability to track the user's web browsing preferences. Configuration Profile Key: forceLimitAdTracking Not_Reviewed Vuln_Num V-288396 Rule_ID SV-288396r1287603_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not allow automatic completion of Safari browser passcodes. Vuln_Discuss The AutoFill functionality in the Safari web browser allows the user to complete a form that contains sensitive information, such as Personally Identifiable Information (PII), without previous knowledge of the information. By allowing the use of the AutoFill functionality, an adversary who learns a user's iPhone or iPad passcode, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the AutoFill feature to provide information unknown to the adversary. By disabling the AutoFill functionality, the risk of an adversary gaining additional information about the device's user or compromising other systems is significantly mitigated. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Enable autofill" is unchecked. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Enable autofill" is unchecked. Alternatively, verify the text "<key>safariAllowAutoFill</key><false>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Auto-fill in Safari not allowed" is present. If "Enable autofill" is checked in the Apple iOS/iPadOS management tool, "<key>safariAllowAutoFill</key><true>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Auto-fill in Safari not allowed", this is a finding. Fix_Text Install a configuration profile to disable the AutoFill capability in the Safari app. Configuration Profile Key: safariAllowAutoFill Not_Reviewed Vuln_Num V-288397 Rule_ID SV-288397r1294300_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: encrypt backups/encrypt local backup. Vuln_Discuss If iCloud backups are not encrypted, this could lead to the unauthorized disclosure of DoW sensitive information if non-DoW personnel are able to access that machine. Forcing the backup to be encrypted greatly mitigates the risk of compromising sensitive data. Work data iCloud backup and USB connections to computers are not authorized, but this control provides defense-in-depth for cases in which a user violates policy either intentionally or inadvertently. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Force encrypted backups" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Encrypt local backup" is checked. Alternatively, verify the text "<key>forceEncryptedBackup</key><true/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Encrypt backups enforced" is listed. If "Encrypt local backup" is unchecked in the Apple iOS/iPadOS management tool, "<key>forceEncryptedBackup</key><false/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Encrypt backups enforced", this is a finding. Fix_Text Install a configuration profile to force encrypted backups to iCloud. Configuration Profile Key: forceEncryptedBackup Not_Reviewed Vuln_Num V-288398 Rule_ID SV-288398r1287609_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not allow use of Handoff. Vuln_Discuss Handoff permits a user of an iPhone and iPad to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled through iCloud, which should be disabled on a compliant iPhone and iPad. If a user associates both DoW and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Handoff mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Handoff" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Handoff" is unchecked. Alternatively, verify the text "<key>allowActivityContinuation</key> <false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Handoff not allowed" is listed. If "Allow Handoff" is checked in the Apple iOS/iPadOS management tool, "<key>allowActivityContinuation</key> <true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "Handoff not allowed", this is a finding. Fix_Text Install a configuration profile to disable continuation of activities among devices and workstations. This is a supervised-only control. Configuration Profile Key: allowActivityContinuation Not_Reviewed Vuln_Num V-288399 Rule_ID SV-288399r1287612_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not allow use of iPhone widgets on Mac. Vuln_Discuss iPhone widgets on Mac use Handoff. Handoff permits a user of an iPhone and iPad to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled though iCloud, which should be disabled on a compliant iPhone and iPad. If a user associates both DoW and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Handoff mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Allow iPhone Widget on Mac" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this requirement is automatically a finding. This check procedure is performed only on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "iPhone Widget on Mac" is unchecked. If "Allow iPhone Widget on Mac" is checked in the Apple iOS/iPadOS management tool, this is a finding. Fix_Text Install a configuration profile to disable the installation of iPhone widgets on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneWidgetsOnMac Not_Reviewed Vuln_Num V-288400 Rule_ID SV-288400r1287615_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device. Vuln_Discuss When a user is allowed to use AirPlay without a password, it may mistakenly associate the iPhone and iPad with an AirPlay-enabled device other than the one intended (i.e., by choosing the wrong one from the AirPlay list displayed). This creates the potential for someone in control of a mistakenly associated device to obtain DoW sensitive information without authorization. Requiring a password before such an association mitigates this risk. Passwords do not require any administration and are not required to comply with any complexity requirements. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Require passcode on outgoing AirPlay request" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Require passcode on outgoing AirPlay request" is checked. Alternatively, verify the text "<key>forceAirPlayOutgoingRequestsPairingPassword</key><false/>" appears in the configuration profile (.mobileconfig file). On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPlay outgoing requests pairing password enforced" is listed. If "Require passcode on outgoing AirPlay request" is unchecked in the Apple iOS/iPadOS management tool, "<key>forceAirPlayOutgoingRequestsPairingPassword</key><true/>" appears in the configuration profile, or the restrictions policy on the iPhone and iPad does not list "AirPlay outgoing requests pairing password enforced", this is a finding. Fix_Text Install a configuration profile to require the user to enter a password when connecting to an AirPlay-enabled device. Configuration Profile Key: forceAirPlayOutgoingRequestsPairingPassword Not_Reviewed Vuln_Num V-288401 Rule_ID SV-288401r1287618_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: disable Allow MailDrop. Vuln_Discuss MailDrop allows users to send large attachments (up to 5GB) via iCloud. Storing data with a non-DoW cloud provider may leave the data vulnerable to breach. Disabling non-DoW cloud services mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Allow MailDrop" is disabled. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow MailDrop" is not checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Mail". 6. Tap the mail account. 7. Verify "Mail Drop Enabled" is set to "No". If "Allow MailDrop" is not disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Mail Drop Enabled" as "Yes", this is a finding. Fix_Text Configure the Apple iOS/iPadOS configuration profile to disable "Allow MailDrop". Not_Reviewed Vuln_Num V-288402 Rule_ID SV-288402r1287621_rule Severity high Rule_Title iPhone and iPad must have the latest available iOS/iPadOS operating system installed. Vuln_Discuss Required security features are not available in earlier OS versions. In addition, earlier versions may have known vulnerabilities. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm the most recently released version of iOS is installed. This validation procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Go to https://www.apple.com and determine the most current version of iOS released by Apple. In the MDM management console, review the version of iOS installed on a sample of managed devices. This procedure will vary depending on the MDM product. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "About" and view the installed version of iOS. 4. Go back to the "General" screen. Tap "Software Update" and verify the following message is shown on the screen: "Your software is up to date." If the installed version of iOS on any reviewed iOS/iPadOS devices is not the latest released by Apple, this is a finding. Fix_Text Install the latest release version of Apple iOS/iPadOS on all managed iOS devices. Not_Reviewed Vuln_Num V-288403 Rule_ID SV-288403r1287624_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: use SSL for Exchange ActiveSync. Vuln_Discuss Exchange email messages are a form of data in transit and thus are vulnerable to eavesdropping and man-in-the-middle attacks. Secure Sockets Layer (SSL), also referred to as Transport Layer Security (TLS), provides encryption and authentication services that mitigate the risk of breach. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Use SSL" for the Exchange account is enabled for incoming mail. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Use SSL for incoming mail" is checked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "SSL for incoming mail" is set to "Yes". If "Use SSL for incoming mail" is unchecked in the Apple iOS/iPadOS management tool or the Exchange policy on the iPhone and iPad has "SSL for incoming mail" set to "No", this is a finding. Fix_Text Install a configuration profile to use SSL for Exchange ActiveSync incoming mail. Configuration Profile Key: IncomingMailServerUseSSL Not_Reviewed Vuln_Num V-288404 Rule_ID SV-288404r1287627_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 27 Mail app. Vuln_Discuss The Apple iOS/iPadOS Mail app can be configured to support multiple email accounts concurrently. These email accounts are likely to involve content of varying degrees of sensitivity (e.g., both personal and enterprise messages). To prevent the unauthorized and undetected forwarding or moving of messages from one account to another, Mail ActiveSync Exchange accounts can be configured to block such behavior. While users may still send a message from the Exchange account to another account, these transactions must involve an Exchange server, enabling audit records of the transaction, filtering of mail content, and subsequent forensic analysis. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Allow messages to be moved" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow messages to be moved" is unchecked under the Exchange payload. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the Exchange policy. 5. Tap "Mail". 6. Tap the name of the Exchange account. 7. Verify "Prevent Move" is set to "Yes". If "Allow messages to be moved" is checked in the Apple iOS/iPadOS management tool, or the Exchange policy on the iPhone and iPad has "Prevent Move" set to "No", this is a finding. Fix_Text Install a configuration profile to prevent Exchange messages from being moved or forwarded between email accounts. Configuration Profile Key: PreventMove Not_Reviewed Vuln_Num V-288405 Rule_ID SV-288405r1287630_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: treat AirDrop as an unmanaged destination. Vuln_Discuss AirDrop is a way to send contact information or photos to other users with AirDrop enabled. This feature enables a possible attack vector for adversaries to exploit. Once the attacker has gained access to the information broadcast by this feature, the attacker may distribute this sensitive information very quickly and without DoW's control or awareness. By disabling this feature, the risk of mass data exfiltration will be mitigated. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Treat AirDrop as an unmanaged destination" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Treat AirDrop as unmanaged destination" is checked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Sharing managed documents using AirDrop not allowed" is listed. If "Treat AirDrop as unmanaged destination" is disabled in the Apple iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad does not list "Sharing managed documents using AirDrop not allowed", this is a finding. Fix_Text Install a configuration profile to treat AirDrop as an unmanaged destination. Configuration Profile Key: forceAirDropUnmanaged Not_Reviewed Vuln_Num V-288406 Rule_ID SV-288406r1287633_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not have any Family Members in Family Sharing. Vuln_Discuss Apple's Family Sharing service allows Apple iOS/iPadOS users to create a Family Group whose members have several shared capabilities, including the ability to lock, wipe, play a sound on, or locate the iPhone and iPads of other members. Each member of the group must be invited to the group and accept that invitation. A DoW user's iPhone and iPad may be inadvertently or maliciously wiped by another member of the Family Group. This poses a risk that the user could be without a mobile device for a period of time or lose sensitive information that has not been backed up to other storage media. Configuring iPhone and iPads so their associated Apple IDs are not members of Family Groups mitigates this risk. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm Family Sharing is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. At the top of the screen, if "Sign in to your iPhone" is listed, this requirement has been met. 3. If the user profile is signed into iCloud, tap the username. 4. Tap "Family Sharing". 5. Verify no accounts are listed other than the "Organizer". Note: The iPhone and iPad must be connected to the internet to conduct this validation procedure. Otherwise, the device will display the notice "Family information is not available", in which case configuration compliance cannot be determined. If accounts (names or email addresses) are listed under "FAMILY MEMBERS" on the iPhone and iPad, this is a finding. Fix_Text The user must either remove all members from the Family Group on the iPhone and iPad or associate the device with an Apple ID that is not a member of a Family Group. Not_Reviewed Vuln_Num V-288407 Rule_ID SV-288407r1287636_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: not share location data through iCloud. Vuln_Discuss Sharing of location data is an operational security (OPSEC) risk because it potentially allows an adversary to determine a DoW user's location, movements, and patterns in those movements over time. An adversary could use this information to target the user or gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User-Based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the iPhone and iPad only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "Privacy & Security". 3. Tap "Location Services". 4. If the authorizing official (AO) has not approved use of personal iCloud accounts on the device, verify "Share My Location" is grayed out (cannot be selected). 5. If the AO has approved the use of personal iCloud accounts on the device, tap "Share My Location". 6. Verify "Share My Location" is off. If "Share My Location" is not grayed out (cannot be selected) when the AO has not approved use of personal iCloud accounts on the device, this is a finding. If "Share My Location" is toggled to the right and appears green on the iPhone and iPad when the AO has approved the use of personal iCloud accounts, this is a finding. Fix_Text The user must configure Apple iOS/iPadOS to disable location sharing through iCloud. Not_Reviewed Vuln_Num V-288408 Rule_ID SV-288408r1287639_rule Severity low Rule_Title Apple iOS/iPadOS 27 must implement the management setting: force Apple Watch wrist detection. Vuln_Discuss Because Apple Watch is a personal device, it is key that any sensitive DoW data displayed on the Apple Watch cannot be viewed when the watch is not in the immediate possession of the user. This control ensures the Apple Watch screen locks when the user takes the watch off, thereby protecting sensitive DoW data from possible exposure. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Force Apple Watch wrist detection" is enabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Wrist detection enforced on Apple Watch" is enforced. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Wrist detection enforced on Apple Watch" is listed. If "Wrist detection enforced on Apple Watch" is not enforced in the Apple iOS/iPadOS management tool, or the restrictions policy on the iPhone and iPad does not list "Wrist detection enforced on Apple Watch", this is a finding. Fix_Text Install a configuration profile to force Apple Watch wrist detection. Configuration Profile Key: forceWatchWristDetection Not_Reviewed Vuln_Num V-288409 Rule_ID SV-288409r1287642_rule Severity medium Rule_Title Apple iOS/iPadOS 27 users must complete required training. Vuln_Discuss The security posture on iOS devices requires the device user to configure several required policy rules on their device. User-Based Enforcement (UBE) is required for these controls. In addition, if the authorizing official (AO) has approved users' full access to the Apple App Store, users must receive training on risks. If a user is not aware of their responsibilities and does not comply with UBE requirements, the security posture of the iOS mobile device and DoW sensitive data may become compromised. SFR ID: NA Check_Content Review a sample of site User Agreements for iOS device users or similar training records and training course content. Verify iPhone and iPad users have completed required training. If any iPhone/iPad user has not completed required training, this is a finding. Fix_Text Have all iPhone and iPad users complete training on the following topics. Users must acknowledge receipt of training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications, including applications using global positioning system (GPS) tracking. - Must ensure no DoW data is saved in an unmanaged app or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn in, or reassignment, ensure a factory data reset is performed prior to device handoff. Follow mobility service provider decommissioning procedures as applicable. - How to configure the following UBE controls (users must configure the control) and other controls on the iPhone and iPad: **Remove Family Sharing. **Disable Shared Location. **Disable Wi-Fi Assist. **Use AirPrint only with AO-approved printers and print servers. **Turn off "Apps" under "Automatic Downloads" in the "iTunes & App Store" section of the Settings app on the iPhone and iPad. **Secure use of Calendar Alarm. **Do not configure a DoW network (work) VPN profile on any third-party unmanaged VPN app. **Disable iPhone and iPad radios using controls under "Settings" instead of "Control Center". - AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.). - Do not accept connection requests from nearby devices (via AirDrop or Wi-Fi Aware). Not_Reviewed Vuln_Num V-288410 Rule_ID SV-288410r1287645_rule Severity medium Rule_Title A managed photo app must be used to take and store work-related photos. Vuln_Discuss The iOS Photos app is unmanaged and may sync photos with a device or user's personal iCloud account. Therefore, work-related photos must not be taken via the iOS camera app or stored in the Photos app. A managed photo app must be used to take and manage work-related photos. SFR ID: NA Check_Content Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the DoW Configuration Profile from the Apple iOS/iPadOS management tool. 5. Tap "Apps". 6. Verify a photo capture and management app is listed. 7. Verify the app is managed and stores photos as managed data. If a managed photo capture and management app is not installed on the iPhone and iPad and/or the app is not managed and does not store photos as managed data, this is a finding. Note: The recommended app is Microsoft OneDrive. (Refer to the DoW Mobility Unclassified Capability [DMUC] "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.) Note: If the Apple device camera is disabled (refer to AIOS-27-016200), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app. Fix_Text Install a managed photos app to take and manage work-related photos. Note: The recommended app is Microsoft OneDrive. (Refer to the DoW Mobility Unclassified Capability [DMUC] "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.) Note: If the Apple device camera is disabled (refer to AIOS-27-016200), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app. Note: The app must be managed and must store photos as managed data. Not_Reviewed Vuln_Num V-288412 Rule_ID SV-288412r1287651_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: enable USB Restricted Mode. Vuln_Discuss The USB port on an iOS device can be used to access data on the device. The required settings ensure the Apple device password is entered before a previously trusted USB accessory can connect to the device. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB Restricted Mode" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB Restricted Mode" is checked (set to "True"). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify there is no listing for "USB Accessories while locked allowed". If "Allow USB Restricted Mode" is not enabled in the management tool and a restriction is listed in the profile on the Apple device, this is a finding. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: "Allow USB Restricted Mode" may be called "Allow USB accessories while device is locked" in some MDM consoles. The required logic is to disable USB accessory connections when the device is locked. Fix_Text Install a configuration profile to configure "Allow USB Restricted Mode" to "True" in the management tool. This is a supervised-only control. Note: The default configuration setting for "allow USB Restricted Mode" is "True" in most MDM products. This is the required setting. When set correctly, nothing will be listed in the Restrictions profile, and the user will be able to toggle USB accessories on/off. Note: This control is called "Allow USB accessories while device is locked" in Apple Configurator, and the control logic is opposite to what is listed here. Ensure the MDM policy rule is set correctly (to disable USB accessory connections when the device is locked). Configuration Profile Key: allowUSBRestrictedMode Not_Reviewed Vuln_Num V-288413 Rule_ID SV-288413r1287654_rule Severity low Rule_Title Apple iOS/iPadOS 27 must not allow managed apps to write contacts to unmanaged contacts accounts. Vuln_Discuss Managed apps have been approved for the handling of DoW sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoW sensitive information. Examples of unmanaged apps include those for news services, travel guides, maps, and social networking. If a document were to be viewed in a managed app and the user had the ability to open this same document in an unmanaged app, this could lead to the compromise of sensitive DoW data. In some cases, the unmanaged apps are connected to cloud backup or social networks that would permit dissemination of DoW sensitive information to unauthorized individuals. Not allowing data to be opened within unmanaged apps mitigates the risk of compromising sensitive data. SFR ID: FMT_SMF_EXT.1.1 #42, FDP_ACF_EXT.1.2 Check_Content Review configuration settings to confirm "Allow managed apps to write contacts to unmanaged contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the Apple iOS/iPadOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow managed apps to write contacts to unmanaged contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Managed apps write to unmanaged contacts allowed" is not listed. If "Allow managed apps to write contacts to unmanaged contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Managed apps write to unmanaged contacts allowed", this is a finding. Fix_Text Install a configuration profile to prevent managed apps from writing contacts to unmanaged contacts accounts. Configuration Profile Key: allowManagedToWriteUnmanagedContacts This payload can only be installed via an MDM. Not_Reviewed Vuln_Num V-288414 Rule_ID SV-288414r1287657_rule Severity low Rule_Title Apple iOS/iPadOS 27 must not allow unmanaged apps to read contacts from managed contacts accounts. Vuln_Discuss Managed apps have been approved for the handling of DoW sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoW sensitive information. Examples of unmanaged apps include those for news services, travel guides, maps, and social networking. If a document were to be viewed in a managed app and the user had the ability to open this same document in an unmanaged app, this could lead to the compromise of sensitive DoW data. In some cases, the unmanaged apps are connected to cloud backup or social networks that would permit dissemination of DoW sensitive information to unauthorized individuals. Not allowing data to be opened within unmanaged apps mitigates the risk of compromising sensitive data. SFR ID: FMT_SMF_EXT.1.1 #42, FDP_ACF_EXT.1.2 Check_Content Review configuration settings to confirm "Allow unmanaged apps to read contacts from managed contacts accounts" is disabled. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow unmanaged apps to read contacts from managed contacts accounts" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS/iPadOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow unmanaged apps to read contacts from managed contacts accounts" is not listed. If "Allow unmanaged apps to read contacts from managed contacts accounts" is checked in the iOS/iPadOS management tool or the restrictions policy on the iPhone and iPad lists "Allow unmanaged apps to read contacts from managed contacts accounts", this is a finding. Fix_Text Install a configuration profile to prevent unmanaged apps from reading contacts from managed contacts accounts. Configuration Profile Key: allowunmanagedToReadManagedContacts This payload can only be installed via an MDM. Not_Reviewed Vuln_Num V-288415 Rule_ID SV-288415r1287660_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: disable AirDrop. Vuln_Discuss AirDrop is a way to send contact information or photos to other users with this same feature enabled. This feature enables a possible attack vector for adversaries to exploit. Once the attacker has gained access to the information broadcast by this feature, the attacker may distribute this sensitive information very quickly and without DoW's control or awareness. By disabling this feature, the risk of mass data exfiltration will be mitigated. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm it is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirDrop" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirDrop not allowed" is listed. If "AirDrop not allowed" is not listed in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable the AllowAirDrop control in the management tool. This is a supervised-only control. Configuration Profile Key: allowAirDrop Not_Reviewed Vuln_Num V-288416 Rule_ID SV-288416r1287663_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: disable paired Apple Watch. Vuln_Discuss Sensitive DoW information could be exposed if an unauthorized Apple Watch is paired to a DoW iPhone. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Allow Paired Watch" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Paired Watch" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Paired Apple Watch not allowed" is listed. If "Paired Apple Watch not allowed" is not listed both in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable the Apple Watch control in the management tool. This is a supervised-only control. Configuration Profile Key: allowPairedWatch Not_Reviewed Vuln_Num V-288418 Rule_ID SV-288418r1287669_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable "Password AutoFill" in browsers and applications. Vuln_Discuss The AutoFill functionality in browsers and applications allows the user to complete a form that contains sensitive information, such as Personally Identifiable Information (PII), without previous knowledge of the information. By allowing the use of the AutoFill functionality, an adversary who learns a user's iPhone and iPad passcode, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the AutoFill feature to provide information unknown to the adversary. By disabling the AutoFill functionality, the risk of an adversary gaining further information about the device's user or compromising other systems is significantly mitigated. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password AutoFill is not allowed" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password AutoFill is not allowed" is unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password AutoFill is not allowed" is listed. If "Password AutoFill is not allowed" is not enabled in the iOS/iPadOS management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable allow Password AutoFill in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordAutoFill Not_Reviewed Vuln_Num V-288419 Rule_ID SV-288419r1287672_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable "Allow setting up new nearby devices". Vuln_Discuss This control allows Apple device users to request passwords from nearby devices. This could lead to a compromise of the device password with an unauthorized person or device. DoW Apple device passwords must not be shared. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow setting up new nearby devices" is disabled. This check procedure is performed on both the iOS/iPadOS device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow proximity setup to a new device" is unchecked. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity setup to a new device is not allowed" is listed. If "Allow proximity setup to a new device" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity setup to a new device is not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable allow setting up new nearby devices in the management tool. This is a supervised-only control. Configuration Profile Key: allowProximitySetupToNewDevice Not_Reviewed Vuln_Num V-288420 Rule_ID SV-288420r1287675_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable password proximity requests. Vuln_Discuss This control allows one Apple device to be notified to share its password with a nearby device. This could lead to a compromise of the device password with an unauthorized person or device. DoW Apple device passwords must not be shared. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow Password Proximity Requests" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Password Proximity Requests" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Proximity password requests not allowed" is listed. If "Allow Password Proximity Requests" is not disabled in the iOS/iPadOS management tool and on the Apple device "Proximity password requests not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable "allow password proximity requests" in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordProximityRequests Not_Reviewed Vuln_Num V-288421 Rule_ID SV-288421r1287678_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable password sharing. Vuln_Discuss This control allows sharing passwords between Apple devices using AirDrop. This could lead to a compromise of the device password with an unauthorized person or device. DoW Apple device passwords must not be shared. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Password Sharing is not allowed" is enabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Password Sharing is not allowed" is checked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Password Sharing is not allowed" is listed. If "Password Sharing is not allowed" is not enabled in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable allow password proximity sharing in the management tool. This is a supervised-only control. Configuration Profile Key: allowPasswordSharing Not_Reviewed Vuln_Num V-288422 Rule_ID SV-288422r1287681_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable "Find My Friends" in the "Find My" app. Vuln_Discuss This control does not share a DoW user's location but encourages location sharing between DoW mobile device users, which can lead to operational security (OPSEC) risks. Sharing the location of a DoW mobile device is a violation of AIOS-17-010900. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Find My Friends" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow Find My Friends" and "Allow modifying Find My Friends" are unchecked. On the iPhone/iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow Find My Friends" is not listed and "Changing Find My Friends settings not allowed" is listed. If "Allow Find My Friends" and "Allow modifying Find My Friends" are not disabled in the management tool, and on the Apple device "Allow Find My Friends" is listed and "Changing Find My Friends settings not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable "Find My Friends" in the Find My app and "Allow modifying Find My Friends" in the management tool. This is a supervised-only control. Configuration Profile Key: allowFindMyFriends, allowFindMyFriendsModification Not_Reviewed Vuln_Num V-288423 Rule_ID SV-288423r1287684_rule Severity medium Rule_Title The Apple iOS/iPadOS 27 must be supervised by the MDM. Vuln_Discuss When an iOS/iPadOS is not supervised, the DoW mobile service provider cannot control when new iOS/iPadOS updates are installed on site-managed devices. Most updates should be installed immediately to mitigate new security vulnerabilities, while some sites need to test each update prior to installation to ensure critical missions are not adversely impacted by the update. Several password and data protection controls can be implemented only when an Apple device is supervised. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify all managed Apple devices are supervised (verification procedure will vary by MDM product). Note: If the Apple device is not managed by an MDM and supervision is set up via Apple Configurator, this procedure is not applicable. On the iPhone and iPad: 1. Open the Settings app. 2. Verify a message similar to the following appears on the screen: "This iPad is supervised by (name of site DoW mobile service provider)." If site-managed iOS/iPadOS devices are not supervised, this is a finding. Fix_Text Use one of the following methods to supervise iOS and iPadOS devices managed by the DoW mobile service provider. Method 1: 1. Register all current and new iOS and iPadOS devices in the DoW mobile service provider's Automated Device Management/Apple Business Manager (ABM) account. 2. Enable supervision of managed iOS/iPadOS devices in the MDM. Method 2: 1. Configure each iOS/iPadOS device using the Apple Configurator tool for Supervision. 2. This method is usually only appropriate when MDM management of the DoW Apple device is not appropriate or an older device cannot be registered in ABM. Not_Reviewed Vuln_Num V-288424 Rule_ID SV-288424r1287687_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DoW-approved USB storage drives with iOS/iPadOS devices. Vuln_Discuss Unauthorized use of USB storage drives could lead to the introduction of malware or unauthorized software into the DoW IT infrastructure and compromise of sensitive DoW information and systems. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This requirement is not applicable if the AO has approved the use of USB drives to load files to Apple devices. The approval must be in writing and include which USB storage devices are approved for use. If the AO has not approved the use of USB drives to load files to Apple devices, use the following procedures to verify compliance. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, review configuration settings to confirm "Allow USB drive access in Files app" is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow USB drive access in Files app" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "USB drives not accessible in Files app" is listed. If "Allow USB drive access in Files app" is not disabled in the management tool and "USB drives not accessible in Files app" is not listed in the Restrictions profile on the Apple device, this is a finding. Fix_Text If the AO has not approved the use of USB drives to load files to Apple devices, install a configuration profile to disable "Allow USB drive access in Files app". Configuration Profile Key: allowFilesUSBDriveAccess Not_Reviewed Vuln_Num V-288425 Rule_ID SV-288425r1287690_rule Severity low Rule_Title The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. Vuln_Discuss Many software systems automatically send diagnostic data to the manufacturer or a third-party. This data enables the developers to understand real-world field behavior and improve the product based on that information. Unfortunately, it can also reveal information about what DoW users are doing with the systems and what causes them to fail. An adversary embedded within the software development team or elsewhere could use the information acquired to breach mobile operating system security. Disabling automatic transfer of such information mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm "Allow sending diagnostic and usage data to Apple" is disabled. This check procedure is performed on both the iOS management tool and the iOS device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow sending diagnostic and usage data to Apple" is unchecked. Alternatively, verify the text "<key>allowDiagnosticSubmission</key><false/>" appears in the configuration profile (.mobileconfig file). On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the management policy. 5. Tap "Restrictions". 6. Verify "Diagnostic submission not allowed". Note: This setting also disables "Share With App Developers". If "Allow sending diagnostic and usage data to Apple" is checked in the iOS management tool, "<key>allowDiagnosticSubmission</key><true/>" appears in the configuration profile, or the restrictions policy on the Apple iOS device from the Apple iOS management tool does not list "Diagnostic submission not allowed", this is a finding. Fix_Text Install a configuration profile to disable sending diagnostic data to an organization other than DoW. Configuration Profile Key: allowDiagnosticSubmission Not_Reviewed Vuln_Num V-288426 Rule_ID SV-288426r1287693_rule Severity medium Rule_Title Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DoW security requirements. Vuln_Discuss Configuration profiles define security policies on Apple iOS devices. If a user is able to remove a configuration profile, the user can then change the configuration that had been enforced by that policy. Relaxing security policies may introduce vulnerabilities the profiles had mitigated. Configuring a profile to never be removed mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm configuration profiles are not removable. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. The procedures below assume the site is not enrolled in Apple's Automatic Device Enrollment and are not applicable to devices under MDM management. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS management tool, verify "Security" is set to "Never" and "Automatically Remove Profile" is set to "Never". On the Apple iOS device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap each Configuration Profile from the Apple iOS management tool that contains the restrictions for the device. 5. Verify the "Remove Profile" button is not present. If on the Apple iOS management tool or the iOS device the "Remove Profile" button is available on the configuration profile, this is a finding. Fix_Text Configure the Apple iOS configuration profile so that it can never be removed. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. When using Apple Configurator, under "General Security", configure "Security" to "Never" and "Automatically Remove Profile" to "Never". Configuration Profile Key: PayloadRemovalDisallowed Not_Reviewed Vuln_Num V-288427 Rule_ID SV-288427r1287696_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable "Allow network drive access in Files access". Vuln_Discuss Allowing network drive access by the Files app could lead to the introduction of malware or unauthorized software into the DoW IT infrastructure and compromise of sensitive DoW information and systems. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow network drive access in Files access" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Network drives not accessible in Files app" is listed. If "Allow network drive access in Files access" is not disabled in the management tool and "Network drives not accessible in Files app" is not listed in Profile Restrictions on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allow network drive access in Files access". Configuration Profile Key: allowFilesNetworkDriveAccess Not_Reviewed Vuln_Num V-288428 Rule_ID SV-288428r1287699_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable connections to Siri servers for the purpose of dictation. Vuln_Discuss If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. Dictation information could contain sensitive DoW information and therefore should not leave DoW control. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm connections to Siri servers for the purpose of dictation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Intelligence Settings" that "Force On-Device Only Dictation" is set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Force On-Device Only Dictation" is listed and set to "Yes". If in the MDM server or the iPhone/iPad "Force On-Device Only Dictation" is not set to "Yes", this is a finding. Fix_Text Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of dictation. This is a supervised-only control. In the MDM server, set "Force On-Device Only Dictation" to "Yes" in the DDM configuration "Intelligence Settings". Not_Reviewed Vuln_Num V-288429 Rule_ID SV-288429r1287702_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable connections to Siri servers for the purpose of translation. Vuln_Discuss If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. Translation information could contain sensitive DoW information and therefore should not leave DoW control. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Review configuration settings to confirm connections to Siri servers for the purpose of translation are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the Declarative Device Management (DDM) configuration "Intelligence Settings" that "Force On-Device Only Translation" to set to "Yes". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Force On-Device Only Translation" is listed and set to "Yes". If in the MDM server or iPhone/iPad "Force On-Device Only Translation" is not set to "Yes", this is a finding. Fix_Text Configure the Apple iOS configuration profile to disable connections to Siri servers for the purpose of translation. In the MDM server, set "Force On-Device Only Translation" to "Yes" in the DDM category "Intelligence Settings". Not_Reviewed Vuln_Num V-288430 Rule_ID SV-288430r1287705_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable copy/paste of data from managed to unmanaged applications. Vuln_Discuss If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Require managed pasteboard" is set to "True". If "Require managed pasteboard" is not set to "True", this is a finding. Fix_Text Configure the Apple iOS configuration profile to disable copy/paste of data from managed to unmanaged applications. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Require managed pasteboard" to "True". Configuration Profile Key: requireManagedPasteboard Not_Reviewed Vuln_Num V-288431 Rule_ID SV-288431r1287708_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must have DoW root and intermediate PKI certificates installed. Vuln_Discuss DoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the user is allowed to remove root and intermediate certificates, the user could allow an adversary to falsely sign a certificate in such a way that it could not be detected. Restricting the ability to remove DoW root and intermediate PKI certificates to the administrator mitigates this risk. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Verify DoW intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DoW intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "More Details". 6. Verify the DoW intermediate and root certificates are listed. If DoW intermediate and root certificates are not installed on the Apple device, this is a finding. Fix_Text Install DoW intermediate and root certificates on managed mobile devices using the MDM. Not_Reviewed Vuln_Num V-288432 Rule_ID SV-288432r1287711_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch. Vuln_Discuss Auto Unlock allows an Apple Watch to automatically unlock an iPhone or Mac when in close proximity (not available for iPad). This feature allows the iPhone/Mac to be unlocked without the user entering the device passcode, which may lead to unauthorized users access to the iPhone/Mac and sensitive DoW data. This control is not applicable if the authorizing official (AO) has approved the use of Apple Watches. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Review configuration settings to confirm "Allow Auto Unlock" is disabled. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow auto unlock" is not checked. If Allow auto unlock is enabled, this is a finding. Fix_Text If the AO has not approved the use of Apple Watch with DoW-owned iPhones, configure the Apple iOS configuration profile to disable "Allow auto unlock". This is a supervised-only control. The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Allow auto unlock" to "False". Configuration Profile Key: allowAutoUnlock Not_Reviewed Vuln_Num V-288433 Rule_ID SV-288433r1287714_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable the installation of alternative marketplace apps. Vuln_Discuss Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoW data accessible by these unauthorized/malicious applications. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow marketplace app installation" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Marketplace app installation not allowed" is listed. If "Marketplace app installation" is not disabled in the management tool, this is a finding. Fix_Text Install a configuration profile to disable the installation of alternative marketplace apps. This is a supervised-only control. Configuration Profile Key: allowMarketplaceAppInstallation Not_Reviewed Vuln_Num V-288434 Rule_ID SV-288434r1287717_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable app installation from a website. Vuln_Discuss Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoW data accessible by these unauthorized/malicious applications. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow app installation from website" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Web app distribution not allowed" is listed. If "Allow app installation from website" is not disabled in the management tool, or on the Apple device "Web app distribution not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable app installation from a website. Configuration Profile Key: allowWebDistributionAppInstallation Not_Reviewed Vuln_Num V-288435 Rule_ID SV-288435r1287720_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must delete eSIM content when the device is erased. Vuln_Discuss An eSIM may contain sensitive DoW data and must be wiped of data when the mobile device is wiped to protect sensitive data from exposure. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Preserve eSIM content when device is erased" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Preserve eSIM content when device is erased" is not listed. If "Preserve eSIM content when device is erased" is not disabled in the management tool, or on the Apple device "Preserve eSIM content when device is erased" is listed, this is a finding. Fix_Text Install a configuration profile to delete eSIM content when the device is erased. Configuration Profile Key: forcePreserveESIMOnErase Not_Reviewed Vuln_Num V-288436 Rule_ID SV-288436r1287851_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable third-party artificial intelligence (AI) app (example: ChatGPT) connections for Apple Intelligence. Vuln_Discuss The ChatGPT feature of Apple Intelligence allows DoW information to be downloaded from the DoW iPhone/iPad and processed by the ChatGPT application in the cloud. The ChatGPT feature of Apple Intelligence increases the risk of compromise of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm third-party AI app connections to Apple Intelligence are disabled. This check procedure is performed on both the MDM server and iPhone or iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify in the DDM configuration "External Intelligence Settings" that "Allow Integrations" and "Allow Sign In" are both set to "No". On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the MDM server containing the policy. 5. Tap "Configurations" and then "External Intelligence Settings". 6. Verify "Allow Integrations" and "Allow Sign In" are both set to "No". If in the MDM server or iPhone/iPad both "Allow Integrations" and "Allow Sign In" are not set to "Yes", this is a finding. Fix_Text Install a configuration profile to disable all third-party AI app connections for Apple Intelligence. In the MDM server, set both "Allow Integrations" and "Allow Sign In" to "No" in the Declarative Device Management (DDM) configuration "External Intelligence Settings". Not_Reviewed Vuln_Num V-288437 Rule_ID SV-288437r1287726_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable the download of iOS/iPadOS beta updates. Vuln_Discuss Beta operating system updates may contain features that could lead to the compromise of sensitive DoW information or provide a vector for the attack on the DoW network. The current STIG will not normally provide controls to disable these unsecure features. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. This check procedure is performed on both the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow installing configuration profiles (supervised only)" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Installing configuration profiles not allowed" is listed. If "Allow installing configuration profiles" is not disabled in the management tool, or on the Apple device "Installing configuration profiles not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable the installation of new configuration profiles. This will block the download and installation of beta iOS and iPadOS updates. This is a supervised-only control. Configuration Profile Key: allowUIConfigurationProfileInstallation Not_Reviewed Vuln_Num V-288438 Rule_ID SV-288438r1287729_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable the ability to hide apps. Vuln_Discuss Hidden apps cannot be seen by enterprise management applications (e.g., MDM server), and therefore, unauthorized apps or apps with embedded malware could be installed and hidden from the MDM or mobile threat detection (MTD) apps. Hidden apps may lead to the compromise of sensitive DoW data or provide a vector to attacks on the DoW network. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This check procedure is performed on the device management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Apps to be hidden" is unchecked. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "Apps". 3. At the bottom of the list of Apps, tap "Hidden Apps". 4. Verify no hidden apps are listed. If "Allow Apps to be hidden" is not disabled in the management tool or hidden apps are installed on enterprise iPhones and iPads, this is a finding. Fix_Text Install a configuration profile to disable hiding apps on iPhones and iPads. Configuration Profile Key: allowAppsToBeHidden Not_Reviewed Vuln_Num V-288439 Rule_ID SV-288439r1287853_rule Severity medium Rule_Title Apple iOS 27 must disable recording cellphone calls on the iPhone. Vuln_Discuss Cellphone recordings are saved as unmanaged recordings in the Notes app, which may be accessible to unmanaged apps. There is a risk that sensitive DoW information can be recorded from a cellphone call, saved in Notes, and be accessible to an unmanaged App, which may expose sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This check procedure is performed on the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow call recording" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "Apps". 3. Tap "Phone". 4. Verify "Audio Call Recording" is not shown. If "Allow Call Recording" is not disabled in the management tool or "Audio Call Recording" is available in Settings on the iPhone, this is a finding. Fix_Text Install a configuration profile to disable recording cellphone calls. Configuration Profile Key: allowCallRecording Not_Reviewed Vuln_Num V-288440 Rule_ID SV-288440r1287735_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable iPhone Mirroring on Mac. Vuln_Discuss iPhone Mirroring allows managed data on a DoW iPhone to be manipulated by an unmanaged Mac. In certain situations, this may lead to the exposure of sensitive DoW data such as notifications, messages, photos, etc. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This check procedure is performed on the device management tool and iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow iPhone Mirroring (supervised only)" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "iPhone Mirroring not allowed" is listed. If "Allow iPhone Mirroring" is not disabled in the management tool, or "iPhone Mirroring not allowed" is not listed on the iPhone, this is a finding. Fix_Text Install a configuration profile to disable iPhone Mirroring on Mac. This is a supervised-only control. Configuration Profile Key: allowiPhoneMirroring Not_Reviewed Vuln_Num V-288441 Rule_ID SV-288441r1287837_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable the ability of the user to wipe the device. Vuln_Discuss This feature must be disabled to comply with DoW electronic records retention requirements for mobile devices. Otherwise, mobile device users could wipe the device, which would violate DoW policy. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow Erase All Content and Settings" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow erase all content and settings" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Erase content and settings not allowed" is listed. If "Allow erase all content and settings" is not disabled in the management tool, or on the Apple device "Erase content and settings not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable "Allow Erase All Content and Settings". This is a supervised-only control. Configuration Profile Key: allowEraseContentAndSettings Not_Reviewed Vuln_Num V-288442 Rule_ID SV-288442r1287741_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable automatic downloads of apps purchased on other Apple devices. Vuln_Discuss The automatic download of apps to a DoW mobile device could cause the exposure of sensitive DoW information when an unauthorized app is installed. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow automatic app downloads" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow automatic app downloads" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Automatic downloading apps not allowed" is listed. If "Automatic downloading apps" is not disabled in the management tool, or on the Apple device "Automatic downloading apps not allowed" is not listed, this is a finding. Fix_Text Install a configuration profile to disable "Allow automatic app downloads". This is a supervised-only control. Configuration Profile Key: allowAutomaticAppDownloads Not_Reviewed Vuln_Num V-288443 Rule_ID SV-288443r1287744_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must disable pairing with a host Mac or PC. Vuln_Discuss The connection of a DoW iPhone to a Mac or PC could cause the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow host pairing" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow host pairing" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Pairing with iTunes not allowed" is listed. If "Host pairing" is not disabled in the management tool, or on the Apple device "Pairing with iTunes not allowed" is not listed, this is a finding. Note: Some applications used to remove iPhone and iPad data to meet the DoW data retention policy require that host pairing be enabled. Host pairing may be temporarily enabled for this purpose only, with authorizing official (AO) approval. Fix_Text Install a configuration profile to disable "Allow host pairing". This is a supervised-only control. Configuration Profile Key: allowHostPairing Note: Some applications used to remove iPhone and iPad data to meet the DoW data retention policy require that host pairing be enabled. Host pairing may be temporarily enabled for this purpose only with AO approval. Not_Reviewed Vuln_Num V-288444 Rule_ID SV-288444r1287747_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable AirPrint. Vuln_Discuss AirPrint allows the printing of sensitive DoW documents to non-DoW-controlled printers, which may lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow AirPrint" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "AirPrint not allowed" is listed. If AirPrint is not disabled in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allow AirPrint". This is a supervised-only control. Configuration Profile Key: AllowAirPrint Not_Reviewed Vuln_Num V-288445 Rule_ID SV-288445r1287750_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons. Vuln_Discuss AirPrint allows the printing of sensitive DoW documents to non-DoW-controlled printers, which may lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow discovery of AirPrint printers using iBeacons" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow discovery of AirPrint printers using iBeacons" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Discovery of AirPrint printers using iBeacons not allowed" or "AirPrint not allowed" is listed. If "Discovery of AirPrint printers using iBeacons" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allow discovery of AirPrint printers using iBeacons". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintiBeaconDiscovery Not_Reviewed Vuln_Num V-288446 Rule_ID SV-288446r1287753_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable AirPrint: Allow storage of AirPrint credentials in Keychain. Vuln_Discuss AirPrint allows the printing of sensitive DoW documents to non-DoW-controlled printers, which may lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allow storage of AirPrint credentials in Keychain" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow storage of AirPrint credentials in Keychain" or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Storage of AirPrint credentials in Keychain not allowed" or "AirPrint not allowed" is listed. If "Storage of AirPrint credentials in Keychain" is not disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allow storage of AirPrint credentials in Keychain". This is a supervised-only control. Note: This control may not be configurable on some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: allowAirPrintCredentialsStorage Not_Reviewed Vuln_Num V-288447 Rule_ID SV-288447r1287836_rule Severity low Rule_Title Apple iOS/iPadOS 27 must allow the AirPrint feature: Disallow AirPrint to destinations with untrusted certificates. Vuln_Discuss AirPrint allows the printing of sensitive DoW documents to non-DoW-controlled printers, which may lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Disallow AirPrint to destinations with untrusted certificates" is enabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Disallow AirPrint to destinations with untrusted certificates" is checked or "Allow AirPrint" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Allow AirPrint to destinations with untrusted certificates" is not listed or "AirPrint not allowed" is listed. If "Disallow AirPrint to destinations with untrusted certificates" is disabled or AirPrint is not disabled in the management tool and on the Apple device, this is a finding. Fix_Text Install a configuration profile to enable "Disallow AirPrint to destinations with untrusted certificates". This is a supervised-only control. Note: This control may not be configurable by some MDM products when "Allow AirPrint" is disabled. Configuration Profile Key: forceAirPrintTrustedTLSRequirement Not_Reviewed Vuln_Num V-288448 Rule_ID SV-288448r1287759_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable Allowed Content Ratings (Movies). Vuln_Discuss There is no known mission need for this personal use feature. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allowed Content Ratings (Movies)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Movie ratings" is set to "0" (disable all movies). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Movie ratings enforced" is listed. If "Movie ratings" is not set to "0" in the management tool, and Movie ratings are not enforced on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allowed Content Ratings (Movies)" (ratingMovies key value = 0). This is a supervised-only control. Configuration Profile Key: ratingMovies Not_Reviewed Vuln_Num V-288449 Rule_ID SV-288449r1287762_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable Allowed Content Ratings (TV Shows). Vuln_Discuss There is no known mission need for this personal use feature. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm "Allowed Content Ratings (TV Shows)" is disabled. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "TV Shows ratings" is set to "0" (disable all TV Shows). On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "TV show ratings enforced" is listed. If "TV show ratings" is not set to "0" in the management tool, and TV show ratings are not enforced on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable "Allowed Content Ratings (TV Shows)" (ratingTVShows key value = 0). This is a supervised-only control. Configuration Profile Key: ratingTVShows Not_Reviewed Vuln_Num V-288450 Rule_ID SV-288450r1287872_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Wand. Vuln_Discuss The security of the Apple Intelligence system has not been vetted by the DoW, and the risk to DoW sensitive information is not known at this time. Therefore, Apple intelligence features will be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm the Apple Intelligence feature "Image Wand" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Wand" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Wand" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Wand" is not set to "No", this is a finding. Fix_Text Install a configuration profile to disable the Apple Intelligence feature "Image Wand". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Wand" to "No" in the DDM configuration "Intelligence Settings". Not_Reviewed Vuln_Num V-288451 Rule_ID SV-288451r1287768_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: Image Generation. Vuln_Discuss The security of the Apple Intelligence system has not been vetted by the DoW, and the risk to DoW sensitive information is not known at this time. Therefore, Apple intelligence features will be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm the Apple Intelligence feature "Image Generation" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Image Playground" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Image Playground" is set to "No". If in the MDM server or iPhone/iPad "Allow Image Playground" is not set to "No", this is a finding. Fix_Text Install a configuration profile to disable the Apple Intelligence feature "Image Generation". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Image Playground" to "No" in the DDM configuration "Intelligence Settings". Not_Reviewed Vuln_Num V-288452 Rule_ID SV-288452r1287771_rule Severity low Rule_Title Apple iOS/iPadOS 27 must disable the Apple Intelligence feature: generate new Genmoji. Vuln_Discuss The security of the Apple Intelligence system has not been vetted by the DoW, and the risk to DoW sensitive information is not known at this time. Therefore, Apple intelligence features will be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm the Apple Intelligence feature "generate new Genmoji" is disabled. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the MDM server, verify "Allow Genmoji" is set to "No" in the Declarative Device Management (DDM) configuration "Intelligence Settings". On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the policy. 5. Tap "Configurations" and then "Intelligence Settings". 6. Verify "Allow Genmoji" is set to "No". If in the MDM server or iPhone/iPad "Allow Genmoji" is not set to "No", this is a finding. Fix_Text Install a configuration profile to disable the Apple Intelligence feature "generate new Genmoji". This is a supervised-only control. Note: This control is applicable only to Apple Intelligence-capable iPhones and iPads. In the MDM server, set "Allow Genmoji" to "No" in the DDM configuration "Intelligence Settings". Not_Reviewed Vuln_Num V-288453 Rule_ID SV-288453r1287774_rule Severity medium Rule_Title DoW Apple iOS/iPadOS 27 devices must have a Mobile Threat Detection (MTD) app installed. Vuln_Discuss DoW mobile devices are in constant risk of cyber threats. Mobile Threat Detection (MTD) apps partially mitigate these risks by providing real-time threat detection, malware prevention, and vulnerability analysis. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Confirm an MTD app is installed on managed iPhones and iPads. This check procedure is performed on both the device management tool and the iPhone and iPad device. In the iOS/iPadOS management tool, verify an MTD app is listed as a managed app being deployed to site-managed devices. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Apps". 6. Verify an MTD app is listed. If an MTD app is not installed on the device, this is a finding. Fix_Text Deploy a site-approved MTD app via the MDM server to managed iPhones and iPads. Not_Reviewed Vuln_Num V-288454 Rule_ID SV-288454r1287777_rule Severity low Rule_Title DoW Apple iOS/iPadOS 27 devices must disable FaceTime. Vuln_Discuss FaceTime is considered a personal use feature. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow FaceTime" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "FaceTime not allowed" is listed. If "Allow FaceTime" is listed in the management tool or "FaceTime not allowed" is not listed on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable FaceTime. This is a supervised-only control. Configuration Profile Key: allowVideoConferencing Not_Reviewed Vuln_Num V-288455 Rule_ID SV-288455r1287855_rule Severity low Rule_Title DoW Apple iOS/iPadOS 27 devices must disable eSIM transfers. Vuln_Discuss eSIM transfers could lead to the unauthorized use of DoW paid cellular service. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Determine if the site authorizing official (AO) has approved the use of eSIM transfer. Look for documentation of AO approval. If eSIM transfer is not approved, review configuration settings to confirm it is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding. If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow outgoing eSIM transfers" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Outgoing eSIM transfers not allowed" is listed. If the AO has not approved eSIM transfers and "Allow eSIM outgoing transfers" is listed in the management tool or "Outgoing eSIM transfers not allowed" is not listed on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable the transfer of an eSIM from one DoW phone to another unless the service has been approved by the AO. This is a supervised-only control. Configuration Profile Key: allowESIMOutgoingTransfers Not_Reviewed Vuln_Num V-288456 Rule_ID SV-288456r1287783_rule Severity low Rule_Title DoW Apple iOS/iPadOS 27 devices must disable screenshots and screen recordings. Vuln_Discuss A screenshot or screen recording of sensitive DoW information could lead to the inadvertent exposure of that information. SFR ID: FMT_MOF_EXT.1.2 #47 Check_Content Review configuration settings to confirm screenshot and screen recording is disabled. This check procedure is performed on both the device management tool and the iPhone and iPad device. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS/iPadOS management tool, verify "Allow screenshot and screen recording" is unchecked. On the iPhone/iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Screen capture not allowed" is listed. If "Allow screenshot and screen recording" is listed in the management tool or "Screen capture not allowed" is not listed on the Apple device, this is a finding. Fix_Text Install a configuration profile to disable the screenshot and screen recording. Configuration Profile Key: allowScreenShot Not_Reviewed Vuln_Num V-288457 Rule_ID SV-288457r1287786_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must implement the management setting: disable Camera. Vuln_Discuss Authorizing official (AO) approval is required before the Apple device camera can be enabled for a specific user or group of users based on a risk assessment of the operational environment. Camera use may lead to the exposure of sensitive DoW information in some operational environments. SFR ID: FMT_SMF.1.1 #47 Check_Content Determine if the site AO has approved the use of Apple device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, this requirement is not applicable. This is a supervised-only control. If the iPhone or iPad being reviewed is not supervised by the MDM, this control is automatically a finding (if the AO has not approved the use of Apple device cameras). If the iPhone or iPad being reviewed is supervised by the MDM, follow these procedures: This check procedure is performed on both the device management tool and the iPhone. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow Camera" is unchecked. On the iPhone: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Verify "Camera not allowed" is listed. If the AO has not approved Apple device camera use and "Allow camera" is listed in the management tool and "Camera not allowed" is not listed on the Apple device, this is a finding. Fix_Text If the AO has not approved the use of Apple device camera, install a configuration profile to disable camera use. This is a supervised-only control. Configuration Profile Key: allowCamera Not_Reviewed Vuln_Num V-288458 Rule_ID SV-288458r1287789_rule Severity medium Rule_Title Apple iOS/iPadOS 27 must be configured to disable Wi-Fi Aware. Vuln_Discuss Wi-Fi Aware allows direct connections between nearby devices for fast data transfer, video streaming, and multiplayer gaming. It allows full peer-to-peer device discovery and communication where two or more devices are publishing and/or subscribing to the same known service name. There is risk that sensitive DoW information could be transferred from a DoW mobile device to a non-DoW device or from Work Profile apps on a DoW device to Personal Profile apps on a non-DoW device. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content Confirm required Wi-Fi Aware procedures have been implemented. 1. Verify site personal that have site-managed iPhones and iPads have completed required training (AIOS-27-011100). 2. Verify the site reviewed all managed iOS/iPadOS apps installed on site-managed iPhones and iPads for Wi-Fi Aware support and removed all apps that support Wi-Fi Aware. Discuss with the information system security officer (ISSO)/information system security manager (ISSM). If the site also manages the deployment of unmanaged apps on site-managed iPhones and iPads, verify unmanaged apps were also reviewed. 3. Review site app vetting procedures and verify they include review of Wi-Fi Aware capabilities in all apps. Verify apps with Wi-Fi Aware capability are disapproved for use. If the site has not reviewed current managed apps for Wi-Fi Aware capabilities or did not remove Wi-Fi Aware-capable apps, this is a finding. If the site app vetting procedures do not include a review of Wi-Fi Aware capabilities in all apps or disapprove apps with Wi-Fi Aware capability, this is a finding. Fix_Text Remove Wi-Fi Aware-capable apps on site-managed Apple iOS/iPadOS 27 devices. Follow these steps to implement this control: 1. Train all users to not accept connection requests from nearby devices. This requirement is met by AIOS-27-011100. 2a. Review all MDM managed apps deployed to site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. Note: At the current time, there is no management API/key to disable Wi-Fi Aware on Apple devices. 2b. If a site manages unmanaged apps on site iPhones and iPads, review all unmanaged apps deployed on site iPhones and iPads. If an app supports Wi-Fi Aware, it must be removed from all site devices. 3a. For managed apps being reviewed for approval, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads. 3b. If a site manages unmanaged apps on site iPhones and iPads, the site app vetting process must determine if the app supports Wi-Fi Aware. If Wi-Fi Aware is supported, the app must not be approved for use on site iPhones and iPads. Not_Reviewed Vuln_Num V-288459 Rule_ID SV-288459r1287874_rule Severity medium Rule_Title The Apple iOS/iPadOS 27 device must be configured to disable web-based artificial intelligence (AI) interactions. Vuln_Discuss Sensitive DoW data could be exposed when an AI app processes device data in the cloud. SFR ID: FMT_SMF_EXT.1.1 #47 Check_Content On the mobile device, try to browse unauthorized AI URLs. Examples to input: chatgpt.com, claude.ai, gemini.google.com, v0.dev. Verify the unauthorized AI websites cannot be reached. If the iPhone/iPad has not been configured to disable web-based AI interactions, this is a finding. Fix_Text Configure the Apple iOS/iPadOS 27 device to disable web-based AI interactions. ***Method 1: 1. In the MDM server, navigate to the iOS/iPadOS Device Configuration Profiles. 2. Locate the Web Content filter payload. 3. Select the Blacklist (or "Never Allow" or Blocklist") option. 4. Enter specific domain names of AI websites to be blocked, e.g., chatgpt.com, claude.ai, gemini.google.com, v0.dev. 5. Deploy the profile to managed devices. This prevents Safari, Chrome, and third-party browsers from loading the listed URLs. ***Method 2: Chrome-Specific URL Policies If the site manages Chrome at the enterprise level, direct Chrome policies can be pushed to restrict browsing. 1. Navigate to the MDM server Web Content Filter settings. 2. Select Google Chrome for iOS. 3. Apply the URLBlocklist policy. 4. Enter the AI website domains in the policy payload to block them within the Chrome app exclusively. Not_Reviewed