V-288361

Discussion

The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #2

Check Content

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less.

This check procedure is performed on both the MDM server and the iPhone and iPad.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the MDM server, in the Declarative Device Management (DDM) configuration "Passcode", verify the sum of the values assigned to "Max grace period" and "Max inactivity" is between 1 and 15 minutes. 

On the iPhone and iPad: 
1. Open the Settings app. 
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the Configuration Profile from the MDM server containing the policy.
5. Tap "Configurations" and then "Passcode".
6. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes.

Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement.

If the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the MDM server or on the iPhone/iPad, this is a finding.