UCF STIG Viewer Logo

Apple iOS 7 STIG


Overview

Date Finding Count (29)
2014-08-26 CAT I (High): 0 CAT II (Med): 22 CAT III (Low): 7
STIG Description
This STIG contains technical security controls required for the use of Apple iOS 7 devices (iPhone and iPad) in the DoD environment when managed by an approved mobile management server. Comments or proposed revisions to this document should be sent via email to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-43820 Medium Apple iOS must disallow more than an organizationally-defined quantity of sequential numbers (e.g., 456) in the device unlock password.
V-43223 Medium Apple iOS must not allow non-DoD applications to access DoD data.
V-43222 Medium Apple iOS must not allow the device to be unlocked using a fingerprint.
V-43221 Medium Apple iOS must not display calendar information while the device is locked.
V-43220 Medium Apple iOS must not display notifications while the device is locked.
V-43209 Medium Apple iOS must wipe all storage media after 10 consecutive, unsuccessful attempts to unlock the mobile device.
V-43208 Medium Only DoD PKI issued or DoD approved server authentication certificates must be installed on DoD mobile operating system devices.
V-43225 Medium Apple iOS must have Airdrop disabled.
V-43224 Medium Apple iOS must encrypt iTunes backups.
V-43205 Medium Apple iOS must lock the device after 15 minutes of inactivity.
V-43207 Medium Apple iOS must enforce a minimum length of 6 for the device unlock password.
V-43218 Medium Apple iOS must not automatically upload new photos to iCloud.
V-43219 Medium Apple iOS must not create photo streams to share with other people, or subscribe to other peoples shared photo streams.
V-43226 Medium An iOS app must display the DoD notice and consent banner exactly as specified at startup device unlock.
V-43234 Medium The iOS app used to support the DoD notice and consent banner must either prevent access to a frequently used service or notify another device that acceptance of the user agreement has occurred.
V-43212 Medium Apple iOS must disable voice-activated assistant functionality when the device is locked (Siri).
V-43213 Medium Apple iOS must disable voice-activated assistant functionality when the device is locked (Voice Dialing).
V-43210 Medium Apple iOS must employ mobile device management services to centrally manage security relevant configuration and policy settings.
V-43211 Medium Apple iOS must require a valid password be successfully entered before the mobile device data is unencrypted.
V-43216 Medium Apple iOS must have cloud document syncing features disabled.
V-43217 Medium Apple iOS must have cloud keychain syncing features disabled.
V-43215 Medium Apple iOS must have the cloud backup feature disabled.
V-43228 Low Apple iOS must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System.
V-43227 Low An iOS app must retain the notice and consent banner on the screen until the user executes a positive action to manifest agreement by selecting a box indicating acceptance.
V-43230 Low Apple iOS must not allow diagnostic data to be sent to an organization other than DoD.
V-43231 Low Apple iOS must limit advertisers tracking abilities.
V-43232 Low Apple iOS must not allow DoD applications to access non-DoD data.
V-43233 Low Apple iOS must disable automatic completion of Safari browser passcodes.
V-43229 Low Apple iOS must disable screen capture.