| Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less. |
This check procedure is performed on both the Apple iOS management tool and the Apple iOS device.
Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.
In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes.
Alternatively, locate the text "maxGracePeriod" and "maxInactivity" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example:
Here, 5 + 5 = 10; this meets the requirement.
On the Apple iOS device:
1. Open the Settings app.
2. Tap "General".
3. Tap "Profiles" or "Profiles & Device Management" or "Device Management".
4. Tap the Configuration Profile from the iOS management tool containing the password policy.
5. Tap "Restrictions".
6. Tap "Passcode".
7. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes.
Note: On some iOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement.
On the management server, if the sum of the "Auto-Lock" and "Require Passcode" values is not between 1 and 15 minutes in the iOS management tool, if the sum of the values assigned to "maxGracePeriod" and "maxInactivity" is not between 1 and 15 minutes in the configuration profile, or on the iOS device, if the sum of the values assigned to "Auto-Lock" and "Require Passcode" is not between 1 and 15 minutes, this is a finding.