The EMM system supporting the iOS/iPadOS 16 BYOAD must be configured to only wipe managed data and apps and not unmanaged data and apps when the user's access is revoked or terminated, the user no longer has the need to access DOD data or IT, or the user reports a registered device as lost, stolen, or showing indicators of compromise.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257096	AIOS-16-800130	SV-257096r904033_rule		Low

Description
DOD policy requires the protection and privacy of personal data and activities to the maximum extent possible on BYOADs. Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(5). SFR ID: FMT_SMF_EXT.1.1 #47

STIG	Date
Apple iOS/iPad OS 16 MDFPP 3.3 BYOAD Security Technical Implementation Guide	2023-08-14

Details

Check Text ( C-60781r904031_chk )
Verify the EMM system administrators supporting the iOS/iPadOS 16 BYOAD have been trained to only wipe managed data and apps when the user's access is revoked or terminated, the user no longer has the need to access DOD data or IT, or the user reports a registered device as lost, stolen, or showing indicators of compromise. If the EMM system administrators supporting the iOS/iPadOS 16 BYOAD have not been trained to only wipe managed data and apps, this is a finding.

Check Text ( C-60781r904031_chk )

Verify the EMM system administrators supporting the iOS/iPadOS 16 BYOAD have been trained to only wipe managed data and apps when the user's access is revoked or terminated, the user no longer has the need to access DOD data or IT, or the user reports a registered device as lost, stolen, or showing indicators of compromise.

If the EMM system administrators supporting the iOS/iPadOS 16 BYOAD have not been trained to only wipe managed data and apps, this is a finding.

Fix Text (F-60722r904032_fix)
Train EMM system administrators supporting the iOS/iPadOS 16 BYOAD to only wipe managed data and apps when the user's access is revoked or terminated, the user no longer has the need to access DOD data or IT, or the user reports a registered device as lost, stolen, or showing indicators of compromise.