The DOD Mobile Service Provider must not allow BYOADs in facilities where personally owned mobile devices are prohibited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259757	AIOS-17-800220	SV-259757r943596_rule		Medium

Description
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Follow local physical security procedures regarding allowing or prohibiting personally owned mobile devices in a DOD facility. If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using personal devices is unacceptable, this could lead to the exposure of sensitive DOD data. SFR ID: FMT_SMF_EXT.1.1 #47

Description

DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Follow local physical security procedures regarding allowing or prohibiting personally owned mobile devices in a DOD facility. If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using personal devices is unacceptable, this could lead to the exposure of sensitive DOD data. SFR ID: FMT_SMF_EXT.1.1 #47

STIG	Date
Apple iOS/iPadOS 17 BYOAD Security Technical Implementation Guide	2024-01-31

Details

Check Text ( C-63493r943594_chk )
Verify the DOD Mobile Service Provider or information system security officer (ISSO)/information system security manager (ISSM) do not allow BYOADs in facilities where personally owned mobile devices are prohibited. If the DOD Mobile Service Provider or ISSO/ISSM allows BYOADs in facilities where personally owned mobile devices are prohibited, this is a finding.

Fix Text (F-63400r943595_fix)
Do not allow BYOADs in facilities where personally owned mobile devices are prohibited.