This check applies to any mobile OS device (smartphones, tablets, etc.).
Check a sample of 2-3 devices managed by the site to verify the device unlock password/passcode has been set to 8 or more alphanumeric characters. The exact procedure will vary, depending on the mobile OS.
Have the user show that a device unlock password/passcode has been set to 8 or more alphanumeric characters.
Mark as a finding if configuration is not set as required.
Fix Text (F-27687r5_fix)
Configure the mobile operating system to enforce a minimum length for the device unlock password. Where a security container application is used in lieu of mobile operating system protections, configure the security container application to enforce a minimum length password for entry into the application.