Required procedures must be followed for the disposal of CMDs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24958	WIR-SPP-004	SV-30695r3_rule	ECSC-1 PECS-1	Low

Description
If appropriate procedures are not followed prior to disposal of a CMD, an adversary may be able to obtain sensitive DoD information or learn aspects of the configuration of the device that might facilitate a subsequent attack.

STIG	Date
General Mobile Device Policy (Non-Enterprise Activated) Security Technical Implementation Guide	2013-03-19

Details

Check Text ( C-31118r5_chk )
This requirement applies to mobile operating system (OS) CMDs. Prior to disposing of a CMD (for example, if a CMD is transferred to another DoD or government agency), follow the disposal procedures found in the STIG Technology Overview document of the STIG for the CMD of interest. For example, look in the BlackBerry Overview document in the BlackBerry STIG for the disposal procedures for a BlackBerry smartphone. Interview the IAO. Verify proper procedures are being followed and the procedures are documented. Check to see how retired, discarded, or transitioned CMDs were disposed of during the previous 6 – 12 months and verify compliance with requirements. Mark as a finding if procedures are not documented or if documented, they were not followed.

Check Text ( C-31118r5_chk )

This requirement applies to mobile operating system (OS) CMDs.

Prior to disposing of a CMD (for example, if a CMD is transferred to another DoD or government agency), follow the disposal procedures found in the STIG Technology Overview document of the STIG for the CMD of interest. For example, look in the BlackBerry Overview document in the BlackBerry STIG for the disposal procedures for a BlackBerry smartphone.

Interview the IAO.

Verify proper procedures are being followed and the procedures are documented.

Check to see how retired, discarded, or transitioned CMDs were disposed of during the previous 6 – 12 months and verify compliance with requirements.

Mark as a finding if procedures are not documented or if documented, they were not followed.

Fix Text (F-27586r3_fix)
Follow required procedures prior to disposing of a CMD or transitioning it to another user.