The MDM agent must wipe a managed mobile device if the MDM agent cannot connect to the MDM server within the specified time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32745	WIR-WMS-MDM-01	SV-43091r1_rule	ECWN-1 IAAC-1	Low

Description
If a mobile device has not connected to the management server within the specified time period, this is an indication that the device is no longer being used, has been lost, or has been stolen. To protect possible sensitive data on the device from being compromised, the device should be wiped.

STIG	Date
Mobile Device Management (MDM) Server Security Technical Implementation Guide (STIG)	2012-07-20

Details

Check Text ( C-41077r3_chk )
This is an iOS security policy set check. Recommend that all checks related to iOS security policy set rules be reviewed using the following procedure. 1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy using the following procedure: -Have the SA identify STIG compliant and non compliant policies on the server. --Log into the MDM server console. --Click on the Policies tab. --View all iOS security policies on the server. -Note: STIG-compliant policies should be identified as such in the policy title. An example is STIG_iOS_Policy. It is recommended that all non-STIG/ISCG policies be deleted. 2. Select each security policy iOS devices are assigned to, and in turn, verify the required settings are in the policy. -Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy in the Findings Details section in VMS/Component Provided Tracking Database. -Launch the MDM console and click on the Policies tab. -Select an iOS security policy to review. -Verify the policy setting that will wipe the mobile device is set to wipe if the MDM agent does not connect to the server in 90 days or less. The check procedure will depend on the MDM product used. Mark as a finding if each security policy is not set as required.

Check Text ( C-41077r3_chk )

This is an iOS security policy set check. Recommend that all checks related to iOS security policy set rules be reviewed using the following procedure.
1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy using the following procedure:
-Have the SA identify STIG compliant and non compliant policies on the server.
--Log into the MDM server console.
--Click on the Policies tab.
--View all iOS security policies on the server.
-Note: STIG-compliant policies should be identified as such in the policy title. An example is STIG_iOS_Policy. It is recommended that all non-STIG/ISCG policies be deleted.

2. Select each security policy iOS devices are assigned to, and in turn, verify the required settings are in the policy.
-Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy in the Findings Details section in VMS/Component Provided Tracking Database.
-Launch the MDM console and click on the Policies tab.
-Select an iOS security policy to review.

-Verify the policy setting that will wipe the mobile device is set to wipe if the MDM agent does not connect to the server in 90 days or less. The check procedure will depend on the MDM product used.

Mark as a finding if each security policy is not set as required.

Fix Text (F-36623r1_fix)
Set each iOS security policy on the MDM server to wipe the device if the MDM agent does not contact the server within the specified time period.