The MDM agent must wipe a managed mobile device if the MDM agent does not connect to the MDM server in 90 days or less.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32745	WIR-WMS-MDM-01	SV-43091r1_rule	ECWN-1 IAAC-1	Low

Description
If a mobile device has not connected to the management server within the specified time period, this is an indication that the device is no longer being used, has been lost, or has been stolen. To protect possible sensitive data on the device from being compromised, the device should be wiped.

STIG	Date
Mobile Device Management (MDM) Server Security Technical Implementation Guide (STIG)	2013-05-08

Details

Check Text ( C-41077r5_chk )
1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy. 2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the policy setting that will wipe the mobile device is set to wipe if the MDM agent does not connect to the server in 90 days or less. The check procedure will depend on the MDM product used. Mark as a finding if each security policy is not set as required. Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database. For the Good Technology MDM server: Verify the “iOS Connectivity Verification” rule is listed. (Note that the rule title does not have to be exact.) - Open the rule by checking the box next to the rule, then click on Edit. •Platform: iPhone •Check to Run: Connectivity Verification •Verify “Failure Action” is set to “Wipe Enterprise Data” •Verify Check Every is set to “90 days”

Check Text ( C-41077r5_chk )

1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy.
2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the policy setting that will wipe the mobile device is set to wipe if the MDM agent does not connect to the server in 90 days or less. The check procedure will depend on the MDM product used.

Mark as a finding if each security policy is not set as required.

Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database.

For the Good Technology MDM server:
Verify the “iOS Connectivity Verification” rule is listed. (Note that the rule title does not have to be exact.)
- Open the rule by checking the box next to the rule, then click on Edit.
•Platform: iPhone
•Check to Run: Connectivity Verification
•Verify “Failure Action” is set to “Wipe Enterprise Data”
•Verify Check Every is set to “90 days”

Fix Text (F-36623r3_fix)
Set each iOS security policy on the MDM server to wipe the device if the MDM agent does not connect to the server in 90 days or less.