| V-35970 | High | The organization must follow the incident handling policy if classified information is found on mobile devices. | In spite of the best security policies, restrictive controls, and random review procedures, incidents of leakage of classified data to unclassified CMDs are bound to occur. In these instances, the... |
| V-35933 | High | The organization must remove the wireless interface on computers with an embedded wireless system before the computer is used to transfer, receive, store, or process classified information. | The majority of consumer based laptops have wireless network interface cards (NICs) integrated with the computer's motherboard. Although the system administrator may disable these embedded NICs,... |
| V-35960 | High | The organization must have written policy or training material that states non-enterprise activated CMD are not permitted to connect to DoD networks. | Non-enterprise activated CMDs are not authorized to connect to DoD networks or to DoD computers that will be connected to DoD networks, because they do not have required security controls. There... |
| V-35935 | High | The organization must ensure all wireless systems connected to a DoD network (including associated peripheral devices, operating system, applications, network/PC connection methods, and services) are approved by the approval authority prior to installation and use for processing DoD information. | Unauthorized wireless systems expose DoD networks to attack. The DAA and appropriate commanders must be aware of all wireless systems used at the site. DAAs should ensure a risk assessment is... |
| V-35987 | High | The organization must develop procedures for ensuring mobile operating systems, mobile applications, and mobile device management agents on managed mobile devices are updated within an organization defined period after the updates/patches are available. | Patches and fixes to an operating system (OS) or application are necessary elements in maintaining the security posture of a system. If one system has been compromised or exposed to a potential... |
| V-35976 | High | The organization must not use DoD-issued software certificates for Non-enterprise activated CMDs. | If DoD issued certificates are utilized, the device may be able to connect to sites/systems that are otherwise prohibited without the certificate. Non-enterprise activated CMDs are not authorized... |
| V-35958 | High | The organization must have a policy forbidding the use of wireless personal area network (PAN) devices, such as near-field communications (NFC), Bluetooth, and ZigBee, to send, receive, store, or process classified information. | Classified data could be compromised since wireless PAN devices do not meet DoD encryption requirements for classified data. |
| V-35955 | High | The organization must have written policy or training material stating CMDs must not be used to receive, transmit, or process classified messages unless specifically approved by NSA for such purposes and NSA-approved transmission and storage methods are used. | Wireless devices will not be used for processing classified data unless approved for such use as classified data could be compromised or exposed to unauthorized personnel. |
| V-35938 | High | The organization must maintain a SIPRNet connection approval package with the Classified Connection Approval Office (CCAO) when connecting a Secure WLAN (SWLAN) to SIPRNet. | The CCAO approval process provides assurance that the SWLAN use is appropriate and does not introduce unmitigated risks into the SIPRNet. |
| V-35942 | Medium | The organization must only procure and deploy WPA2-Enterprise certified WLAN equipment and software for wireless systems that connect directly to DoD networks. | The Wi-Fi Alliance WPA2-Enterprise certification means the WLAN equipment can support DoD security protocol and encryption requirements, most notably EAP-TLS and AES-CCMP. If the equipment has not... |
| V-35928 | Medium | The organization must confine Wi-Fi and Bluetooth communications to organization-controlled boundaries. | Wireless technologies controlled by this requirement are only Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired network, and since the open airwaves are... |
| V-35912 | Medium | The organization must make a risk-based determination for applications before they are accredited by the DAA prior to distribution or installation on a CMD. | CMD applications can be written and published very quickly without a thorough life cycle management process or security assessment. It is critical that all applications that reside on CMDs go... |
| V-35924 | Medium | The organization must establish usage restrictions for wireless access. | Wireless security has additional vulnerability because of transmission over an open medium accessible by all, yielding a broader threat profile. Without a methodology for the deployment and usage... |
| V-35921 | Medium | The organization must document and take appropriate action if an unauthorized wireless connection is discovered. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35920 | Medium | The organization must define a time period for monitoring of unauthorized wireless connections to information systems, including scans for unauthorized wireless access points. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35922 | Medium | The organization must define the appropriate action(s) to be taken if an unauthorized wireless connection is discovered. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35946 | Medium | The organization must authorize wireless access to the information system prior to connection. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35962 | Medium | The organization must require that mobile devices used in facilities containing information systems processing, storing, or transmitting classified information, and the information stored on those devices, are subject to random reviews/inspections by organization defined security officials. | The organization's access control procedures and security policies establish the requirement to control the use of various mobile devices and connected or imbedded capabilities. These policies and... |
| V-35965 | Medium | The organization must store and maintain a configuration baseline of each CMD, including application software. | An integrity baseline scan must be maintained, so the baseline can be compared to any subsequent scan to identify any anomalies or determine if there are any security vulnerability trends or... |
| V-35988 | Medium | An authorization process must be developed and published that states the process to obtain approval before CMDs can connect to the organizations information system(s). | In order to protect their information systems, organizations must have a process in place ensuring mobile devices adhere to implementation guidance, meet published usage restrictions, and are... |
| V-35983 | Medium | The organization must develop policy to restrict CMD Instant Messaging (IM) client applications to connect to only security-compliant, DoD-controlled IM servers. | Non-DoD IM servers can be located anywhere in the world and may be under an adversary's control. If a DoD CMD IM client connects to a non-DoD IM server, malware could be installed on the CMD from... |
| V-35982 | Medium | The organizations DAA must approve the use of software PKI certificates on enterprise-activated CMDs prior to provisioning CMDs with DoD PKI digital certificates. | S/MIME provides the user with the ability to digitally sign and encrypt email messages, to verify the digital signatures on received messages, and to decrypt messages received from others if those... |
| V-35981 | Medium | Develop policy that states CMD software updates must only originate from DoD approved sources. | Users must not accept over-the-air (OTA) wireless software updates from the wireless carrier or other non-DoD sources unless the updates have been tested and DoD approved. Unauthorized/unapproved... |
| V-35985 | Medium | The organization must perform a security risk analysis on a mobile operating system (OS) application by the DAA or DAA-authorized approval authority prior to the application being approved for use. | Non-approved applications can contain malware. Approved applications should be reviewed and tested by the approving authority to ensure they do not contain malware, spyware, or have unexpected... |
| V-35984 | Medium | The organization must obtain approval from the DAA or Command IT Configuration Control Board prior to installing a software application on a mobile device. | Core applications are applications included in the CMD operating system. Applications added by the wireless carrier are not considered core applications. A security risk analysis must be performed... |
| V-36003 | Medium | The organization must ensure physical security controls are implemented for Secure WLAN (SWLAN) access points. | If an adversary is able to gain physical access to a SWLAN device, he/she may be able to compromise the device in a variety of ways, some of which could enable the adversary to obtain classified... |
| V-36002 | Medium | The organization must secure all wireless network devices, such as wireless Intrusion Detection System (IDS) and wireless routers, access points, gateways, and controllers to prevent tampering or theft, or must be located in a secure room with limited access. | DoD data and the network could be exposed to attack if wireless network devices are not physically protected. The Network Security Officer (NSO) will ensure all wireless network devices (e.g.,... |
| V-35973 | Medium | The organization must have a CMD Personal Use Policy that specifies what types of personal files are permitted on the device. | Malware can be introduced to a DoD enclave via personally-owned applications and personal website accounts. In addition, sensitive DoD data could be exposed, altered, or exfiltrated by the same... |
| V-35971 | Medium | The organization must establish a standard operating procedure (SOP) for data spills on CMDs. | When a data spill occurs on a CMD, classified or sensitive data must be protected to prevent disclosure. After a data spill, the CMD must either be wiped using approved procedures, or destroyed if... |
| V-35919 | Medium | The organization must monitor for unauthorized wireless connections to the information system at an organization defined time period. | DoD networks are at risk, and DoD data could be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to, or attempting to, connect to... |
| V-35934 | Medium | The organization must establish implementation guidance for wireless access. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35979 | Medium | The organization must establish standard operating procedures for provisioning mobile devices. | A trusted provisioning process must be the foundation for installation of the mobile operating system and applications on the device during provisioning (whether tethered or over-the-air (OTA)).... |
| V-35910 | Medium | The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted. | Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device.... |
| V-35956 | Medium | The organization must not permit operation of wireless devices in areas where classified information is electronically stored, processed, or transmitted unless operation is in accordance with DAA-approved CTTA restrictions at the site. | The operation of electronic equipment and emanations must be controlled in and around areas where sensitive information is kept or processed. Ensure wireless devices are not operated in areas... |
| V-35950 | Medium | The organization must notify the Certified TEMPEST Technical Authority (CTTA) before a Secure WLAN (SWLAN) becomes operational and connected to the SIPRNet. | A TEMPEST review must be completed or classified information may be at risk of exposure. |
| V-35953 | Medium | The organization must ensure the network access control solution supports wireless clients and solutions if wireless networking is implemented. | Without a secure network access solution implemented, rogue and/or non-policy compliant devices can gain access to the network and its resources. |
| V-35974 | Medium | The organization must have a CMD Personal Use Policy that specifies restrictions on the use of personal email. | Malware can be introduced to a DoD enclave via personally owned applications and personal web site accounts. In addition, sensitive DoD data could be exposed, altered, or exfiltrated by the same... |
| V-35961 | Medium | The organization must not permit non-enterprise activated CMDs to process or store DoD sensitive information, including DoD email. | Non-enterprise activated CMDs are not authorized to process any information other than non-sensitive because they do not have required security controls to avoid tampering and malicious intent.... |
| V-35990 | Medium | The organization must define locations the organization deems to be of significant risk to DoD information systems, in accordance with organizational policies and procedures. | Given the continuous threat level in today's global environment, there are certain locations presenting significant risks to an organization's personnel, equipment, and data. To afford an... |
| V-35930 | Medium | The organization concept of operations (CONOPS) or site security plan must include guidance that signal amplification, antenna configuration, or other techniques must not be modified in Bluetooth radios that could affect signal detection or interception. | If Bluetooth radio modifications have been made, security personnel cannot predict potential vulnerabilities of the system due to lack of security analysis of the modified state. |
| V-35992 | Medium | The organization must apply organization defined inspection and preventative measures to mobile devices returning from locations the organization deems to be of significant risk to DoD information systems. | Despite the implementation of viable countermeasures on mobile devices, upon return from a high risk location, each device should be treated as if it has been compromised. The mobile device should... |
| V-35993 | Medium | The organization must produce a written policy and training material that states CMDs that are classified as non-enterprise activated must not be used to send, receive, store, or process sensitive/FOUO or classified data and information or connect to DoD networks. | Some CMDs are not authorized to store or process sensitive DoD data and information because they do not have required security controls to protect the data/information. There is a high risk that... |
| V-35994 | Medium | The organization must produce a written policy and training material that states CMDs classified as non-enterprise activated must not access DoD email systems. | Some CMDs are not authorized to connect to DoD email systems because they do not have required security controls. There is a high risk of introducing malware on a DoD email system or of... |
| V-35997 | Medium | The organization must ensure all non-enterprise activated CMD users complete Operational Security (OPSEC) training that provides use guidelines and vulnerability mitigation techniques. | Improper use of CMD devices can compromise both the CMD and the network, as well as, expose DoD data to unauthorized individuals. Without adequate OPSEC training, users are more likely to engage... |
| V-35977 | Low | The organization must explicitly specify in each sites physical security policy whether CMDs, containing cameras, are permitted at that site. | CMDs with cameras are easily used to photograph sensitive information and areas if not addressed. Sites must establish, document, and train on how to mitigate this threat. |
| V-35929 | Low | The organization concept of operations (CONOPS) or site security plan must include information that Bluetooth devices use only Class 2 or 3 standard radios. | A key security control for DoD Bluetooth devices is to limit the broadcast area of the Bluetooth signal to the personal area of the user (approximately 30 feet or less). Class 1 radios broadcast... |
| V-35940 | Low | The organizations WMAN system must not operate in the 3.30-3.65 GHz frequency band. | The 3.30-3.65 GHz frequency band WMAN interferes with DoD radar systems. Therefore, this range must be avoided.
This requirement originated in DTM 08-039, "Commercial Wireless Metropolitan Area... |
| V-35968 | Low | The organization must review MDM integrity scan results at least daily. | If the organization does not review the integrity tool scans, an attacker may not be noticed by the administrator, and gain control of DoD data or compromise the system. |
| V-35949 | Low | The organization must have a wireless remote access policy signed by the site DAA, Commander, Director, or other appropriate authority. | Wireless clients, DoD data, and the DoD network could be compromised if operational policies for the use of wireless remote access are not documented by the site.
A site's Remote Access Policy... |
| V-35948 | Low | The organization must include each wireless device connecting to a DoD network in the applicable site security plan or other appropriate DIACAP document. | The DAA and site commander must be aware of all approved wireless devices used at the site or DoD data may be exposed to unauthorized individuals. Documentation of the enclave configuration must... |
| V-35947 | Low | The organization must maintain a list of all DAA-approved wireless and non-wireless devices under their control that store, process, or transmit DoD information. | Close tracking of authorized wireless devices will facilitate the search for rogue devices. Sites must maintain precise inventory control over wireless and handheld devices used to store, process,... |
| V-35963 | Low | The organization must periodically conduct manual audits of CMDs to verify the CMD is not running unauthorized software or has otherwise not been modified in an unauthorized manner. | The organization's access control procedures and security policies establish the requirement to control the use of various mobile devices and connected or imbedded capabilities. These policies and... |
| V-35964 | Low | The organization, at the mobile device management (MDM) server site, must verify that local sites, where CMDs are provisioned, issued, and managed, are conducting annual self assessments. | The security integrity of the CMD system depends on whether local sites, where CMDs are provisioned and issued, are complying with IA requirements. The risk of both malware being introduced on a... |
| V-35941 | Low | The Incident Response Plan (IRP) and/or SOP must have the required procedures for reporting the results of WMAN intrusion scans. | If scan results are not properly reported and acted on, the site could be vulnerable to wireless attack.
This requirement originated in DTM 08-039, "Commercial Wireless Metropolitan Area Network... |
| V-35966 | Low | The organization must maintain results and mitigation actions, from CMD integrity validation tool scans on site managed mobile devices, for 6 months (one year recommended). | Scan results must be maintained, so auditors can verify mitigation actions have been completed, so a scan can be compared to a previous scan, and to determine if there are any security... |
| V-35913 | Low | The organizations wireless metropolitan area network (WMAN) system accreditation must include a Transmission Security (TRANSEC) vulnerability analysis, if the WMAN system operates in a tactical environment. | If a TRANSEC vulnerability analysis has not been completed, the system may not be designed or configured correctly to mitigate exposure of DoD data, or may be vulnerable to a wireless attack. The... |
| V-36001 | Low | The organization must follow required procedures for the disposal of CMDs. | If appropriate procedures are not followed prior to disposal of a CMD, an adversary may be able to obtain sensitive DoD information or learn aspects of the configuration of the device that might... |
| V-35975 | Low | The organizations CMD Personal Use Policy must be approved by its DAA. | Malware can be introduced on a DoD enclave via personally-owned applications and personal website accounts. In addition, sensitive DoD data could be exposed by the same malware.
The DoD... |
| V-36005 | Low | The organization must not permit personnel to operate CMD without first signing a user agreement IAW DoD CIO Memorandum, Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement, 9 May 2008. | Lack of user training and understanding of responsibilities to safeguard wireless technology is a significant vulnerability to the enclave. Once policies are established, users must be trained to... |
| V-35932 | Low | The organization must obtain U.S. Forces Command (USFORSCOM) or host nation approval for the use of wireless equipment prior to operation of such equipment outside the United States and Possessions (USP). | When using a wireless system outside of the US&P, host nation wireless spectrum regulations must be followed. Otherwise, the system could interfere with, or be disrupted by, host nation... |
| V-35939 | Low | The organization must reasonably size and constrain the Wireless Metropolitan Area Network (WMAN) signals to their intended coverage area. | Wireless signals can be intercepted more easily by an adversary than a wired signal due to the nature of the technology. DoD data may be at risk of exposure if the signals are not constrained to... |
| V-35936 | Low | The organizations wireless policy or wireless remote access policy must include information on locations CMD Wi-Fi access is approved or disapproved. | If the policy does not include information on Wi-Fi security controls, it is more likely that the security controls will not be implemented properly. Without appropriate controls, Wi-Fi is... |
| V-35937 | Low | The organization must have a written policy or training materials stating Bluetooth must be disabled on all applicable devices unless they employ FIPS 140-2 validated cryptographic modules for data in transit. | Policy and training provide assurance that security requirements will be implemented in practice. Failure to use FIPS 140-2 validated cryptography makes data more vulnerable to security breaches... |
| V-35967 | Low | The organization must ensure WIDS sensor scan results are saved for at least 6 months (one year recommended). | If organizations do not maintain scan logs, it cannot be determined if intrusion detection findings are isolated and harmless events, or a more sustained, methodical attack on the system. |
| V-35980 | Low | The organization must develop policy which ensures a CMD is wiped prior to issuance to DoD personnel. | Malware may be installed on a device at some point between shipping from the factory and delivery to DoD. The malware could result in the compromise of sensitive DoD information or result in the... |
| V-35911 | Low | The organization must comply with DoD ports and protocol guidance within the information system deemed to be non-secure for remote access into DoD networks. | Some networking protocols are considered less secure than others (e.g., Bluetooth, peer-to-peer, etc.). In its access control policy and security procedures addressing remote access to the... |
| V-35998 | Low | The organization must verify each of its CMD users has completed annual CMD user training. | Users are the first line of security controls for CMD systems. They must be trained in using CMD security controls or the system could be vulnerable to attack. All CMD users must receive security... |
| V-35999 | Low | The organization must execute its incident response plan or applicable Standard Operating Procedure (SOP) when a CMD is reported lost or stolen. | If procedures for lost or stolen CMDs are not followed, it is more likely that an adversary could obtain the device and use it to access DoD networks or otherwise compromise DoD information... |
| V-36000 | Low | The organization must include procedures for lost or stolen CMDs in its Incident Response Plan or applicable Standard Operating Procedure (SOP). | Sensitive DoD data could be stored in memory on a DoD operated CMDs and the data could be compromised if required actions are not followed when a CMD is lost or stolen. Without procedures for lost... |
| V-35995 | Low | The organization must ensure users receive training before they are authorized to access a DoD network with a CMD. | Improper use of wireless remote access to a DoD network can compromise both the wireless client and the network, as well as, expose DoD data to unauthorized individuals. Without adequate training,... |
| V-35996 | Low | The organization must ensure the MDM server administrator receives required training annually. | The security posture of the MDM server could be compromised if the administrator is not trained to follow required procedures. |
