| V-35960 | High | The organization must have written policy or training material that states non-enterprise activated CMD are not permitted to connect to DoD networks. | Non-enterprise activated CMDs are not authorized to connect to DoD networks or to DoD computers that will be connected to DoD networks, because they do not have required security controls. There... |
| V-35976 | High | The organization must not use DoD-issued software certificates for Non-enterprise activated CMDs. | If DoD issued certificates are utilized, the device may be able to connect to sites/systems that are otherwise prohibited without the certificate. Non-enterprise activated CMDs are not authorized... |
| V-35970 | High | The organization must follow the incident handling policy if classified information is found on mobile devices. | In spite of the best security policies, restrictive controls, and random review procedures, incidents of leakage of classified data to unclassified CMDs are bound to occur. In these instances, the... |
| V-35987 | High | The organization must develop procedures for ensuring mobile operating systems, mobile applications, and mobile device management agents on managed mobile devices are updated within an organization defined period after the updates/patches are available. | Patches and fixes to an operating system (OS) or application are necessary elements in maintaining the security posture of a system. If one system has been compromised or exposed to a potential... |
| V-35991 | High | The organizations physical security policy must state that CMDs with cameras must not be allowed in any SCIF or other areas where classified documents or information is stored, transmitted, or processed. | CMDs with embedded cameras can be used to photograph classified material and can be easily concealed. Classified information could be compromised. Photos may also be taken of the areas that would... |
| V-35938 | High | The organization must maintain a SIPRNet connection approval package with the Classified Connection Approval Office (CCAO) when connecting a Secure WLAN (SWLAN) to SIPRNet. | The CCAO approval process provides assurance that the SWLAN use is appropriate and does not introduce unmitigated risks into the SIPRNet. |
| V-35933 | High | The organization must remove the wireless interface on computers with an embedded wireless system before the computer is used to transfer, receive, store, or process classified information. | The majority of consumer based laptops have wireless network interface cards (NICs) integrated with the computer's motherboard. Although the system administrator may disable these embedded NICs,... |
| V-35935 | High | The organization must ensure all wireless systems connected to a DoD network (including associated peripheral devices, operating system, applications, network/PC connection methods, and services) are approved by the approval authority prior to installation and use for processing DoD information. | Unauthorized wireless systems expose DoD networks to attack. The DAA and appropriate commanders must be aware of all wireless systems used at the site. DAAs should ensure a risk assessment is... |
| V-35958 | High | The organization must have a policy forbidding the use of wireless personal area network (PAN) devices, such as near-field communications (NFC), Bluetooth, and ZigBee, to send, receive, store, or process classified information. | Classified data could be compromised since wireless PAN devices do not meet DoD encryption requirements for classified data. |
| V-35954 | High | The organization must not permit CMDs in Sensitive Compartmented Information Facilities (SCIFs), unless approved by the DAA and SCIF Cognizant Security Authority (CSA) in accordance with Intelligence Community Directive 503 and Intelligence Community Standard (ICS) 705.1. | Emanations from computing devices in the secured area may be transmitted or picked up inadvertently by wireless devices. |
| V-35955 | High | The organization must have written policy or training material stating CMDs must not be used to receive, transmit, or process classified messages unless specifically approved by NSA for such purposes and NSA-approved transmission and storage methods are used. | Wireless devices will not be used for processing classified data unless approved for such use as classified data could be compromised or exposed to unauthorized personnel. |
| V-35969 | Medium | The organization must assign personnel to perform reviews/inspections of mobile devices in facilities containing information systems processing, storing, or transmitting classified information. | The organization's access control procedures and security policies establish the requirement to (i) control the use of various mobile devices and connected or imbedded capabilities, and (ii)... |
| V-35961 | Medium | The organization must not permit non-enterprise activated CMDs to process or store DoD sensitive information, including DoD email. | Non-enterprise activated CMDs are not authorized to process any information other than non-sensitive because they do not have required security controls to avoid tampering and malicious intent.... |
| V-35962 | Medium | The organization must require that mobile devices used in facilities containing information systems processing, storing, or transmitting classified information, and the information stored on those devices, are subject to random reviews/inspections by organization defined security officials. | The organization's access control procedures and security policies establish the requirement to control the use of various mobile devices and connected or imbedded capabilities. These policies and... |
| V-35965 | Medium | The organization must store and maintain a configuration baseline of each CMD, including application software. | An integrity baseline scan must be maintained, so the baseline can be compared to any subsequent scan to identify any anomalies or determine if there are any security vulnerability trends or... |
| V-35974 | Medium | The organization must have a CMD Personal Use Policy that specifies restrictions on the use of personal email. | Malware can be introduced to a DoD enclave via personally owned applications and personal web site accounts. In addition, sensitive DoD data could be exposed, altered, or exfiltrated by the same... |
| V-35972 | Medium | The organization must establish usage restrictions for organization controlled CMD. | In order to effectively control access to its information systems, the organization must define usage restrictions for CMDs. In the absence of such restrictions, users could execute unauthorized... |
| V-35973 | Medium | The organization must have a CMD Personal Use Policy that specifies what types of personal files are permitted on the device. | Malware can be introduced to a DoD enclave via personally-owned applications and personal website accounts. In addition, sensitive DoD data could be exposed, altered, or exfiltrated by the same... |
| V-35971 | Medium | The organization must establish a standard operating procedure (SOP) for Classified Message Incidents (CMI) on CMDs. | When a data spill occurs on a CMD, classified or sensitive data must be protected to prevent disclosure. After a data spill, the CMD must either be wiped using approved procedures, or destroyed if... |
| V-35978 | Medium | The organization must establish implementation guidance for organization-controlled portable and mobile devices. | In order to effectively manage and control its portable and mobile devices, the organization must develop and publish implementation guidance for these devices. Lacking implementation guidance,... |
| V-35979 | Medium | The organization must establish standard operating procedures for provisioning mobile devices. | A trusted provisioning process must be the foundation for installation of the mobile operating system and applications on the device during provisioning (whether tethered or over-the-air (OTA)).... |
| V-35989 | Medium | A policy must exist prohibiting non-enterprise activated (NEA) CMDs connecting to DoD devices containing sensitive or classified information or devices that connect to DoD networks. | As non-enterprise activated CMDs do not have the required and necessary security controls applied to the devices, in all cases, DoD data is at risk of compromise or exfiltration if those devices... |
| V-35988 | Medium | An authorization process must be developed and published that states the process to obtain approval before CMDs can connect to the organizations information system(s). | In order to protect their information systems, organizations must have a process in place ensuring mobile devices adhere to implementation guidance, meet published usage restrictions, and are... |
| V-35983 | Medium | The organization must develop policy to restrict CMD Instant Messaging (IM) client applications to connect to only security-compliant, DoD-controlled IM servers. | Non-DoD IM servers can be located anywhere in the world and may be under an adversary's control. If a DoD CMD IM client connects to a non-DoD IM server, malware could be installed on the CMD from... |
| V-35982 | Medium | The organizations DAA must approve the use of software PKI certificates on enterprise-activated CMDs prior to provisioning CMDs with DoD PKI digital certificates. | S/MIME provides the user with the ability to digitally sign and encrypt email messages, to verify the digital signatures on received messages, and to decrypt messages received from others if those... |
| V-35981 | Medium | Develop policy that states CMD software updates must only originate from DoD approved sources. | Users must not accept over-the-air (OTA) wireless software updates from the wireless carrier or other non-DoD sources unless the updates have been tested and DoD approved. Unauthorized/unapproved... |
| V-35986 | Medium | The organization must make a risk-based determination, prior to installation of applications on non-enterprise activated CMDs. | CMD applications can be written and published very quickly without a thorough life cycle management process or security assessment. It is critical that all applications that reside on CMDs go... |
| V-35985 | Medium | The organization must perform a security risk analysis on a mobile operating system (OS) application by the DAA or DAA-authorized approval authority prior to the application being approved for use. | Non-approved applications can contain malware. Approved applications should be reviewed and tested by the approving authority to ensure they do not contain malware, spyware, or have unexpected... |
| V-35984 | Medium | The organization must obtain approval from the DAA or Command IT Configuration Control Board prior to installing a software application on a mobile device. | Core applications are applications included in the CMD operating system. Applications added by the wireless carrier are not considered core applications. A security risk analysis must be performed... |
| V-35910 | Medium | The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted. | Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device.... |
| V-35912 | Medium | The organization must make a risk-based determination for applications before they are accredited by the DAA prior to distribution or installation on a CMD. | CMD applications can be written and published very quickly without a thorough life cycle management process or security assessment. It is critical that all applications that reside on CMDs go... |
| V-35919 | Medium | The organization must monitor for unauthorized wireless connections to the information system at an organization defined time period. | DoD networks are at risk, and DoD data could be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to, or attempting to, connect to... |
| V-35990 | Medium | The organization must define locations the organization deems to be of significant risk to DoD information systems, in accordance with organizational policies and procedures. | Given the continuous threat level in today's global environment, there are certain locations presenting significant risks to an organization's personnel, equipment, and data. To afford an... |
| V-35992 | Medium | The organization must apply organization defined inspection and preventative measures to mobile devices returning from locations the organization deems to be of significant risk to DoD information systems. | Despite the implementation of viable countermeasures on mobile devices, upon return from a high risk location, each device should be treated as if it has been compromised. The mobile device should... |
| V-35993 | Medium | The organization must produce a written policy and training material that states CMDs that are classified as non-enterprise activated must not be used to send, receive, store, or process sensitive/FOUO or classified data and information or connect to DoD networks. | Some CMDs are not authorized to store or process sensitive DoD data and information because they do not have required security controls to protect the data/information. There is a high risk that... |
| V-35994 | Medium | The organization must produce a written policy and training material that states CMDs classified as non-enterprise activated must not access DoD email systems. | Some CMDs are not authorized to connect to DoD email systems because they do not have required security controls. There is a high risk of introducing malware on a DoD email system or of... |
| V-35997 | Medium | The organization must ensure all non-enterprise activated CMD users complete Operational Security (OPSEC) training that provides use guidelines and vulnerability mitigation techniques. | Improper use of CMD devices can compromise both the CMD and the network, as well as, expose DoD data to unauthorized individuals. Without adequate OPSEC training, users are more likely to engage... |
| V-35928 | Medium | The organization must confine Wi-Fi and Bluetooth communications to organization-controlled boundaries. | Wireless technologies controlled by this requirement are only Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired network, and since the open airwaves are... |
| V-35924 | Medium | The organization must establish usage restrictions for wireless access. | Wireless security has additional vulnerability because of transmission over an open medium accessible by all, yielding a broader threat profile. Without a methodology for the deployment and usage... |
| V-35921 | Medium | The organization must document and take appropriate action if an unauthorized wireless connection is discovered. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35920 | Medium | The organization must define a time period for monitoring of unauthorized wireless connections to information systems, including scans for unauthorized wireless access points. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35922 | Medium | The organization must define the appropriate action(s) to be taken if an unauthorized wireless connection is discovered. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35930 | Medium | The organization concept of operations (CONOPS) or site security plan must include guidance that signal amplification, antenna configuration, or other techniques must not be modified in Bluetooth radios that could affect signal detection or interception. | If Bluetooth radio modifications have been made, security personnel cannot predict potential vulnerabilities of the system due to lack of security analysis of the modified state. |
| V-35931 | Medium | The organization must use FIPS 140-2 validated cryptographic modules for unclassified DoD data in transit over Bluetooth (or ZigBee) devices. | FIPS validation provides assurance that the cryptographic modules are implemented correctly and resistant to compromise. Failure to use FIPS 140-2 validated cryptographic modules makes it more... |
| V-35934 | Medium | The organization must establish implementation guidance for wireless access. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35946 | Medium | The organization must authorize wireless access to the information system prior to connection. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35945 | Medium | The organization must monitor for unauthorized wireless access to DoD networks. | DoD networks are at risk for intrusion and DoD data may be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to, or attempting to,... |
| V-35944 | Medium | The DoD component must employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks. | DoD networks are at risk for intrusion and DoD data may be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to, or attempting to,... |
| V-35943 | Medium | The DoD component must employ a wireless intrusion detection system. | DoD networks are at risk for intrusion and DoD data may be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to, or attempting to,... |
| V-35942 | Medium | The organization must only procure and deploy WPA2-Enterprise certified WLAN equipment and software for wireless systems that connect directly to DoD networks. | The Wi-Fi Alliance WPA2-Enterprise certification means the WLAN equipment can support DoD security protocol and encryption requirements, most notably EAP-TLS and AES-CCMP. If the equipment has not... |
| V-36003 | Medium | The organization must ensure physical security controls are implemented for Secure WLAN (SWLAN) access points. | If an adversary is able to gain physical access to a SWLAN device, he/she may be able to compromise the device in a variety of ways, some of which could enable the adversary to obtain classified... |
| V-36002 | Medium | The organization must secure all wireless network devices, such as wireless Intrusion Detection System (IDS) and wireless routers, access points, gateways, and controllers to prevent tampering or theft, or must be located in a secure room with limited access. | DoD data and the network could be exposed to attack if wireless network devices are not physically protected. The Network Security Officer (NSO) will ensure all wireless network devices (e.g.,... |
| V-35959 | Medium | The organization must have an access control security policy requiring approval from the appropriate authorizing official(s) for the connection of unclassified mobile devices to unclassified information systems. | Mobile/portable computing and communications devices (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, digital cameras, etc.) require specific approval for use,... |
| V-35956 | Medium | The organization must not permit operation of wireless devices in areas where classified information is electronically stored, processed, or transmitted unless operation is in accordance with DAA-approved CTTA restrictions at the site. | The operation of electronic equipment and emanations must be controlled in and around areas where sensitive information is kept or processed. Ensure wireless devices are not operated in areas... |
| V-35957 | Medium | The organization must have a policy and connection approval process prohibiting connection of unclassified mobile devices to classified information systems. | Mobile/portable computing and communications devices with information storage capability (e.g., notebook/laptop computers, personal digital assistants, cellular telephones, and digital cameras,... |
| V-35950 | Medium | The organization must notify the Certified TEMPEST Technical Authority (CTTA) before a Secure WLAN (SWLAN) becomes operational and connected to the SIPRNet. | A TEMPEST review must be completed or classified information may be at risk of exposure. |
| V-35952 | Medium | The organization must enforce requirements for wireless connections to the information system. | Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired... |
| V-35953 | Medium | The organization must ensure the network access control solution supports wireless clients and solutions if wireless networking is implemented. | Without a secure network access solution implemented, rogue and/or non-policy compliant devices can gain access to the network and its resources. |
| V-35968 | Low | The organization must review MDM integrity scan results at least daily. | If the organization does not review the integrity tool scans, an attacker may not be noticed by the administrator, and gain control of DoD data or compromise the system. |
| V-35963 | Low | The organization must periodically conduct manual audits of CMDs to verify the CMD is not running unauthorized software or has otherwise not been modified in an unauthorized manner. | The organization's access control procedures and security policies establish the requirement to control the use of various mobile devices and connected or imbedded capabilities. These policies and... |
| V-35964 | Low | The organization, at the mobile device management (MDM) server site, must verify that local sites, where CMDs are provisioned, issued, and managed, are conducting annual self assessments. | The security integrity of the CMD system depends on whether local sites, where CMDs are provisioned and issued, are complying with IA requirements. The risk of both malware being introduced on a... |
| V-35967 | Low | The organization must ensure WIDS sensor scan results are saved for at least 6 months (one year recommended). | If organizations do not maintain scan logs, it cannot be determined if intrusion detection findings are isolated and harmless events, or a more sustained, methodical attack on the system. |
| V-35966 | Low | The organization must maintain results and mitigation actions, from CMD integrity validation tool scans on site managed mobile devices, for 6 months (one year recommended). | Scan results must be maintained, so auditors can verify mitigation actions have been completed, so a scan can be compared to a previous scan, and to determine if there are any security... |
| V-35977 | Low | The organization must explicitly specify in each sites physical security policy whether CMDs, containing cameras, are permitted at that site. | CMDs with cameras are easily used to photograph sensitive information and areas if not addressed. Sites must establish, document, and train on how to mitigate this threat. |
| V-35975 | Low | The organizations CMD Personal Use Policy must be approved by its DAA. | Malware can be introduced on a DoD enclave via personally-owned applications and personal website accounts. In addition, sensitive DoD data could be exposed by the same malware.
The DoD... |
| V-35980 | Low | The organization must develop policy which ensures a CMD is wiped prior to issuance to DoD personnel. | Malware may be installed on a device at some point between shipping from the factory and delivery to DoD. The malware could result in the compromise of sensitive DoD information or result in the... |
| V-35911 | Low | The organization must define networking protocols within the information system deemed to be non-secure for remote access into DoD networks. | Some networking protocols are considered less secure than others (e.g., Bluetooth, peer-to-peer, etc.). In its access control policy and security procedures addressing remote access to the... |
| V-35913 | Low | The organizations wireless metropolitan area network (WMAN) system accreditation must include a Transmission Security (TRANSEC) vulnerability analysis, if the WMAN system operates in a tactical environment. | If a TRANSEC vulnerability analysis has not been completed, the system may not be designed or configured correctly to mitigate exposure of DoD data, or may be vulnerable to a wireless attack. The... |
| V-35998 | Low | The organization must verify each of its CMD users has completed annual CMD user training. | Users are the first line of security controls for CMD systems. They must be trained in using CMD security controls or the system could be vulnerable to attack. All CMD users must receive security... |
| V-35999 | Low | The organization must execute its incident response plan or applicable Standard Operating Procedure (SOP) when a CMD is reported lost or stolen. | If procedures for lost or stolen CMDs are not followed, it is more likely that an adversary could obtain the device and use it to access DoD networks or otherwise compromise DoD information... |
| V-35995 | Low | The organization must ensure users receive training before they are authorized to access a DoD network with a CMD. | Improper use of wireless remote access to a DoD network can compromise both the wireless client and the network, as well as, expose DoD data to unauthorized individuals. Without adequate training,... |
| V-35996 | Low | The organization must ensure the MDM server administrator receives required training annually. | The security posture of the MDM server could be compromised if the administrator is not trained to follow required procedures. |
| V-35929 | Low | The organization concept of operations (CONOPS) or site security plan must include information that Bluetooth devices use only Class 2 or 3 standard radios. | A key security control for DoD Bluetooth devices is to limit the broadcast area of the Bluetooth signal to the personal area of the user (approximately 30 feet or less). Class 1 radios broadcast... |
| V-35939 | Low | The organization must reasonably size and constrain the Wireless Metropolitan Area Network (WMAN) signals to their intended coverage area. | Wireless signals can be intercepted more easily by an adversary than a wired signal due to the nature of the technology. DoD data may be at risk of exposure if the signals are not constrained to... |
| V-35932 | Low | The organization must obtain U.S. Forces Command (USFORSCOM) or host nation approval for the use of wireless equipment prior to operation of such equipment outside the United States and Possessions (USP). | When using a wireless system outside of the US&P, host nation wireless spectrum regulations must be followed. Otherwise, the system could interfere with, or be disrupted by, host nation... |
| V-35936 | Low | The organizations wireless policy or wireless remote access policy must include information on locations CMD Wi-Fi access is approved or disapproved. | If the policy does not include information on Wi-Fi security controls, it is more likely that the security controls will not be implemented properly. Without appropriate controls, Wi-Fi is... |
| V-35937 | Low | The organization must have a written policy or training materials stating Bluetooth must be disabled on all applicable devices unless they employ FIPS 140-2 validated cryptographic modules for data in transit. | Policy and training provide assurance that security requirements will be implemented in practice. Failure to use FIPS 140-2 validated cryptography makes data more vulnerable to security breaches... |
| V-35949 | Low | The organization must have a wireless remote access policy signed by the site DAA, Commander, Director, or other appropriate authority. | Wireless clients, DoD data, and the DoD network could be compromised if operational policies for the use of wireless remote access are not documented by the site.
A site's Remote Access Policy... |
| V-35948 | Low | The organization must include each wireless device connecting to a DoD network in the applicable site security plan. | The DAA and site commander must be aware of all approved wireless devices used at the site or DoD data may be exposed to unauthorized individuals. Documentation of the enclave configuration must... |
| V-35947 | Low | The organization must maintain a list of all DAA-approved wireless and non-wireless devices under their control that store, process, or transmit DoD information. | Close tracking of authorized wireless devices will facilitate the search for rogue devices. Sites must maintain precise inventory control over wireless and handheld devices used to store, process,... |
| V-35941 | Low | The Incident Response Plan (IRP) and/or SOP must have the required procedures for reporting the results of WMAN intrusion scans. | If scan results are not properly reported and acted on, the site could be vulnerable to wireless attack.
This requirement originated in DTM 08-039, "Commercial Wireless Metropolitan Area Network... |
| V-35940 | Low | The organizations WMAN system must not operate in the 3.30-3.65 GHz frequency band. | The 3.30-3.65 GHz frequency band WMAN interferes with DoD radar systems. Therefore, this range must be avoided.
This requirement originated in DTM 08-039, "Commercial Wireless Metropolitan Area... |
| V-36001 | Low | The organization must follow required procedures for the disposal of CMDs. | If appropriate procedures are not followed prior to disposal of a CMD, an adversary may be able to obtain sensitive DoD information or learn aspects of the configuration of the device that might... |
| V-36000 | Low | The organization must include procedures for lost or stolen CMDs in its Incident Response Plan or applicable Standard Operating Procedure (SOP). | Sensitive DoD data could be stored in memory on a DoD operated CMDs and the data could be compromised if required actions are not followed when a CMD is lost or stolen. Without procedures for lost... |
| V-36005 | Low | The organization must not permit personnel to operate CMD without first signing a user agreement IAW DoD CIO Memorandum, Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement, 9 May 2008. | Lack of user training and understanding of responsibilities to safeguard wireless technology is a significant vulnerability to the enclave. Once policies are established, users must be trained to... |
| V-35951 | Low | The organization must provide the DAA the results of a Certified TEMPEST Technical Authority (CTTA) TEMPEST evaluation of each WLAN system it operates. | Sensitive and/or classified information could be compromised via a TEMPEST vulnerability. |
