CCI-000057 in U Apple iOS-iPadOS 17 MDFPP 3-3 BYOAD V1

ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

UNCLASSIFIED

Group Title

PP-MDF-333026

Group ID

V-259765

Rule Version

AIOS-17-706700

Rule Title

Apple iOS/iPadOS 17 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.

Rule ID

SV-259765r943620_rule

Rule Severity

● Medium

Rule Weight

10.0

Vuln Discussion

The screen-lock timeout helps protect the device from unauthorized access. Devices without a screen-lock timeout provide an opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device and possibly access to DOD networks.

SFR ID: FMT_SMF_EXT.1.1 #2a

Documentable

False

Check Content

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less.

This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes.

Alternatively, locate the text "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example:

"<key>maxGracePeriod</key>

<key>maxInactivity</key>

<integer>5</integer>"

Here, 5 + 5 = 10; so this meets the requirement.

On the iPhone and iPad:

1. Open the Settings app.

2. Tap "General".

3. Tap "VPN & Device Management".

4. Tap the Configuration Profile from the iOS management tool containing the password policy.

5. Tap "Restrictions".

6. Tap "Passcode".

7. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes.

Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement.

On the management server, if the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the iOS/iPadOS management tool or the sum of the values assigned to "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" is not between 1 and 15 minutes in the configuration profile, or if on the iPhone/iPad, the sum of the values assigned to "Max grace period" and "Max inactivity" is not between 1 and 15 minutes, this is a finding.

Check System

C-63501r943618_chk

Fix Reference

F-63408r943619_fix

Fix Text

Install a configuration profile to lock the device display after 15 minutes (or less) of inactivity. This is done by setting "Maximum Auto-Lock time" and "Grace Period for device lock" so the sum of their values is between 1 and 15 minutes.

Identities

CCI-000057

The information system initiates a session lock after the organization-defined time period of inactivity.

800-53 :: AC-11 a
800-53 Rev. 4 :: AC-11 a
800-53 Rev. 5 :: AC-11 a
800-53A :: AC-11.1 (ii)

Group Title

PP-MDF-333030

Group ID

V-259766

Rule Version

AIOS-17-706800

Rule Title

Apple iOS/iPadOS 17 must be configured to lock the display after 15 minutes (or less) of inactivity.

Rule ID

SV-259766r943623_rule

Rule Severity

● Medium

Rule Weight

10.0

Vuln Discussion

The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device.

SFR ID: FMT_SMF_EXT.1.1 #2b

Documentable

False

Check Content

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or less.

This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes.

"<key>maxGracePeriod</key>

<key>maxInactivity</key>

<integer>5</integer>"

Here, 5 + 5 = 10; this meets the requirement.

On the iPhone and iPad:

1. Open the Settings app.

2. Tap "General".

3. Tap "VPN & Device Management".

4. Tap the Configuration Profile from the iOS management tool containing the password policy.

5. Tap "Restrictions".

6. Tap "Passcode".

7. Verify the sum of the "Max grace period" and "Max inactivity" values is less than 15 minutes.

Note: On some iOS/iPadOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement.

Check System

C-63502r943621_chk

Fix Reference

F-63409r943622_fix

Fix Text

Identities

CCI-000057

The information system initiates a session lock after the organization-defined time period of inactivity.

800-53 :: AC-11 a
800-53 Rev. 4 :: AC-11 a
800-53 Rev. 5 :: AC-11 a
800-53A :: AC-11.1 (ii)

UNCLASSIFIED