ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.
- Group Title
- PP-BYO-000110
- Group ID
- V-257094
- Rule Version
- AIOS-16-800110
- Rule Title
- The BYOAD and DOD enterprise must be configured to limit access to only enterprise corporate-owned IT resources approved by the authorizing official (AO).
- Rule ID
- SV-257094r904451_rule
- Rule Severity
- ● High
- Rule Weight
- 10.0
- Vuln Discussion
-
Note: IT resources includes DOD networks and applications (for example, DOD email).
The system administrator must have the capability to limit access of the BYOAD to DOD networks and DOD IT resources based on mission needs and risk. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DOD sensitive information. The AO should document networks, IT resources, and enterprise applications that BYOAD can access.
Examples of EMM security controls are as follows:
1. Device access restrictions: Restrict or isolate access based on the device's access type (i.e., from the internet), authentication type (e.g., password), credential strength, etc.
2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information.
3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(2)ii.
SFR ID: FMT_SMF_EXT.1.1 #47
- Documentable
- False
- Check Content
-
Verify the EMM system and DOD enterprise have been configured to limit iOS/iPadOS 16 BYOAD access to only AO-approved enterprise IT resources.
The exact procedure will depend on the EMM system used and IT resources at the site.
If the EMM system and DOD enterprise have not been configured to limit iOS/iPadOS 16 BYOAD access to only AO-approved enterprise IT resources, this is a finding.
- Check System
- C-60779r904025_chk
- Fix Reference
- F-60720r904026_fix
- Fix Text
-
Configure the EEM system and DOD enterprise to limit iOS/iPadOS 16 BYOAD access to only AO-approved enterprise IT resources.
The exact procedure will depend on the EMM system used and IT resources at the site.
- Identities
-
CCI-000213
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
- 800-53 :: AC-3
- 800-53 Rev. 4 :: AC-3
- 800-53 Rev. 5 :: AC-3
- 800-53A :: AC-3.1
- Group Title
- PP-BYO-000200
- Group ID
- V-257100
- Rule Version
- AIOS-16-800200
- Rule Title
- The EMM system supporting the iOS/iPadOS 16 BYOAD must be NIAP validated (included on the NIAP list of compliant products or products in evaluation) unless the DOD CIO has granted an approved Exception to Policy (E2P).
- Rule ID
- SV-257100r904452_rule
- Rule Severity
- ● High
- Rule Weight
- 10.0
- Vuln Discussion
-
Note: For a virtual mobile infrastructure (VMI) solution, both the client and server must be NIAP compliant.
Nonapproved EMM systems may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack. EMM systems include mobile device management (MDM), mobile application management (MAM), mobile content management (MCM), or VMI.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(2).
SFR ID: FMT_SMF_EXT.1.1 #47
- Documentable
- False
- Check Content
-
Verify the EMM system supporting the iOS/iPadOS BYOAD is NIAP validated (included on the NIAP list of compliant products or products in evaluation).
If it is not, verify the DOD CIO has granted an approved E2P.
Note: For a VMI solution, both the client and server components must be NIAP compliant.
If the EMM system supporting the iOS/iPadOS BYOAD is not NIAP validated (included on the NIAP list of compliant products or products in evaluation) and the DOD CIO has not granted an approved E2P, this is a finding.
- Check System
- C-60785r904043_chk
- Fix Reference
- F-60726r904044_fix
- Fix Text
-
Only use an EMM system supporting the iOS/iPadOS 16 BYOAD that is NIAP validated (included on the NIAP list of compliant products or products in evaluation) unless the DOD CIO has granted an approved E2P.
Note: For a VMI solution, both the client and server components must be NIAP compliant.
- Identities
-
CCI-000366
Implement the security configuration settings.
- 800-53 :: CM-6 b
- 800-53 Rev. 4 :: CM-6 b
- 800-53 Rev. 5 :: CM-6 b
- 800-53A :: CM-6.1 (iv)
- Group Title
- PP-BYO-000200
- Group ID
- V-257136
- Rule Version
- AIOS-16-800280
- Rule Title
- The mobile device used for BYOAD must be NIAP validated.
- Rule ID
- SV-257136r904500_rule
- Rule Severity
- ● High
- Rule Weight
- 10.0
- Vuln Discussion
-
Note: For a virtual mobile infrastructure (VMI) solution, both the client and server must be NIAP compliant.
Nonapproved mobile devices may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices" (3.a.(2)).
SFR ID: FMT_SMF_EXT.1.1 #47
- Documentable
- False
- Check Content
-
Verify the mobile device used for BYOAD is NIAP validated (included on the NIAP list of compliant products or products in evaluation).
If the mobile device used for BYOAD is not NIAP validated (included on the NIAP list of compliant products or products in evaluation), this is a finding.
- Check System
- C-60821r904454_chk
- Fix Reference
- F-60762r904455_fix
- Fix Text
-
Use only mobile devices for BYOAD that are NIAP validated (included on the NIAP list of compliant products or products in evaluation).
- Identities
-
CCI-000366
Implement the security configuration settings.
- 800-53 :: CM-6 b
- 800-53 Rev. 4 :: CM-6 b
- 800-53 Rev. 5 :: CM-6 b
- 800-53A :: CM-6.1 (iv)