Search filters the loaded procedure list locally. Separate terms must all match (use quotes for an exact phrase). Cached STIG Search results apply when you arrive from Search.
Objective ID
Severity
Discussion
V-259742
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure.
Examples of possible EMM security controls are as follows:
1. Device access restrictions: Restrict or isolate access based on the device's access type (i.e., from the internet), authentication type (e.g., password), credential strength, etc.
2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information.
3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)ii, 3.b.(2)ii,1 and 2.
SFR ID: FMT_SMF_EXT.1.1 #47
Examples of possible EMM security controls are as follows:
1. Device access restrictions: Restrict or isolate access based on the device's access type (i.e., from the internet), authentication type (e.g., password), credential strength, etc.
2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information.
3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)ii, 3.b.(2)ii,1 and 2.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259743
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259744
medium
Examples of indicators that the device native security controls have been disabled include jailbroken or rooted devices.
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and the work profile can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Detection via collection and analysis of BYOAD-generated logs for noncompliance indicators is acceptable.
This detection capability must be implemented prior to BYOAD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the BYOAD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the BYOAD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and the work profile can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Detection via collection and analysis of BYOAD-generated logs for noncompliance indicators is acceptable.
This detection capability must be implemented prior to BYOAD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the BYOAD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the BYOAD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259745
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Detection via collection and analysis of BYOAD-generated logs for noncompliance indicators is acceptable.
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259746
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Detection via collection and analysis of BYOAD-generated logs for noncompliance indicators is acceptable.
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259747
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure. Detection via collection and analysis of BYOAD-generated logs for noncompliance indicators is acceptable.
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
This detection capability must be implemented prior to AMD (Approved Mobile Device, called BYOAD device in the STIG) enrollment and AMD access to DOD information and IT resources and continuously monitored on the DOD-managed segment of the AMD enrolled in the program. If non-DOD information (i.e., personal user data, device information) outside the DOD-managed segment of the AMD is required to be accessed, collected, monitored, tracked (i.e., location), or maintained, the circumstances under which this may be done must be outlined in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259748
medium
Examples of indicators that the native device security controls have been disabled include jailbroken or rooted devices.
When a BYOAD is out of compliance, DOD data and apps must be removed to protect against compromise of sensitive DOD information.
Note: The site should review DOD and local data retention policies before wiping the work profile of a BYOAD device.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(4), 3.b.(5)i.
SFR ID: FMT_SMF_EXT.1.1 #47
When a BYOAD is out of compliance, DOD data and apps must be removed to protect against compromise of sensitive DOD information.
Note: The site should review DOD and local data retention policies before wiping the work profile of a BYOAD device.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(4), 3.b.(5)i.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259749
medium
When a BYOAD is out of compliance, DOD data and apps must be removed to protect against compromise of sensitive DOD information.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(3)iii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259750
medium
When a BYOAD is out of compliance, DOD data and apps must be removed to protect against compromise of sensitive DOD information.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(1)ii.
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(1)ii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259751
high
Note: IT resources includes DOD networks and applications (for example, DOD email).
The system administrator must have the capability to limit access of the BYOAD to DOD networks and DOD IT resources based on mission needs and risk. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DOD sensitive information. The AO should document networks, IT resources, and enterprise applications that BYOAD can access.
Examples of EMM security controls are as follows:
1. Device access restrictions: Restrict or isolate access based on the device's access type (i.e., from the internet), authentication type (e.g., password), credential strength, etc.
2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information.
3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(2)ii.
SFR ID: FMT_SMF_EXT.1.1 #47
The system administrator must have the capability to limit access of the BYOAD to DOD networks and DOD IT resources based on mission needs and risk. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DOD sensitive information. The AO should document networks, IT resources, and enterprise applications that BYOAD can access.
Examples of EMM security controls are as follows:
1. Device access restrictions: Restrict or isolate access based on the device's access type (i.e., from the internet), authentication type (e.g., password), credential strength, etc.
2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information.
3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(2)ii.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259752
low
A key construct of a BYOAD is that user personal information and data are protected from exposure to the enterprise.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(4), 3.b.(5).
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(4), 3.b.(5).
SFR ID: FMT_SMF_EXT.1.1 #47
V-259753
low
DOD policy requires the protection and privacy of personal data and activities to the maximum extent possible on BYOADs.
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(5).
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(5).
SFR ID: FMT_SMF_EXT.1.1 #47
V-259754
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and the work profile can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure.
Note: Technical limitations prohibit using Apple iOS/iPadOS User Enrollment in most DOD environments.
Reference: DOD policy "Use of Non-Government Mobile Devices".
SFR ID: FMT_SMF_EXT.1.1 #47
Note: Technical limitations prohibit using Apple iOS/iPadOS User Enrollment in most DOD environments.
Reference: DOD policy "Use of Non-Government Mobile Devices".
SFR ID: FMT_SMF_EXT.1.1 #47
V-259755
high
Note: For a virtual mobile infrastructure (VMI) solution, both the client and server components must be NIAP compliant.
Nonapproved EMM systems may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack. EMM systems include mobile device management (MDM), mobile application management (MAM), mobile content management (MCM), or VMI.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(2).
SFR ID: FMT_SMF_EXT.1.1 #47
Nonapproved EMM systems may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack. EMM systems include mobile device management (MDM), mobile application management (MAM), mobile content management (MCM), or VMI.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.a.(2).
SFR ID: FMT_SMF_EXT.1.1 #47
V-259756
low
DOD policy states BYOAD owners must sign a user agreement and be made aware of what personal data and activities will be monitored by the enterprise by including this information in the user agreement.
Reference: DOD policy "Use of Non-Government Mobile Devices" 3.a.(3)ii, and 3.c.(4).
SFR ID: FMT_SMF_EXT.1.1 #47
Reference: DOD policy "Use of Non-Government Mobile Devices" 3.a.(3)ii, and 3.c.(4).
SFR ID: FMT_SMF_EXT.1.1 #47
V-259757
medium
DOD policy requires BYOAD devices with DOD data be managed by a DOD MDM server, MAM server, or VMI system. This ensures the device can be monitored for compliance with the approved security baseline and managed data and apps can be removed when the device is out of compliance, which protects DOD data from unauthorized exposure.
Follow local physical security procedures regarding allowing or prohibiting personally owned mobile devices in a DOD facility. If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using personal devices is unacceptable, this could lead to the exposure of sensitive DOD data.
SFR ID: FMT_SMF_EXT.1.1 #47
Follow local physical security procedures regarding allowing or prohibiting personally owned mobile devices in a DOD facility. If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using personal devices is unacceptable, this could lead to the exposure of sensitive DOD data.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259758
medium
In some DOD operational environments, the use of the mobile device camera or microphone could lead to a security incident or compromise of DOD information. The system administrator must have the capability to disable the mobile device camera and/or microphone based on mission needs. Alternatively, mobile devices with cameras or microphones that cannot be disabled must be prohibited from the facility by the information system security officer (ISSO)/information system security manager (ISSM).
If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using mobile device cameras or microphones is unacceptable, this could lead to the exposure of sensitive DOD data.
SFR ID: FMT_SMF_EXT.1.1 #47
If BYOAD devices are brought into facilities where the authorizing official (AO) has determined the risk of using mobile device cameras or microphones is unacceptable, this could lead to the exposure of sensitive DOD data.
SFR ID: FMT_SMF_EXT.1.1 #47
V-259759
high
Note: For a virtual mobile infrastructure (VMI) solution, both the client and server components must be NIAP compliant.
Nonapproved mobile devices may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(1)i.
SFR ID: FMT_SMF_EXT.1.1 #47
Nonapproved mobile devices may not include sufficient controls to protect work data, applications, and networks from malware or adversary attack.
Components must only approve devices listed on the NIAP product compliant list or products listed in evaluation at the following links respectively:
- https://www.niap-ccevs.org/Product/
- https://www.niap-ccevs.org/Product/PINE.cfm
Reference: DOD policy "Use of Non-Government Mobile Devices". 3.b.(1)i.
SFR ID: FMT_SMF_EXT.1.1 #47
V-274440
high
Apple iOS/iPadOS 17 BYOAD is no longer supported by Apple and therefore, may contain security vulnerabilities.
SFR ID: FMT_SMF_EXT.1.1 #47
SFR ID: FMT_SMF_EXT.1.1 #47
SFR ID: FMT_SMF_EXT.1.1 #47
SFR ID: FMT_SMF_EXT.1.1 #47