What changed in Apple iOS/iPadOS 13 STIG V2R1V2R1 changes

Apple iOS/iPadOS 13 STIG V2R1 (2021-01-22) replaced V1R1 (2019-09-19): 50 checks added, 51 removed. It has 50 checks, against 51 in V1R1.

V2R1 checklistV1R1 checklist Compare V1R1 and V2R1 in STIG Compare

  • 50 added
  • 51 removed
  • 0 updated

Added in V2R1 (50)

  • V-219347CAT IIApple iOS/iPadOS must be configured to enforce a minimum password length of six characters.
  • V-219348CAT IIApple iOS/iPadOS must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-219349CAT IIApple iOS/iPadOS must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-219350CAT IIIApple iOS/iPadOS must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-219351CAT IIApple iOS/iPadOS must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: Apple App Store].
  • V-219352CAT IIApple iOS/iPadOS must not include applications with the following characteristics: access to Siri when the device is locked.
  • V-219353CAT IIApple iOS/iPadOS must not include applications with the following characteristics: Voice dialing application if available when MD is locked.
  • V-219354CAT IIApple iOS/iPadOS must not display notifications when the device is locked.
  • V-219355CAT IIApple iOS/iPadOS must not display notifications (calendar information) when the device is locked.
  • V-219356CAT IIIApple iOS/iPadOS must be configured to display the DoD advisory warning message at start-up or each time the user unlocks the device.
  • V-219357CAT IIApple iOS/iPadOS must not allow backup of managed app data to locally connected systems.
  • V-219358CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud).
  • V-219359CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud document and data synchronization).
  • V-219360CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud Keychain).
  • V-219361CAT IIApple iOS/iPadOS must not allow backup to remote systems (My Photo Stream).
  • V-219362CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Photo Streams).
  • V-219363CAT IIApple iOS/iPadOS must not allow backup to remote systems (managed applications data stored in iCloud).
  • V-219364CAT IIApple iOS/iPadOS must not allow backup to remote systems (enterprise books).
  • V-219365CAT IIApple iOS/iPadOS must not allow non-DoD applications to access DoD data.
  • V-219366CAT IIApple iOS/iPadOS must implement the management setting: remove managed applications upon unenrollment from MDM (including sensitive and protected data).
  • V-219367CAT IApple iOS/iPadOS must require a valid password be successfully entered before the mobile device data is unencrypted.
  • V-219368CAT IIIApple iOS/iPadOS must implement the management setting: limit Ad Tracking.
  • V-219369CAT IIIApple iOS/iPadOS must implement the management setting: not allow automatic completion of Safari browser passcodes.
  • V-219370CAT IIApple iOS/iPadOS must implement the management setting: Encrypt iTunes backups / Encrypt local backup.
  • V-219371CAT IIIApple iOS/iPadOS must implement the management setting: not allow use of Handoff.
  • V-219372CAT IIIApple iOS/iPadOS must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device for the first time.
  • V-219373CAT IIApple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.
  • V-219374CAT IIApple iOS/iPadOS must implement the management setting: Disable Allow Shared Albums.
  • V-219375CAT IiPhone and iPad must have the latest available iOS operating system installed.
  • V-219376CAT IIApple iOS/iPadOS must implement the management setting: use SSL for Exchange ActiveSync.
  • V-219377CAT IIApple iOS/iPadOS must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS Mail app.
  • V-219378CAT IIApple iOS/iPadOS must implement the management setting: Treat Airdrop as an unmanaged destination.
  • V-219379CAT IIIApple iOS/iPadOS must implement the management setting: not have any Family Members in Family Sharing.
  • V-219380CAT IIApple iOS/iPadOS must implement the management setting: not share location data through iCloud.
  • V-219381CAT IIIApple iOS/iPadOS must implement the management setting: force Apple Watch wrist detection.
  • V-219382CAT IIApple iOS/iPadOS users must complete required training.
  • V-219383CAT IIA managed photo app must be used to take and store work-related photos.
  • V-219384CAT IIApple iOS/iPadOS must implement the management setting: enable USB Restricted Mode.
  • V-219385CAT IIIApple iOS/iPadOS must not allow managed apps to write contacts to unmanaged contacts accounts.
  • V-219386CAT IIIApple iOS/iPadOS must not allow unmanaged apps to read contacts from managed contacts accounts.
  • V-219387CAT IIIApple iOS/iPadOS must implement the management setting: disable AirDrop.
  • V-219388CAT IIApple iOS/iPadOS must implement the management setting: disable paired Apple Watch.
  • V-219389CAT IIApple iOS/iPadOS must disable password autofill in browsers and applications.
  • V-219390CAT IIApple iOS/iPadOS must disable allow setting up new nearby devices.
  • V-219391CAT IIApple iOS/iPadOS must disable password proximity requests.
  • V-219392CAT IIApple iOS/iPadOS must disable password sharing.
  • V-219393CAT IIIApple iOS/iPadOS must disable Find My Friends in the Find My app.
  • V-219394CAT IIThe Apple iOS/iPadOS must be Supervised by the MDM.
  • V-219395CAT IIApple iOS/iPadOS must disable Allow USB drive access in Files access if the AO has not approved the use of DoD approved USB storage drives with iOS/iPadOS devices.
  • V-233510CAT IAll Apple iOS/iPadOS 13 installations must be removed.

Removed since V1R1 (51)

  • V-97419CAT IIApple iOS/iPadOS must be configured to enforce a minimum password length of six characters.
  • V-97421CAT IIApple iOS/iPadOS must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-97423CAT IIApple iOS/iPadOS must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-97425CAT IIIApple iOS/iPadOS must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-97427CAT IIIIf an unmanaged third-party VPN client is installed on the iOS/iPadOS device, it must not be configured with a DoD network (work) VPN profile.
  • V-97429CAT IIApple iOS/iPadOS must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: Apple App Store].
  • V-97431CAT IIApple iOS/iPadOS must not include applications with the following characteristics: access to Siri when the device is locked.
  • V-97433CAT IIApple iOS/iPadOS must not include applications with the following characteristics: Voice dialing application if available when MD is locked.
  • V-97435CAT IIApple iOS/iPadOS must not display notifications when the device is locked.
  • V-97437CAT IIApple iOS/iPadOS must not display notifications (calendar information) when the device is locked.
  • V-97439CAT IIIApple iOS/iPadOS must be configured to display the DoD advisory warning message at start-up or each time the user unlocks the device.
  • V-97441CAT IIApple iOS/iPadOS must not allow backup of managed app data to locally connected systems.
  • V-97443CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud).
  • V-97445CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud document and data synchronization).
  • V-97447CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud Keychain).
  • V-97449CAT IIApple iOS/iPadOS must not allow backup to remote systems (My Photo Stream).
  • V-97451CAT IIApple iOS/iPadOS must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Photo Streams).
  • V-97453CAT IIApple iOS/iPadOS must not allow backup to remote systems (managed applications data stored in iCloud).
  • V-97455CAT IIApple iOS/iPadOS must not allow backup to remote systems (enterprise books).
  • V-97457CAT IIApple iOS/iPadOS must not allow non-DoD applications to access DoD data.
  • V-97459CAT IIIApple iOS/iPadOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
  • V-97461CAT IIApple iOS/iPadOS must implement the management setting: remove managed applications upon unenrollment from MDM (including sensitive and protected data).
  • V-97463CAT IApple iOS/iPadOS must require a valid password be successfully entered before the mobile device data is unencrypted.
  • V-97465CAT IIIApple iOS/iPadOS must implement the management setting: limit Ad Tracking.
  • V-97467CAT IIIApple iOS/iPadOS must implement the management setting: not allow automatic completion of Safari browser passcodes.
  • V-97469CAT IIApple iOS/iPadOS must implement the management setting: Encrypt iTunes backups / Encrypt local backup.
  • V-97471CAT IIIApple iOS/iPadOS must implement the management setting: not allow use of Handoff.
  • V-97473CAT IIIApple iOS/iPadOS must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device for the first time.
  • V-97475CAT IIApple iOS/iPadOS must implement the management setting: Disable Allow MailDrop.
  • V-97477CAT IIApple iOS/iPadOS must implement the management setting: Disable Allow Shared Albums.
  • V-97479CAT IiPhone and iPad must have the latest available iOS operating system installed.
  • V-97481CAT IIApple iOS/iPadOS must implement the management setting: use SSL for Exchange ActiveSync.
  • V-97483CAT IIApple iOS/iPadOS must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS Mail app.
  • V-97485CAT IIApple iOS/iPadOS must implement the management setting: Treat Airdrop as an unmanaged destination.
  • V-97487CAT IIIApple iOS/iPadOS must implement the management setting: not have any Family Members in Family Sharing.
  • V-97489CAT IIApple iOS/iPadOS must implement the management setting: not share location data through iCloud.
  • V-97491CAT IIIApple iOS/iPadOS must implement the management setting: force Apple Watch wrist detection.
  • V-97493CAT IIApple iOS/iPadOS users must complete required training.
  • V-97495CAT IIA managed photo app must be used to take and store work-related photos.
  • V-97497CAT IIApple iOS/iPadOS must implement the management setting: enable USB Restricted Mode.
  • V-97499CAT IIIApple iOS/iPadOS must not allow managed apps to write contacts to unmanaged contacts accounts.
  • V-97501CAT IIIApple iOS/iPadOS must not allow unmanaged apps to read contacts from managed contacts accounts.
  • V-97503CAT IIIApple iOS/iPadOS must implement the management setting: disable AirDrop.
  • V-97505CAT IIApple iOS/iPadOS must implement the management setting: disable paired Apple Watch.
  • V-97507CAT IIApple iOS/iPadOS must disable password autofill in browsers and applications.
  • V-97509CAT IIApple iOS/iPadOS must disable allow setting up new nearby devices.
  • V-97511CAT IIApple iOS/iPadOS must disable password proximity requests.
  • V-97513CAT IIApple iOS/iPadOS must disable password sharing.
  • V-97515CAT IIIApple iOS/iPadOS must disable Find My Friends in the Find My app.
  • V-97517CAT IIThe Apple iOS/iPadOS must be Supervised by the MDM.
  • V-97519CAT IIApple iOS/iPadOS must disable Allow USB drive access in Files access if the AO has not approved the use of DoD approved USB storage drives with iOS/iPadOS devices.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.