V3R2 changes
Jamf Pro v10.x EMM STIG V3R2 (2026-09-30) replaced V3R1 (2024-07-24): 16 checks updated. It has 29 checks, against 29 in V3R1.
V3R2 checklistV3R1 checklist Compare V3R1 and V3R2 in STIG Compare
- 0 added
- 0 removed
- 16 updated
Updated fields: Fix text 8CCIs 7Check text 7Discussion 7Title 5
Updated in V3R2 (16)
V-241790CAT IIWhen the Jamf Pro EMM server cannot establish a connection to determine the validity of a certificate, the server must not have the option to accept the certificate.Check text, Fix text, Discussion
Check text
Validate the Jamf Pro EMM server has been configured to not accept a certificate if the certificate cannot be validated.
1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, verify "Use a third-party signing certificate" is selected.
5. Verify the name and certificate extension of the DoDDoW p12 certificate is listed.
If the Jamf Pro EMM server has been not been configured to not accept a certificate if the certificate cannot be validated, this is a finding.
Fix text
Configure the Jamf Pro EMM server to not accept a certificate if the certificate cannot be validated.
1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, select "Use a third-party signing certificate".
5. Drag and drop the DoDDoW p12 certificate.
6. Click "Save".
Discussion
When a Jamf Pro EMM server accepts an unverified certificate, it may be trusting a malicious actor. For example, messages signed with an invalid certificate may contain links to malware, which could lead to the installation or distribution of that malware on DoDDoW information systems, leading to compromise of DoDDoW sensitive information and other attacks.
SFR ID: FIA_X509_EXT.2.2
V-241792CAT IIThe Jamf Pro EMM server must be configured with an enterprise certificate for signing policies (if function is not automatically implemented during Jamf Pro EMM server install).Fix text, Discussion
Fix text
Configure the following settings within the Jamf Pro EMM server for ensuring an authorized DoDDoW certificate is used for signing enrollment and configuration profiles:
1. Open Jamf Pro server.
2. Open "Settings".
3. Open "PKI Certificates".
4. Select "Management Certificate Template" tab.
5. Select "External CA" tab.
6. Select "Edit".
7. Select to use SCEP-enabled external CA for computer and mobile device enrollment.
8. Enter all the applicable settings to connect this server to SCEP/Entrust enabled CA.
9. Select "Save".
10. At the bottom of the External CA screen, select "Change Signing and CA Certificates".
11. Follow onscreen instructions to upload the signing and CA certificates for Jamf Pro to use.
Jamf Pro is now set to use an External CA for signing all communication to mobile devices.
Discussion
It is critical that only authorized certificates are used for key activities such as code signing for system software updates, code signing for integrity verification, and policy signing. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. For example, messages signed with an invalid certificate may contain links to malware, which could lead to the installation or distribution of that malware on DoDDoW information systems, leading to compromise of DoDDoW sensitive information and other attacks. Therefore, the Jamf Pro EMM server must have the capability to configure the enterprise certificate.
SFR ID: FMT_SMF.1.1(2) i, FMT_POL_EXT.1.1
V-241794CAT IIIThe Jamf Pro EMM server must be configured to display the required DoW warning banner upon administrator logon. Note: This requirement is not applicable if the TOE platform is selected in FTA_TAB.1.1 in the Security Target (ST).Title, Check text, Fix text, Discussion
Title
The Jamf Pro EMM server must be configured to display the required DoDDoW warning banner upon administrator logon.
Note: This requirement is not applicable if the TOE platform is selected in FTA_TAB.1.1 in the Security Target (ST).
Check text
Verify the Jamf Pro EMM server for customized login page:
Go to /path/to/JSS/Tomcat/webapps/ROOT/WEB-INF/frontend folder.
Find the login.jsp.
Locate new <body> content related to customized text for DoDDoW classification.
Verify the DoDDoW warning banner text is correct.
If the Jamf Pro EMM server is not configured to display DoDDoW warning banner when the system administrator logs on to the server, this is a finding.
Fix text
Configure the Jamf Pro EMM server for customized login page:
Go to /path/to/JSS/Tomcat/webapps/ROOT/WEB-INF/frontend>>Open the login.jsp with a text editor application.
Scroll to the bottom of the page by the line "<input type="submit" class="button" value="log in" />"
Under the </div> create a new line and paste the following:
NOTE: Anything under "style" and "body" can be customized to fit your environments needs.<head>
<style>
p {margin-top:1em}
p {margin-bottom:0em}
p {color:red}
p {text-align:center}
p {font-family:courier}
p {font-size:100%}
</style>
</head>
<body>
<p>""Place DoDDoW warning banner first line here""</p>
<p>""place second (or next) line here""</p>
</body>
Restart Tomcat for changes to take effect.
Discussion
Note: The advisory notice and consent warning message is not required if the general purpose OS or network device displays an advisory notice and consent warning message when the administrator logs on to the general purpose OS or network device prior to accessing the Jamf Pro EMM server or Jamf Pro EMM server platform.
Before granting access to the system, the Jamf Pro EMM server/server platform is required to display the DoDDoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. This ensures the legal requirements for auditing and monitoring are met.
The approved DoDDoW text must be used as specified in the KS referenced in DoDI 8500.01.
The non-bracketed text below must be used without any changes as the warning banner.
[A. Use this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner shall be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK."]
You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
SFR ID: FMT_SMF.1.1(2) d
V-241796CAT IIThe Jamf Pro EMM server must be configured to leverage the MDM platform user accounts and groups for Jamf Pro EMM server user identification and CAC authentication.Check text, Fix text
Check text
Interview the site ISSM.
Determine if the site has connected Jamf Pro EMM to an Authentication Gateway Service (AGS) which connects to the DoDDoW Identity Access Management (IdAM) environment that uses CAC authentication.
- If YES, verify the AGS implementation has been reviewed using the Application Layer Gateway SRG. Verify the Jamf Pro EMM server is configured to connect to the AGS:
1. Go to the server console.
2. Open "Settings".
3. Select "SSO" (Single Sign-on).
4. Verify Single Sign-on Authentication is enabled and connection to the AGS using SAML-based protocol is set up.
- If NO, verify strong password controls for the administrator local accounts are in place. (Verified by JAMF-10-100700 to JAMF-10-100820.)
If Jamf Pro EMM is not connected Jamf Pro EMM to an Authentication Gateway Service (AGS) which connects to your DoDDoW Identity Access Management (IdAM) environment that utilizes CAC authentication or has not been configured to use strong password controls for the administrator local accounts, this is a finding.
Fix text
Implement one of the following options:
Option #1. Connect Jamf Pro EMM to an Authentication Gateway Service (AGS) which connects to the DoDDoW Identity Access Management (IdAM) environment that uses CAC authentication. Note: Jamf requires AGS to support SAML.
- Set up AGS / IdAM environment.
- Connect the Jamf pro EMM to the AGS:
1. Open "Settings".
2. Select "SSO" (Single Sign-on).
3. Select "Edit".
4. Enable Single Sign-on Authentication.
5. Complete the appropriate settings to connect Jamf Pro EMM to the AGS using SAML-based protocol.
6. Click "Save".
Note: If Option #1 is used, requirements JAMF-10-100700 to JAMF-10-10820 are Not Applicable and requirement JAMF-10-200040 is Applicable - Configurable.
Option #2. Implement strong password policy for admin local accounts. Configure the server password policy (JAMF-10-100700 to JAMF-10-10820).
Note: If Option #2 is used, requirement JAMF-10-200040 is Not Applicable.
V-241797CAT IIAuthentication of Jamf Pro EMM server accounts must be configured so they are implemented either via an Authentication Gateway Service (AGS) which connects to the site DoW Identity Access Management (IdAM) environment that utilizes CAC authentication or via strong password controls for the administrator local accounts.Title, Check text, Fix text
Title
Authentication of Jamf Pro EMM server accounts must be configured so they are implemented either via an Authentication Gateway Service (AGS) which connects to the site DoDDoW Identity Access Management (IdAM) environment that utilizes CAC authentication or via strong password controls for the administrator local accounts.
Check text
Interview the site ISSM.
Determine if the site has connected Jamf Pro EMM to an Authentication Gateway Service (AGS) which connects to the DoDDoW Identity Access Management (IdAM) environment that uses CAC authentication.
- If YES, verify the AGS implementation has been reviewed using the Application Layer Gateway SRG. Verify the Jamf Pro EMM server is configured to connect to the AGS:
1. Go to the server console.
2. Open "Settings".
3. Select "SSO" (Single Sign-on).
4. Verify Single Sign-on Authentication is enabled and connection to the AGS using SAML-based protocol is set up.
- If NO, verify strong password controls for the administrator local accounts are in place. (Verified by JAMF-10-100700 to JAMF-10-100820.)
If Jamf Pro EMM is not connected to an Authentication Gateway Service (AGS) which connects to the DoDDoW Identity Access Management (IdAM) environment that uses CAC authentication or has not been configured to use strong password controls for the administrator local accounts, this is a finding.
Fix text
Implement one of the following options:
Option #1. Connect Jamf Pro EMM to an Authentication Gateway Service (AGS) which connects to the DoDDoW Identity Access Management (IdAM) environment that uses CAC authentication. Note: Jamf requires AGS to support SAML.
- Set up AGS/IdAM environment.
- Connect the Jamf pro EMM to the AGS:
1. Open "Settings".
2. Select "SSO" (Single Sign-on).
3. Select "Edit".
4. Enable Single Sign-on Authentication.
5. Complete the appropriate settings to connect Jamf Pro EMM to the AGS using SAML-based protocol.
6. Click "Save".
Note: If Option #1 is used, requirements JAMF-10-100700 to JAMF-10-10820 are Not Applicable and requirement JAMF-10-200040 is Applicable - Configurable.
Option #2. Implement strong password policy for admin local accounts. Configure the server password policy (JAMF-10-100700 to JAMF-10-10820).
Note: If Option #2 is used, requirement JAMF-10-200040 is Not Applicable.
V-241800CAT IIA unique database name and a unique MySQL user with a secure password must be created for use in Jamf Pro EMM.Discussion, CCIs
Discussion
If the default MySQL database name and password are not changed an adversary could gain unauthorized access to the application which could lead to the compromise of sensitive DODDoW data.
SFR ID: FMT_SMF.1(2)b. / IA-5(1)(c)
Satisfies: SRG-APP-000171
CCIs
CCI-004062CCI-004062,CCI-000196
V-241801CAT IISeparate MySQL user accounts with limited privileges must be created within Jamf Pro EMM.Discussion
Discussion
If separate MySQL accounts with limited privileges are not created an adversary could gain unauthorized access to the application or gain access unauthorized features which could lead to the compromise of sensitive DoDDoW data.
SFR ID: FMT_SMF.1(2)b. / CM-6 b
Satisfies: SRG-APP-000516
V-241804CAT IIThe Jamf Pro EMM local accounts password must be configured with length of 15 characters.CCIs
V-241805CAT IIThe Jamf Pro EMM local accounts must be configured with at least one lowercase character.CCIs
V-241806CAT IIThe Jamf Pro EMM local accounts must be configured with at least one uppercase character.CCIs
V-241807CAT IIThe Jamf Pro EMM local accounts must be configured with at least one number.CCIs
V-241808CAT IIThe Jamf Pro EMM local accounts must be configured with at least one special character.CCIs
V-241809CAT IIThe Jamf Pro EMM local accounts must be configured with password minimum lifetime of 24 hours.CCIs
V-241810CAT IIThe Jamf Pro EMM local accounts must be configured with password maximum lifetime of 6 months.Title, Check text, Fix text
Title
The Jamf Pro EMM local accounts must be configured with password maximum lifetime of 36 months.
Check text
To verify the "password maximum lifetime" of "36" months for the local account's password is set, do the following:
1. Open the Jamf Pro EMM console.
2. Click "Settings".
3. Click "System Settings".
4. Click "Jamf Pro System User Accounts & Groups".
5. Click "Password Policy".
6. Verify "password maximum lifetime" of "36" months.
If the "password maximum lifetime" for local account's password is not set to "36" months, this is a finding.
Fix text
To configure the "password maximum lifetime" of "36" months for the local account's password, do the following:
1. Open the Jamf Pro EMM console.
2. Click "Settings".
3. Click "System Settings".
4. Click "Jamf Pro System User Accounts & Groups".
5. Click "Password Policy".
6. Click "Edit".
7. Set the "password maximum lifetime" of "36" months.
V-241814CAT IIThe Jamf Pro EMM server platform must be protected by a DoW-approved firewall.Title, Check text, Fix text, Discussion
Title
The Jamf Pro EMM server platform must be protected by a DoDW-approved firewall.
Check text
Review the Jamf Pro EMM server platform configuration to determine whether a DoDDoW-approved firewall is installed or if the platform operating system provides a firewall service that can restrict both inbound and outbound traffic by TCP/UDP port and IP address.
If there is not a host-based firewall present on the Jamf Pro EMM server platform, this is a finding.
Fix text
Install a DoDW-approved firewall on the Jamf Pro EMM server.
Discussion
Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Unneeded services and processes provide additional threat vectors and avenues of attack to the information system. The MDM server is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality. All others must be expressly disabled or removed. A DoDDoW-approved firewall implements the required network restrictions. A host-based firewall is appropriate where the MDM server runs on a standalone platform. Network firewalls or other architectures may be preferred where the MDM server runs in a cloud or virtualized solution.
SFR ID: FMT_SMF.1.1(2) b / CM-7b
Satisfies: SRG-APP-000142
V-241816CAT IIThe firewall protecting the Jamf Pro EMM server platform must be configured so that only DoW-approved ports, protocols, and services are enabled. (See the DoW Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoW-approved ports, protocols, and services).Title, Check text, Fix text, Discussion
Title
The firewall protecting the Jamf Pro EMM server platform must be configured so that only DoDDoW-approved ports, protocols, and services are enabled. (See the DoDDoW Ports, Protocols, Services Management [PPSM] Category Assurance Levels [CAL] list for DoDDoW-approved ports, protocols, and services).
Check text
Ask the Jamf Pro EMM server administrator for a list of ports, protocols, and services that have been configured on the host-based firewall of the Jamf Pro EMM server or generate the list by inspecting the firewall. Verify all allowed ports, protocols, and services are included on the DoDDoW PPSM CAL list.
If any allowed ports, protocols, and services on the Jamf Pro EMM server host-based firewall are not included on the DoDDoW PPSM CAL list, this is a finding.
Fix text
Turn off any ports, protocols, and services on the Jamf Pro EMM server host-based firewall that are not on the DoDW PPSM CAL list.
Discussion
All ports, protocols, and services used on DoDDoW networks must be approved and registered via the DoDDoW PPSM process. This is to ensure that a risk assessment has been completed before a new port, protocol, or service is configured on a DoDDoW network and has been approved by proper DoDDoW authorities. Otherwise, the new port, protocol, or service could cause a vulnerability to the DoDDoW network, which could be exploited by an adversary.
SFR ID: FMT_SMF.1.1(2) b / CM-7b
Satisfies: SRG-APP-000142
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.