STIGQter: STIG Summary: Apple iOS/iPadOS 26 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 13 May 2026:

Apple iOS/iPadOS 26 must be configured to enforce a passcode reuse prohibition of at least two generations.

DISA Rule

SV-278752r1150865_rule

Vulnerability Number

V-278752

Group Title

PP-MDF-993300

Rule Version

AIOS-26-006950

Severity

CAT I

CCI(s)

CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).

Weight

Fix Recommendation

Install a configuration profile to enforce a passcode reuse prohibition of at least two generations (passcode history).

Configuration Profile Key: pinHistory

Check Contents

Review configuration settings to confirm the Apple iOS or iPadOS device has a passcode reuse prohibition of at least two generations.

This procedure is performed in the Apple iOS/iPadOS management tool and on the iPhone and iPad.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the Management tool, verify the "Passcode History" value is set to two or greater.

On the iPhone and iPad:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the Configuration Profile from the Apple iOS/iPadOS management tool containing the password policy.
5. Tap "Restrictions".
6. Tap "Passcode".
7. Verify "Number of unique recent passcodes required" is listed as "two" or greater.

If the Apple iOS or iPadOS device does not enforce a passcode reuse prohibition of at least two generations, this is a finding.

Vulnerability Number

V-278752

Documentable

False

Rule Version

AIOS-26-006950

Severity Override Guidance

Check Content Reference

Target Key

5723