STIGQter STIGQter: STIG Summary: Apple iOS/iPadOS 26 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 13 May 2026:

A managed photo app must be used to take and store work-related photos.

DISA Rule

SV-278801r1150878_rule

Vulnerability Number

V-278801

Group Title

PP-MDF-993300

Rule Version

AIOS-26-012000

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Install a managed photos app to take and manage work-related photos.

Note: The recommended application is Microsoft OneDrive. Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.

Note: If the Apple device camera is disabled (see AIOS-26-018100), with AO approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app.

Note: The app must be managed and must store photos as managed data.

Check Contents

Review configuration settings to confirm a managed photos app is installed on the iOS device.

This check procedure is performed on the iPhone and iPad.

On the iPhone and iPad:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the DOD Configuration Profile from the Apple iOS/iPadOS management tool.
5. Tap "Apps".
6. Verify a photo capture and management app is listed.
7. Verify the app is managed and stores photos as managed data.

If a photo capture and management app is installed on the iPhone and iPad and the app is not managed and does not store photos as managed data, this is a finding.

Note: The recommended app is Microsoft OneDrive. Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.

Note: If the Apple device camera is disabled (see AIOS-26-018100), with authorizing official (AO) approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app.

Vulnerability Number

V-278801

Documentable

False

Rule Version

AIOS-26-012000

Severity Override Guidance

Review configuration settings to confirm a managed photos app is installed on the iOS device.

This check procedure is performed on the iPhone and iPad.

On the iPhone and iPad:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the DOD Configuration Profile from the Apple iOS/iPadOS management tool.
5. Tap "Apps".
6. Verify a photo capture and management app is listed.
7. Verify the app is managed and stores photos as managed data.

If a photo capture and management app is installed on the iPhone and iPad and the app is not managed and does not store photos as managed data, this is a finding.

Note: The recommended app is Microsoft OneDrive. Refer to the DOD Mobility Unclassified Capability (DMUC) "iOS & iPadOS Microsoft OneDrive Photo and Video Capture Quick Reference Guide" for more information.

Note: If the Apple device camera is disabled (see AIOS-26-018100), with authorizing official (AO) approval, use the Apple iOS/iPadOS key "allowedCameraRestrictionBundleIDs" to enable an approved managed camera app.

Check Content Reference

M

Target Key

5723