STIGQter: STIG Summary: Mobile Device Policy Security Technical Implementation Guide (STIG) Version: 2 Release: 6 Benchmark Date: 26 Jul 2019:

The site Incident Response Plan or other procedure must include procedures to follow when a mobile operating system (OS) based mobile device is reported lost or stolen.

DISA Rule

SV-30699r7_rule

Vulnerability Number

V-24962

Group Title

Follow lost/stolen mobile device procedures

Rule Version

WIR-SPP-007-01

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Publish procedures to follow if a mobile operating system (OS) based mobile device is lost or stolen.

Check Contents

Detailed Policy Requirements:

The site (location where mobile devices are issued and managed and the site where the mobile operating system (OS) based mobile device management server is located) must publish procedures to follow if a mobile device has been lost or stolen. The procedures should include (as appropriate):

- Mobile device user notifies ISSO, SM, and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan.

- The ISSO notifies the mobile device management server system administrator and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan.

The site mobile device management server administrator sends a wipe command to the mobile device and then disables the user account on the management server or removes the mobile device from the user account.

- The site will contact the carrier to have the device deactivated on the carrier’s network.

Check procedures:
Interview the ISSO.

Review the site’s Incident Response Plan or other policies to determine if the site has a written plan of action.

If the site does not have a written plan of action following a lost or stolen mobile device, this is a finding.

Vulnerability Number

V-24962

Documentable

False

Rule Version

WIR-SPP-007-01

Severity Override Guidance

Detailed Policy Requirements:

The site (location where mobile devices are issued and managed and the site where the mobile operating system (OS) based mobile device management server is located) must publish procedures to follow if a mobile device has been lost or stolen. The procedures should include (as appropriate):

- Mobile device user notifies ISSO, SM, and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan.

- The ISSO notifies the mobile device management server system administrator and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan.

The site mobile device management server administrator sends a wipe command to the mobile device and then disables the user account on the management server or removes the mobile device from the user account.

- The site will contact the carrier to have the device deactivated on the carrier’s network.

Check procedures:
Interview the ISSO.

Review the site’s Incident Response Plan or other policies to determine if the site has a written plan of action.

If the site does not have a written plan of action following a lost or stolen mobile device, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

3521

Comments