STIGQter STIGQter: STIG Summary: Commercial Mobile Device (CMD) Policy Security Technical Implementation Guide (STIG) Version: 2 Release: 5 Benchmark Date: 28 Oct 2016:

The mobile device system administrator must perform a wipe command on all new or reissued CMDs and a STIG-compliant IT policy will be pushed to the device before issuing it to DoD personnel.

DISA Rule

SV-30700r5_rule

Vulnerability Number

V-24963

Group Title

CMD provisioning-01

Rule Version

WIR-SPP-008-01

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Perform a wipe command on all new or reissued mobile devices.

Check Contents

Detailed Policy Requirements:
The CMD system administrator must perform a wipe command on all new or reissued CMDs, reload system software, and load a STIG-compliant security policy on the CMD before issuing it to DoD personnel and placing the device on a DoD network. The intent is to return the device to the factory state before the DoD software baseline is installed.

When wireless activation is performed, the activation password is passed to the user in a secure manner (e.g., activation password is encrypted and emailed to an individual).

Check Procedures:
Interview the ISSO. Verify required procedures are followed. If required procedures were not followed, this is a finding.

Vulnerability Number

V-24963

Documentable

False

Rule Version

WIR-SPP-008-01

Severity Override Guidance

Detailed Policy Requirements:
The CMD system administrator must perform a wipe command on all new or reissued CMDs, reload system software, and load a STIG-compliant security policy on the CMD before issuing it to DoD personnel and placing the device on a DoD network. The intent is to return the device to the factory state before the DoD software baseline is installed.

When wireless activation is performed, the activation password is passed to the user in a secure manner (e.g., activation password is encrypted and emailed to an individual).

Check Procedures:
Interview the ISSO. Verify required procedures are followed. If required procedures were not followed, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

1978

Comments