Apple iOS/iPadOS 17 STIG Checklist

18 items · Security · Medium difficulty · 2 hours

Harden iOS/iPadOS 17 devices with essential STIG steps for managed deployments.

• Place devices in supervised mode

  Supervision is required for DoD deployments and enables advanced management controls.

• Enroll devices using Apple Automated Device Enrollment (ADE)

  Preferred method to supervise at activation via Apple Business/School Manager.

• Supervise devices via Apple Configurator (AC2) as an alternate method

  Use AC2 for manual supervision when ADE is not available.

• Provide ABM (Apple Business/School) customer number to reseller or procurement

  Obtain ABM customer number at deploy.apple.com to enable ADE enrollment.

• Enroll devices in a Mobile Device Management (MDM) solution and install the MDM profile

  Install a managed MDM profile to control device settings and policies.

• Configure MDM policies to enforce passcodes and biometric requirements

  Set complexity, retry limits, and biometric allowances via MDM.

• Enforce strong passcode complexity and automatic lock

  Require long numeric or alphanumeric codes and short auto-lock interval.

• Enable device data encryption (Data Protection)

  Ensure data is protected at rest by enforcing device encryption.

• Enable remote wipe and enterprise lock via MDM

  Allow administrators to remotely wipe, lock, or disable lost/stolen devices.

• Restrict installation of unmanaged/personal apps without AO approval

  Follow AO-approved exceptions; otherwise block unmanaged app installs.

• Configure managed/unmanaged app data separation and data controls

  Use MDM app policies to separate corporate and personal data and restrict sharing.

• Restrict App Store and app installation settings

  Disable or limit App Store access and require managed app distribution when possible.

• Disable or limit AirDrop and Bluetooth file sharing

  Prevent unauthorized file transfer vectors by restricting AirDrop/Bluetooth.

• Disable Siri, Dictation, and lock screen voice access where required

  Turn off voice services that can leak sensitive info if not needed.

• Prevent users from removing accounts or management profiles

  Use supervision and MDM to block profile removal and account deletion.

• Manage OS updates through MDM and restrict direct OS installs

  Control update timing and prevent unmanaged OS upgrades that break policy.

• Limit Wi-Fi connections to compliant networks and follow Network STIG guidance

  Allow only approved networks and ensure network infrastructure STIGs are met.

• Test configurations, implement logging/reporting, and document exceptions for AO approval

  Validate settings in a lab, enable audit reporting, and record any authorized deviations.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.