iOS 18 STIG

18 items · Security · Hard difficulty · 1 hour

Practical steps to harden iOS/iPadOS 18 devices to STIG standards.

• Place device in supervised mode

  Supervision is required for DoD deployments to enable advanced controls.

• Enroll device via Automated Device Enrollment (ABM)

  Use ABM during activation; procurement must provide the ABM customer number.

• Place device in supervised mode using Apple Configurator

  Use Apple Configurator 2 for manual supervision when ABM is unavailable.

• Enroll device in MDM and install the management profile

  Register the device with your enterprise MDM and push the management profile.

• Disable user removal of the management (MDM) profile

  Require that the MDM profile cannot be removed by the end user.

• Enforce device passcode complexity and auto-lock

  Require strong passcodes, minimum length, and short auto-lock timeout.

• Ensure data protection and device encryption is enabled

  Verify iOS data protection is active; hardware encryption is used when passcode set.

• Configure managed app controls to separate work and personal data

  Use MDM app management to enforce data separation for COPE/COBO devices.

• Restrict installation of unmanaged apps or block the App Store

  Apply App Store restrictions per AO policy to limit unvetted apps.

• Disable or restrict iCloud backups and syncing for DOD data

  Prevent unauthorized cloud storage of controlled/unclassified data.

• Configure Wi-Fi with enterprise settings and enforce Network STIG compliance

  Use WPA2/3-Enterprise (EAP) and avoid direct AP-to-enclave bridges.

• Disable or limit AirDrop to contacts only

  Turn off AirDrop or restrict it to reduce unsolicited file exchange risks.

• Disable Siri and voice assistant access from the lock screen

  Prevent unintended data exposure via voice assistant features.

• Disable Bluetooth file sharing and restrict accessory pairing

  Limit Bluetooth to authorized accessories to reduce attack surface.

• Configure automatic OS updates or manage updates via MDM

  Keep devices on supported iOS versions and control update rollout.

• Document AO approvals and exceptions for personal app use

  Record official approvals when DOD data storage in unmanaged apps is allowed.

• Test configurations in a representative environment before deployment

  Validate settings to avoid loss of required functionality at scale.

• Subscribe to DISA STIG updates and maintain a change log

  Monitor cyber.mil/public.cyber.mil and track STIG version changes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.