STIGQter: STIG Summary: Commercial Mobile Device (CMD) Policy Security Technical Implementation Guide (STIG) Version: 2 Release: 5 Benchmark Date: 28 Oct 2016:

Mobile operating system (OS) based CMDs and systems must not be used to send, receive, store, or process classified messages unless specifically approved by NSA for such purposes and NSA approved transmission and storage methods are used.

DISA Rule

SV-30697r5_rule

Vulnerability Number

V-24960

Group Title

Classified data on CMDs

Rule Version

WIR-SPP-005

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Publish written policy or training material stating if and when CMDs can be used to process, send, or receive classified information.

Check Contents

Interview the ISSO.

Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating if and when CMDs can be used to transmit classified information.

If written policy or training material does not exist, stating if and when CMDs can be used to receive, transmit, or process classified information, this is a finding.

Vulnerability Number

V-24960

Documentable

False

Rule Version

WIR-SPP-005

Severity Override Guidance

Interview the ISSO.

Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating if and when CMDs can be used to transmit classified information.

If written policy or training material does not exist, stating if and when CMDs can be used to receive, transmit, or process classified information, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

1978

Comments