Apple iOS must implement the management setting: not share location data through iCloud.

From Apple iOS 12 Security Technical Implementation Guide

Associated with: CCI-000048

SV-96547r1_rule Apple iOS must implement the management setting: not share location data through iCloud.

Vulnerability discussion

Sharing of location data is an operations security (OPSEC) risk because it potentially allows an adversary to determine a DoD user's location and movements and patterns in those movements over time. An adversary could use this information to target the user or to gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk.SFR ID: FMT_SMF_EXT.1.1 #47

Check content

Review configuration settings to confirm "Share My Location" is disabled. Note that this is a User based Enforcement (UBE) control, which cannot be managed by an MDM server. This check procedure is performed on the Apple iOS device only. On the Apple iOS device: 1. Open the Settings app. 2. Tap "Privacy". 3. Tap "Location Services". 4. Tap "Share My Location". 5. Verify "Share My Location" is off. If "Share My Location" is toggled to the right and appears green on the Apple iOS device, this is a finding.

Fix text

The user must configure Apple iOS to disable location sharing through iCloud.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.