The organization must have written policy or training material that states non-enterprise activated CMD are not permitted to connect to DoD networks.

From Mobile Policy Security Requirements Guide

Part of SRG-MPOL-042

Associated with: CCI-001332

SV-47276r1_rule The organization must have written policy or training material that states non-enterprise activated CMD are not permitted to connect to DoD networks.

Vulnerability discussion

Non-enterprise activated CMDs are not authorized to connect to DoD networks or to DoD computers that will be connected to DoD networks, because they do not have required security controls. There is a significant risk of introducing malware on a DoD network if these types of devices are connected to a DoD network.

Check content

CMDs and tablets classified as non-enterprise activated are not authorized to connect to DoD networks. Examples of unauthorized DoD network connections include: -Connecting the mobile device to a DoD network interface device (switch, router, Wi-Fi access point, etc.). Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP) (see the Wireless STIG for more information). -Connecting the mobile device to a DoD PC that is authorized to connect to a DoD network. - Managing the mobile device from a DoD network connected Mobile Device Management (MDM) server. -Connecting the mobile device to a web server located on a DoD network, unless the server is available to the general public. -Connecting the mobile device to a DoD email system. Interview the appropriate security personnel and 2-3 users who are using mobile OS devices that are managed by the site, and which are not authorized to connect to DoD networks. Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating mobile OS devices must not be connected to a DoD network, unless authorized to do so. Verify users are aware of the requirement. If written policy or training material does not exist or users are not aware of the requirement, this is a finding.

Fix text

Develop and publish the policy or procedure preventing connection of CMDs and tablets classified as non-enterprise activated to DoD networks and users are trained on the requirement.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer