The organization must develop policy which ensures a CMD is wiped prior to issuance to DoD personnel.

From Mobile Policy Security Requirements Guide

Associated with: CCI-000083

SV-47296r1_rule The organization must develop policy which ensures a CMD is wiped prior to issuance to DoD personnel.

Vulnerability discussion

Malware may be installed on a device at some point between shipping from the factory and delivery to DoD. The malware could result in the compromise of sensitive DoD information or result in the introduction of malware within the DoD network.

Check content

Review the policy to ensure a procedure is in place for a CMD system administrator to perform a Wipe command on all new or reissued CMDs (e.g., reset to factory configuration), reload system software or updates, and load a DoD compliant security policy on the CMD before issuing it to DoD personnel and placing the device on a DoD network. Verify required procedures are followed. If required procedures are not followed, this is a finding.

Fix text

Develop a policy which ensures CMD system administrators perform a wipe command on all new or reissued CMDs and an approved IT policy is pushed to the device before issuing it to DoD personnel.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.