SYS.3.2.3 iOS (for Enterprise)

If an MDM system is used, any iOS-based devices in use MUST be managed and configured via this system. There MUST be a strategy for using iOS devices that defines aspects such as the selection of end devices or backup strategies. Whether additional apps from third-party providers should or may be used MUST be regulated. Furthermore, jailbreaks MUST be prohibited by organisational guidelines and, if possible, technically prevented.

Before iOS-based devices are used, it MUST be determined which cloud services should or may be used and to what extent. It SHOULD be taken into account that iOS-based devices are generally closely intertwined with Apple's own iCloud services. It SHOULD also be considered that this integration can be triggered by merely activating individual devices with an Apple ID. It SHOULD therefore be checked whether Apple Business Manager (formerly the Device Enrollment Program, DEP) can be used for device registration.

In order to ensure that configuration profiles cannot be deleted without authorisation, suitable technical (e.g. through support mode) or organisational regulations MUST be established and implemented. Users of mobile devices SHOULD be made aware of the intention and purpose of these security safeguards.

An anonymised Apple ID SHOULD be used instead of a user's personal Apple ID. If possible, Apple Business Manager SHOULD be used for volume licensing (formerly the Volume Purchase Program, VPP) and the centralised installation of apps.

All iOS functions and services that are not needed or allowed SHOULD be disabled. Based on the intended purpose at hand and the underlying protection needs, the use of lock screens, unified communication, Siri, background images, connections to host systems, and diagnostic and usage data SHOULD be checked in particular.

Before extensive or selective usage of the iCloud infrastructure is approved for business use, the compatibility of Apple’s general terms and conditions with an organisation's internal policies SHOULD be assessed in terms of availability, confidentiality, integrity, and data protection. If the use of the iCloud infrastructure is allowed, identities on the iCloud web service SHOULD be verified by two-factor authentication. Otherwise, iCloud use for purely business purposes SHOULD be reduced to a minimum or completely prohibited.

If using the iCloud infrastructure has not been generally prohibited by an organisation’s security management department, the compatibility of Continuity functions with the organisation's internal policies SHOULD be assessed, taking account of the aspects of confidentiality and integrity. Based on the results of this assessment, the extent to which these functions are technically and organisationally restricted SHOULD be regulated.

In configuration profiles, the number of unique codes that must be used before repetition is allowed SHOULD be set to an appropriate value.

The browser policies already established in an organisation SHOULD also be implemented accordingly for Safari by means of technical and organisational safeguards. The requirements for browsers on stationary and portable PCs that are already in place SHOULD be used as a basis for securing iOS-based devices and establishing application scenarios. The operational environment of the devices SHOULD be considered.

To ensure that the required apps are sufficiently available to authorised users at the necessary time, consideration SHOULD be given to integrating Apple Business Manager into the MDM infrastructure. Payments in the App Store SHOULD NOT be confirmed using biometrics.

Devices that are continuously offline for a clearly defined period of time SHOULD lose their access to the corresponding organisation's internal infrastructure. At the end of the defined period or on a specific day, their configuration profiles SHOULD be deleted without the need for action on the part of those in charge of IT. If the user of such a device accesses their organisation's internal network before the period expires, this SHOULD reset the period until their configuration profile will be automatically deleted. If it is necessary to ensure that a user is still in possession of a given device, the user SHOULD be actively prompted to establish access within a set period of time. If no access is established before this period expires, the user's configuration profile SHOULD be automatically deleted.

Approved AirPrint printers SHOULD be provided to users by means of a configuration profile. In order to prevent users from printing information on untrusted printers, all communication links SHOULD always be routed through an organisation’s infrastructure systems.

To prevent iOS-based devices from being connected to other IT systems in an unauthorised manner, users SHOULD only be able to connect iOS-based devices to a corresponding MDM system.