Title

The smartphone management server administrator must receive required training. (Cat III impact)

Discussion

The security posture of the smartphone management server could be compromised if the administrator is not trained to follow required procedures.

Check Content

Detailed policy requirements: The smartphone management server administrator must be trained on the following requirements: -Requirement that administrative service accounts will not be used to log into the smartphone management server or any server service. -Activation passwords or PINs will consist of a pseudo-random pattern of at least eight characters consisting of at least two letters and two numbers. A new activation password must be selected each time one is assigned (e.g., the same password cannot be used for all users or for a group of users). - User and group accounts on the smartphone management server will always be assigned a STIG-compliant security/IT policy. Check procedures: - Verify the smartphone management server administrator(s) has received the required training. The site should document when the training was completed. Mark as a finding if smartphone management server admin did not receive required training.

Fix Text

Have smartphone management server administrator complete and document his/her training.

Additional Identifiers

Rule ID: SV-30707r3_rule

Vulnerability ID: V-24970

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.