Navigate

AC-7(2)

AC-7(2): Purge / Wipe Mobile Device

The information system purges/wipes information from [organization-defined mobile devices] based on [organization-defined purging/wiping requirements/techniques] after [organization-defined number] consecutive, unsuccessful device logon attempts.

Supplemental

This control enhancement applies only to mobile devices for which a logon occurs (e.g., personal digital assistants, smart phones, tablets). The logon is to the mobile device, not to any one account on the device. Therefore, successful logons to any accounts on mobile devices reset the unsuccessful logon count to zero. Organizations define information to be purged/wiped carefully in order to avoid over purging/wiping which may result in devices becoming unusable. Purging/wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-7(2).

Control	Description
AC-19	The organization: a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and b: Authorizes the connection of mobile devices to organizational information systems.
MP-5	The organization: a: Protects and controls [organization-defined types of information system media] during transport outside of controlled areas using [organization-defined security safeguards]; b: Maintains accountability for information system media during transport outside of controlled areas; c: Documents activities associated with the transport of information system media; and d: Restricts the activities associated with the transport of information system media to authorized personnel.
MP-6	The organization: a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
SC-13	The information system implements [organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Enhancements

The controls below (if any) add on to the requirements of AC-7(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-7(2).

CCI	Definition
CCI-002239	Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts.
CCI-002240	Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.
CCI-002241	Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped.
CCI-002242	Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.