TMA-IPADOS-4.1.6
Ensure "Stolen Device Protection" Is Enabled
Description
With the release of iOS and iPadOS 17.3, Apple added the ability to restrict when a passcode can be reset. Turning this on will protect a user if their phone is stolen and the thief has obtained the user's passcode. If the passcode is compromised, a user's iCloud credentials can be reset or altered, giving access to the user's AppleID. Profile: Level 2 - End-User Owned Devices. iPadOS-specific: applies to iPad devices (differs from the iOS 26 benchmark item).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
From the device: Settings > Face ID & Passcode > Enter the passcode > Stolen Device Protection > Verify Stolen Device Protection is enabled.
How it is fixed
Fix method: Guidance or infrastructure patch
From the device: Settings > Face ID & Passcode > Enter the passcode > Stolen Device Protection > Enable Stolen Device Protection.
Properties
- Operating systems
- Any
- Tags
- iosipadosdevice-settings
- Reference
- CIS Apple iPadOS 26 Benchmark v1.0.0 - 4.1.6 Ensure "Stolen Device Protection" Is Enabled