id: os_system_settings_find_my_device_disable
title: Disable Find My Device
discussion: |
  The Find My service _MUST_ be disabled.

  A Mobile Device Management (MDM) solution _MUST_ be used to carry out remote locking and wiping instead of Apple's Find My service.

  Apple's Find My service uses a personal AppleID for authentication. Organizations should rely on MDM solutions, which have much more secure authentication requirements, to perform remote lock and remote wipe.
references:
  nist:
    cce:
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-95533-6
      ios_18:
        - CCE-94555-0
      ios_17:
        - CCE-93503-1
    800-53r5:
      - AC-20
      - CM-7
      - CM-7(1)
  bsi:
    indigo:
      ios_26:
        - ANNEX K
      ios_18:
        - ANNEX K
      ios_17:
        - ANNEX K
  disa:
    cmmc:
      - AC.L1-B.1.III
      - AC.L2-3.1.20
      - CM.L2-3.4.6
      - CM.L2-3.4.7
platforms:
  iOS:
    '27.0':
      supervised: true
    '26.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    '18.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    '17.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    introduced: '13.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cmmc_lvl1
  - cmmc_lvl2
  - cmmc_lvl3
  - cnssi-1253_moderate
  - cnssi-1253_low
  - cnssi-1253_high
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess
    PayloadContent:
      - allowFindMyDevice: false
