id: os_rapid_security_responses_remove_disable
title: Disallow to Remove Rapid Security Responses
discussion: |
  The iOS device _MUST_ be configured not to allow the user to remove rapid security responses.
references:
  nist:
    cce:
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-95511-2
      ios_18:
        - CCE-94545-1
      ios_17:
        - CCE-93493-5
    800-53r5:
      - SI-2
      - SI-2(5)
      - SI-3
  bsi:
    indigo:
      ios_26:
        - ANNEX D (Section 6.3.1.3 - Rapid security response)
      ios_18:
        - ANNEX D (Section 6.3.1.3 - Rapid security response)
      ios_17:
        - ANNEX D (Section 6.3.1.3 - Rapid security response)
  disa:
    cmmc:
      - SI.L1-B.1.XII
      - SI.L1-B.1.XIII
      - SI.L1-B.1.XIV
      - SI.L1-B.1.XV
      - SI.L2-3.14.1
      - SI.L2-3.14.2
      - SI.L2-3.14.4
      - RA.L2-3.11.3
platforms:
  iOS:
    '27.0':
      supervised: true
    '26.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    '18.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    '17.0':
      supervised: true
      benchmarks:
        - name: indigo_high
    introduced: '16.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cmmc_lvl1
  - cmmc_lvl2
  - cmmc_lvl3
  - cnssi-1253_moderate
  - cnssi-1253_low
  - cnssi-1253_high
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess
    PayloadContent:
      - allowRapidSecurityResponseRemoval: false
