Purge or Wipe Mobile Device
LOW MODERATE HIGHRequirements NIST SOURCE
Purge or wipe information from [mobile devices] based on [purging or wiping requirements and techniques] after [number] consecutive, unsuccessful device logon attempts.
Discussion (NIST Supplemental Guidance)
A mobile device is a computing device that has a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Purging or wiping the device applies only to mobile devices for which the organization-defined number of unsuccessful logons occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Purging or wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AC-7(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- mobile devices to be purged or wiped of information are defined;
- purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined;
- the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined;
- information is purged or wiped from <AC-07(02)_ODP[01] mobile devices> based on <AC-07(02)_ODP[02] purging or wiping requirements or techniques> after <AC-07(02)_ODP[03] number> consecutive, unsuccessful device logon attempts.
Examine
[SELECT FROM: Access control policy; procedures addressing unsuccessful logon attempts on mobile devices; system design documentation; system configuration settings and associated documentation; list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts; list of purging/wiping requirements or techniques for mobile devices; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities].
Test
[SELECT FROM: Mechanisms implementing access control policy for unsuccessful device logon attempts].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AC-7(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Access control policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Mechanisms implementing access control policy for unsuccessful device logon attempts
Other Records
- procedures addressing unsuccessful logon attempts on mobile devices
- list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts
- list of purging/wiping requirements or techniques for mobile devices
- system audit records
- other relevant documents or records