Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Unified Endpoint Management Agent Security Requirements Guide

V2R2 · · · Released 29 Jun 2026 · 14 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Requirements Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Supporting documents DISA companion ZIP · 1.5 MB 4 PDFs

Bundled by DISA alongside this STIG release: overview, revision history, and readme files. Download the full archive or open an individual PDF.

Download full ZIP U_UEM_Y26M05_SRG.zip
Digest of Updates vs. V2R1 · 28 Oct 2025 ✎ 9

Comparison against the immediately-prior release (V2R1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Content changes 9

  • V-234235 Medium description The UEM Agent must provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server.
  • V-234236 Medium description The UEM Agent must generate a UEM Agent audit record of the following auditable events:-startup and shutdown of the UEM Agent-UEM policy updated-any modification commanded by the UEM Server.
  • V-234237 Medium description The UEM Agent must be configured to enable the following function: read audit logs of the managed endpoint device.
  • V-234238 Medium description The UEM Agent must record within each UEM Agent audit record the following information: -date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event.
  • V-234240 Medium description The UEM Agent must use managed endpoint device key storage for all persistent secret and private keys.
  • V-234242 Medium description The UEM Agent must be configured to enable the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server.
  • V-234246 Medium description The UEM Agent must perform the following functions: -enroll in management -configure whether users can unenroll from management -configure periodicity of reachability events.
  • V-234247 Medium description The UEM Agent must be configured to perform one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data.
  • V-234248 High descriptioncheckfix All UEM Agent cryptography supporting DoW functionality must be FIPS 140-3 validated.
Sort by
b
The UEM Agent must provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server.
AU-12 - Medium - CCI-000169 - V-234235 - SV-234235r1213329_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
SRG-APP-000089-UEM-100002
Vuln IDs
  • V-234235
Rule IDs
  • SV-234235r1213329_rule
Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced on the mobile device. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FAU_ALT_EXT.2.1 Reference: PP-MDMA-200100, PP-MDMA-200200, PP-MDMA-200300
Checks: C-37420r1207964_chk

Verify the UEM Agent provides an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server. If the UEM Agent does not provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server this is a finding.

Fix: F-37385r1207965_fix

Configure the UEM Agent to provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server.

b
The UEM Agent must generate a UEM Agent audit record of the following auditable events:-startup and shutdown of the UEM Agent-UEM policy updated-any modification commanded by the UEM Server.
AU-12 - Medium - CCI-000169 - V-234236 - SV-234236r1213330_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
SRG-APP-000089-UEM-100004
Vuln IDs
  • V-234236
Rule IDs
  • SV-234236r1213330_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoW has defined the list of events for which the application will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions. DoW Required auditable events include: - Change in enrollment status - Failure to apply policies to a mobile device - Start up and shut down of the MDM System - All administrative actions - Commands issued to the MDM Agent. Satisfies: FAU_GEN.1.1/AGENT
Checks: C-37421r1207967_chk

Verify the UEM Agent generates an UEM Agent audit record of the following auditable events: -Startup and shutdown of the UEM Agent -UEM policy updated -any modification commanded by the UEM Server. If the UEM Agent does not generate an UEM Agent audit record of the following auditable events: -Startup and shutdown of the UEM Agent -UEM policy updated -any modification commanded by the UEM Server this is a finding.

Fix: F-37386r612015_fix

Configure the UEM Agent to generate an UEM Agent audit record of the following auditable events: -Startup and shutdown of the UEM Agent -UEM policy updated -any modification commanded by the UEM Server.

b
The UEM Agent must be configured to enable the following function: read audit logs of the managed endpoint device.
AU-12 - Medium - CCI-000169 - V-234237 - SV-234237r1213331_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
SRG-APP-000089-UEM-100012
Vuln IDs
  • V-234237
Rule IDs
  • SV-234237r1213331_rule
Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FMT_SMF_EXT.4.1 Reference: PP-MDMA-200700
Checks: C-37422r612017_chk

Verify the UEM Agent has enabled the following function: read audit logs of the managed endpoint device. If the UEM Agent has not enabled the following function: read audit logs of the managed endpoint device, this is a finding.

Fix: F-37387r612018_fix

Configure the UEM Agent to enable the following function: read audit logs of the managed endpoint device.

b
The UEM Agent must record within each UEM Agent audit record the following information: -date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event.
AU-3 - Medium - CCI-000132 - V-234238 - SV-234238r1213332_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000132
Version
SRG-APP-000097-UEM-100005
Vuln IDs
  • V-234238
Rule IDs
  • SV-234238r1213332_rule
Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them. Satisfies: FAU_GEN.1.2/AGENT
Checks: C-37423r1207970_chk

Verify the UEM Agent records within each UEM Agent audit record the following information: -Date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event. If the UEM Agent does not record within each UEM Agent audit record the following information: -Date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event this is a finding.

Fix: F-37388r612021_fix

Configure the UEM Agent to record within each UEM Agent audit record the following information: -Date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event.

b
The UEM Agent must not install policies if the policy-signing certificate is deemed invalid.
IA-5 - Medium - CCI-000185 - V-234239 - SV-234239r1213333_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000185
Version
SRG-APP-000175-UEM-100008
Vuln IDs
  • V-234239
Rule IDs
  • SV-234239r1213333_rule
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_POL_EXT.2.2
Checks: C-37424r612023_chk

Verify the UEM Agent does not install policies if the policy-signing certificate is deemed invalid. If the UEM Agent installs policies when the policy-signing certificate is deemed invalid, this is a finding.

Fix: F-37389r612024_fix

Configure the UEM Agent to not install policies if the policy-signing certificate is deemed invalid.

b
The UEM Agent must use managed endpoint device key storage for all persistent secret and private keys.
IA-5 - Medium - CCI-000186 - V-234240 - SV-234240r1213334_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000186
Version
SRG-APP-000176-UEM-100001
Vuln IDs
  • V-234240
Rule IDs
  • SV-234240r1213334_rule
If validated secure storage locations are not used for keys, they could be compromised. Satisfies: FCS_STG_EXT.4.1
Checks: C-37425r612026_chk

This requirement is not applicable if the UEM Agent is provided by the managed endpoint device operating system. Verify the UEM Agent uses the managed endpoint device key storage for all persistent secret and private keys. If the UEM Agent does not use the managed endpoint device key storage for all persistent secret and private keys, this is a finding.

Fix: F-37390r612027_fix

Configure the UEM Agent must use the managed endpoint device key storage for all persistent secret and private keys.

b
The UEM Agent must queue alerts if the trusted channel is not available.
AU-4 - Medium - CCI-001851 - V-234241 - SV-234241r1213335_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
SRG-APP-000358-UEM-100003
Vuln IDs
  • V-234241
Rule IDs
  • SV-234241r1213335_rule
Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced on the mobile device. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FAU_ALT_EXT.2.2
Checks: C-37426r612029_chk

Verify the UEM Agent queues alerts if the trusted channel is not available. If the UEM Agent does not queue alerts if the trusted channel is not available, this is a finding.

Fix: F-37391r612030_fix

Configure the UEM Agent to queue alerts if the trusted channel is not available.

b
The UEM Agent must be configured to enable the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server.
AU-4 - Medium - CCI-001851 - V-234242 - SV-234242r1213336_rule
RMF Control
AU-4
Severity
M
CCI
CCI-001851
Version
SRG-APP-000358-UEM-100013
Vuln IDs
  • V-234242
Rule IDs
  • SV-234242r1213336_rule
Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. MD audit logs must be transferred to an audit management service so they can be analyzed and acted on. Satisfies: FMT_SMF_EXT.4.1 Reference: PP-MDMA-200800
Checks: C-37427r612032_chk

Verify the UEM Agent has enabled the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server. If the UEM Agent has not enabled the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server, this is a finding.

Fix: F-37392r612033_fix

Configure the UEM Agent to enable the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server.

b
The UEM Agent must only accept policies and policy updates that are digitally signed by a certificate that has been authorized for policy updates by the UEM Server.
SC-23 - Medium - CCI-002470 - V-234243 - SV-234243r1213337_rule
RMF Control
SC-23
Severity
M
CCI
CCI-002470
Version
SRG-APP-000427-UEM-100007
Vuln IDs
  • V-234243
Rule IDs
  • SV-234243r1213337_rule
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_POL_EXT.2.1
Checks: C-37428r612035_chk

Verify the UEM Agent only accepts policies and policy updates that are digitally signed by a certificate that has been authorized for policy updates by the UEM Server. If the UEM Agent does not only accept policies and policy updates that are digitally signed by a certificate that has been authorized for policy updates by the UEM Server, this is a finding.

Fix: F-37393r612036_fix

Configure the UEM Agent to only accept policies and policy updates that are digitally signed by a certificate that has been authorized for policy updates by the UEM Server.

b
The UEM Agent must perform the following functions: Import the certificates to be used for authentication of UEM Agent communications.
SC-23 - Medium - CCI-002470 - V-234244 - SV-234244r1213338_rule
RMF Control
SC-23
Severity
M
CCI
CCI-002470
Version
SRG-APP-000427-UEM-100009
Vuln IDs
  • V-234244
Rule IDs
  • SV-234244r1213338_rule
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_SMF_EXT.4.1
Checks: C-37429r612038_chk

Verify the UEM Agent performs the following functions: Import the certificates to be used for authentication of UEM Agent communications. If the UEM Agent does not perform the following functions: Import the certificates to be used for authentication of UEM Agent communications, this is a finding.

Fix: F-37394r612039_fix

Configure the UEM Agent to perform the following functions: Import the certificates to be used for authentication of UEM Agent communications.

b
The UEM Agent must record the reference identifier of the UEM Server during the enrollment process.
CM-6 - Medium - CCI-000366 - V-234245 - SV-234245r1213339_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-APP-000516-UEM-100006
Vuln IDs
  • V-234245
Rule IDs
  • SV-234245r1213339_rule
Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them. Satisfies: FIA_ENR_EXT.2.1
Checks: C-37430r612041_chk

Verify the UEM Agent records the reference identifier of the UEM Server during the enrollment process. If the UEM Agent does not record the reference identifier of the UEM Server during the enrollment process, this is a finding.

Fix: F-37395r612042_fix

Configure the UEM Agent to record the reference identifier of the UEM Server during the enrollment process.

b
The UEM Agent must perform the following functions: -enroll in management -configure whether users can unenroll from management -configure periodicity of reachability events.
CM-6 - Medium - CCI-000366 - V-234246 - SV-234246r1213340_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-APP-000516-UEM-100010
Vuln IDs
  • V-234246
Rule IDs
  • SV-234246r1213340_rule
Access control of mobile devices to DoW sensitive information or access to DoW networks must be controlled so that DoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control. Satisfies: FMT_SMF_EXT.4.2
Checks: C-37431r1212885_chk

Verify the UEM Agent performs the following functions: -Enroll in management -Configure whether users can unenroll from management -Configure periodicity of reachability events. If the UEM Agent does not perform the following functions: -Enroll in management -Configure whether users can unenroll from management -Configure periodicity of reachability event this is a finding.

Fix: F-37396r612045_fix

Configure the UEM Agent to perform the following functions: -Enroll in management -Configure whether users can unenroll from management -Configure periodicity of reachability events.

b
The UEM Agent must be configured to perform one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data.
CM-6 - Medium - CCI-000366 - V-234247 - SV-234247r1213341_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-APP-000516-UEM-100011
Vuln IDs
  • V-234247
Rule IDs
  • SV-234247r1213341_rule
Access control of mobile devices to DoW sensitive information or access to DoW networks must be controlled so that DoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control. Satisfies: FMT_UNR_EXT.1.1
Checks: C-37432r1212887_chk

Verify the UEM Agent performs one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data. If the UEM Agent does not perform one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data this is a finding.

Fix: F-37397r612048_fix

Configure the UEM Agent to perform one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data.

c
All UEM Agent cryptography supporting DoW functionality must be FIPS 140-3 validated.
SC-13 - High - CCI-002450 - V-234248 - SV-234248r1213344_rule
RMF Control
SC-13
Severity
H
CCI
CCI-002450
Version
SRG-APP-000555-UEM-100014
Vuln IDs
  • V-234248
Rule IDs
  • SV-234248r1213344_rule
Unapproved cryptographic algorithms cannot be relied on to provide confidentiality or integrity, and DoW data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140-3 validation provides assurance that the relevant cryptography has been implemented correctly. FIPS 140-3 validation is also a strict requirement for use of cryptography in the federal government for protecting unclassified data. This requirement also applies to Zero Trust initiatives. Satisfies: FCS Reference: PP-MDMA-200600
Checks: C-37433r1213342_chk

Verify all UEM Agent cryptography supporting DoW functionality is FIPS 140-3 validated. If all UEM Agent cryptography supporting DoW functionality is not FIPS 140-3 validated, this is a finding.

Fix: F-37398r1213343_fix

Configure the UEM Agent cryptography supporting DoW functionality for FIPS 140-3 mode.