7 Configure security policy for connecting to wireless networks Windows 10 Windows 10 Windows 10 Mobile 8 Transition to the locked state Windows 10 Windows 10 Mobile Windows 10 9 TSF wipe of protected data Windows 10 Windows 10 Windows 10 Mobile 10 Configure application installation policy Windows 10 Windows 10 Windows 10 Mobile 11 Import keys/secrets into the secure key storage Windows 10 Windows 10 Mobile Windows 10 12 Destroy imported keys/secrets and any other keys/secrets in the secure key storage Windows 10 Windows 10 Mobile Windows 10 13 Import X.509v3 certificates into the Trust Anchor Database Windows 10 Windows 10 Windows 10 Mobile 14 Remove imported X.509v3 certificates and any other X.509v3 certificates in the Trust Anchor Database Windows 10 Mobile Windows 10 15 Enroll the TOE in management Windows 10 Mobile Windows 10 16 Remove applications Windows 10 Windows 10 Windows 10 Mobile 17 Update system software Windows 10 Windows 10 Windows 10 Mobile 18 Install applications Windows 10 Windows 10 Windows 10 Mobile 19 Remove Enterprise applications Windows 10 Windows 10 Windows 10 Mobile
Windows 10 Mobile 36 Configure the unlock banner Windows 10 Windows 10 Windows 10 Mobile 37 Configure the auditable items Windows 10 38 Retrieve TSF-software integrity verification values Windows 10 Windows 10 Mobile 39 enable/disable [USB mass storage mode] Windows 10 Mobile 40 Enable/disable backup to remote system Windows 10 Windows 10 Mobile Windows 10 44 Enable/disable location services Windows 10 Windows 10 Windows 10 Mobile Managing Audits This section contains the following Common Criteria SFRs: Audit Data Generation (FAU_GEN.1), Selective Audit (FAU_SEL.1) Extended: Audit Storage Protection (FAU_STG_EXT.1) Specifications of Management Functions (FMT_SMF_EXT.1) Windows 10 Audit Events The following required audits are described for FAU_GEN.1: Description Id Start-up and shutdown of the audit functions Security: 4608, 1100 All administrative actions <see first table below> Startup and shutdown of the OS and kernel Security: 4608, 1100
Insertion or removal of removable media Microsoft- Windows-Kernel-PnP/Device Configuration: 410 Establishment of a synchronizing connection System: 36880 Microsoft-Windows-CAPI2/Operational: 11 Specifically defined auditable events from table 10 <see second table below> Audit records reaching [assignment: integer value less than 100] percentage of audit capacity, [assignment: other auditable events derived from this profile Security: 1103 Table 1: FAU_GEN.1 audits (AGD1: FAU_GEN.1) The following table correlates the set of administrative operations described in this document with their associated audits. Section FMT_SMF_EXT.1 has test procedures to produce these audits. Administrative Action Id configure password policy: minimum password length minimum password complexity maximum password lifetime IT Administrator: 813 Local Administrator: Security: 4739 configure session locking policy: screen-lock enabled/disabled screen lock timeout number of authentication failures IT Administrator: 813 Local Administrator: Security: 4739 enable/disable the VPN protection: across device [b. on a per-app basis c. no other method] Security: Enable: 4651, 5451 Disable: 4655 enable/disable [GPS, Wi-Fi, Bluetooth, mobile broadband] 813
This section contains the following Common Criteria SFRs: Default TOE Access Banners (FTA_TAB.1) Specifications of Management Functions (FMT_SMF_EXT.1) IT Administrator Guidance The following MSDN topic describes the LockscreenWallpaper policy the IT administrator may use to manage notifications prior to unlocking enrolled devices: EnterpriseAssignedAccess CSP: Windows 10 Local Administrator Guidance The following TechNet topics describe how to configure notifications prior to unlocking devices: Interactive logon: Message title for users attempting to log on: Interactive logon: Message text for users attempting to log on: Managing Airplane Mode (AGD1: FMT_SMF_EXT.1(4)) This section contains the following Common Criteria SFRs: Specifications of Management Functions (FMT_SMF_EXT.1) When airplane mode is on wireless connections, cellular voice, cellular protocols, and messaging functionality will not work on the device. Windows 10 User Guidance To enable/disable airplane mode go to Settings -> Network & Internet -> Airplane Mode.