DISA STIG library Y26M10
| Ref | Title | Text | |
|---|---|---|---|
| GOOG-16-002800 | Google Android 16 must be configured to enable audit logging. | Inspect the configuration on the managed Google Android 16 device to enable audit logging. This validation procedure is performed only on the EMM Administration Console. On the EMM console: COBO and COPE: 1. Open "Device owner management" s | |
| GOOG-16-006000 | Google Android 16 must be configured to enforce a minimum password length of six characters. | Review managed Google Android 16 device configuration settings to determine if the mobile device is enforcing a minimum password length of six characters. This validation procedure is performed on both the EMM Administration Console and the | |
| GOOG-16-006100 | Google Android 16 must be configured to not allow passwords that include more than four repeating or sequential characters. | Review managed Google Android 16 device configuration settings to determine if the mobile device is prohibiting passwords with more than four repeating or sequential characters. This validation procedure is performed on both the EMM Adminis | |
| GOOG-16-006300 | Google Android 16 must be configured to lock the display after 15 minutes (or less) of inactivity. | Review managed Google Android device configuration settings to determine if the mobile device is enforcing a screen-lock policy that will lock the display after a period of 15 minutes or less of inactivity. Note: The Google Android 16 Setti | |
| GOOG-16-006400 | Google Android 16 must be configured to not allow more than 10 consecutive failed authentication attempts. | Review managed Google Android 16 device configuration settings to determine if the mobile device has the maximum number of consecutive failed authentication attempts set at 10 or fewer. This validation procedure is performed on both the EMM | |
| GOOG-16-006500 | Google Android 16 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoW-approved commercial app repository, MDM server, mobile application store]. | Review managed Google Android 16 device configuration settings to determine if the mobile device has only approved application repositories (DoW-approved commercial app repository, EMM server, and/or mobile application store). This validati | |
| GOOG-16-006600 | Google Android 16 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version]. | Review managed Google Android 16 device configuration settings to determine if the mobile device has an application allowlist configured. Verify that all applications listed on the allowlist have been approved by the authorizing official (A | |
| GOOG-16-006700 | Google Android 16 allowlist must be configured to not include applications with the following characteristics: - Backs up mobile device (MD) data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; -… | Review managed Google Android 16 device configuration settings to determine if the mobile device has an application allowlist configured and that the application allowlist does not include applications with the following characteristics: - | |
| GOOG-16-006750 | Google Android 16 allowlist must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini. | Review managed Google Android 16 device configuration settings to determine if the mobile device has an AI application that processes device data in the cloud, including Google Gemini. This validation procedure is performed only on the EMM | |
| GOOG-16-006800 | Google Android 16 must be configured to not display the following (work profile) notifications when the device is locked: [selection: a. email notifications b. calendar appointments c. contact associated with phone call notification d. text message notification e. other application-based notifications f. all notifications]. | Review managed Google Android 16 device settings to determine if the Google Android 16 device displays (work profile) notifications on the lock screen. Notifications of incoming phone calls are acceptable even when the device is locked. Thi | |
| GOOG-16-007200 | Google Android 16 must be configured to disable trust agents. | Review device configuration settings to confirm that trust agents are disabled. This procedure is performed on both the EMM Administration Console and the managed Google Android 16 device. On the EMM console: COBO: 1. Open "Lock screen rest | |
| GOOG-16-007400 | Google Android 16 must be configured to disable developer modes. | Review managed Google Android 16 device configuration settings to determine whether a developer mode is enabled. This validation procedure is performed on both the EMM Administration Console and the managed Google Android 16 device. On the | |
| GOOG-16-007700 | Google Android 16 must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device. | The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each managed Android 16 device user (preferred | |
| GOOG-16-007800 | Google Android 16 must be configured to generate audit records for the following auditable events: Detected integrity violations. | Review managed Google Android 16 device configuration settings to determine if the mobile device is configured to generate audit records for the following auditable events: Detected integrity violations. This validation procedure is perform | |
| GOOG-16-008400 | Google Android 16 must be configured to disable USB mass storage mode. | Review managed Google Android 16 device configuration settings to determine if the mobile device has a USB mass storage mode and whether it has been disabled. This validation procedure is performed on both the EMM Administration Console and | |
| GOOG-16-008500 | Google Android 16 must be configured to not allow backup of [all applications, configuration data] to locally connected systems. | Review managed Google Android 16 device configuration settings to determine if the capability to back up to a locally connected system has been disabled. This validation procedure is performed on both the EMM Administration Console and the | |
| GOOG-16-008600 | Google Android 16 must be configured to not allow backup of [all applications, configuration data] to remote systems. | Review managed Google Android 16 device configuration settings to determine if the capability to back up to a remote system has been disabled. Note: Because personal accounts cannot be added to the work profile (GOOG-16-009800), this contro | |
| GOOG-16-008700 | Google Android 16 must be configured to enable authentication of personal hotspot connections to the device using a preshared key. | This is a User-Based Enforcement (UBE) control. Check a sample of Pixel phones at the site and verify that the Wi-Fi hotspot preshared key (password) is set to "WPA3-Personal". 1. Go to Settings >> Network & Internet >> Hotspot & tethering. | |
| GOOG-16-009000 | Google Android 16 must be configured to disable multiuser modes. | Review documentation on the managed Google Android 16 device and inspect the configuration on the Google Android device to disable multiuser modes. This validation procedure is performed on both the EMM Administration Console and the manage | |
| GOOG-16-009400 | Google Android 16 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP). | Determine if the authorizing official (AO) has approved the use of Bluetooth at the site. If the AO has not approved the use of Bluetooth, verify that Bluetooth has been disabled. On the EMM console: COBO: 1. Open the "User restrictions" se | |
| GOOG-16-009500 | Google Android 16 must be configured to disable ad hoc wireless client-to-client connection capability. | Review the configuration to determine if the Google Android devices are disallowing Wi-Fi Direct. This validation procedure is performed on both the management tool and the Google Android device. On the management tool, in the user restrict | |
| GOOG-16-009800 | Google Android 16 users must complete required training. | Review a sample of site User Agreements for Google Android 16 device users or similar training records and training course content. Verify that the Google Android 16 device users have completed the required training. The intent is that requ | |
| GOOG-16-009900 | Google Android 16 must be configured to disable Wi-Fi Sharing. | Review device configuration settings to confirm Wi-Fi Sharing is disabled. Mobile Hotspot must be enabled to enable Wi-Fi Sharing. If the authorizing official (AO) has not approved Mobile Hotspot, and it has been verified as disabled on the | |
| GOOG-16-009950 | Google Android 16 must be configured to enforce a password for Wi-Fi and Bluetooth hotspot if approved for use by the authorizing official (AO). If not approved for use, Wi-Fi and Bluetooth hotspot must be disabled. | Review device configuration and user training and determine if the AO has approved hotspot use. If the AO has not approved hotspot use, verify that hotspot use has been disabled: On the EMM console: COBO: 1. Open "Set user restrictions". 2. | |
| GOOG-16-010000 | Google Android 16 must have the DoW root and intermediate PKI certificates installed. | Review device configuration settings to confirm that the DoW root and intermediate PKI certificates are installed. This procedure is performed on both the EMM Administration Console and the managed Google Android 16 device. The current DoW | |
| GOOG-16-010200 | The Google Android 16 work profile must be configured to enforce the system application disable list. | Review the managed Google Android 16 work profile configuration settings to confirm the system application disable list is enforced. This setting is enforced by default. Verify that only approved system apps have been placed on the core all | |
| GOOG-16-010400 | The Google Android 16 work profile must be configured to disable automatic completion of workspace internet browser text input. | Review the work profile Chrome Browser app on the Google Android 16 autofill setting. This procedure is performed only on the EMM Administration Console. On the EMM console: COBO: 1. Open the "Managed Configurations" section. 2. Select the | |
| GOOG-16-010500 | The Google Android device must be configured to disable Wi-Fi Aware for Work Profile apps. | Review device configuration settings to confirm Wi-Fi Aware is disabled for each work profile app. This procedure is performed on the EMM console. For each Work Profile app, verify the app is configured to deny the NEARBY_WIFI_DEVICE permis | |
| GOOG-16-010800 | Android 16 devices must have the latest available Google Android 16 operating system installed. | Review device configuration settings to confirm the Google Android device has the most recently released version of managed Google Android 16 installed. This procedure is performed on both the EMM Administration Console and the managed Goog | |
| GOOG-16-010900 | Android 16 devices must be configured to disable the use of third-party keyboards. | Review the managed Google Android 16 configuration settings to confirm that no third-party keyboards are enabled. This procedure is performed on the EMM Administration Console. On the EMM console: COBO and COPE: 1. Open "Input methods". 2. | |
| GOOG-16-011000 | Android 16 devices must be configured to enable Common Criteria (CC) Mode. | Review the managed Google Android 16 configuration settings to confirm CC Mode is enabled. This procedure is performed on the EMM Administration Console. COBO and COPE: 1. Open Device owner management. 2. Verify that "Enable Common Criteria | |
| GOOG-16-012200 | Google Android 16 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)]. | Review the device configuration to confirm that the USB port is disabled except for charging the device. On the EMM console: COBO and COPE: 1. Open "Set user restrictions". 2. Verify that "Disallow USB file transfer" is set to "ON". If on t | |
| GOOG-16-012300 | Google Android 16 must allow only the administrator (EMM) to install/remove DoW root and intermediate PKI certificates. | Review the device configuration to confirm that the user is unable to remove DoW root and intermediate PKI certificates. On the EMM console: 1. Open "Set user restrictions". 2. Verify that "Disallow config credentials" is toggled to "ON". O | |
| GOOG-16-012400 | Google Android 16 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub. | Review the EMM configuration to confirm phone hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify that "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app str | |
| GOOG-16-012500 | Google Android 16 must be configured to disable "Private Space" use. | Review the Google Android 16 work profile configuration settings to confirm that Private Space is disabled. This procedure is performed only on the EMM Administration Console. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Ve | |
| GOOG-16-013000 | Google Android 16 must disable the user's ability to wipe the device. | Review configuration settings to confirm the user is unable to perform a factory reset and the admin has the ability to inject a recovery account on the device to unlock Factory Reset Protection (FRP). This check procedure is performed on t | |
| GOOG-16-013200 | Google Android 16 must disable wireless printing. | Review configuration settings to confirm that wireless printing has been disabled. This check procedure is performed on the device management tool and the Google Android 16 device. On the MDM console: COBO and COPE: 1. Open user restriction | |
| GOOG-16-013300 | Google Android 16 must disable screen capture. | Review configuration settings to confirm that screen capture has been disabled. This check procedure is performed on the device management tool and the Google Android 16 device. On the MDM console: COBO and COPE: 1. Open Camera, screen capt | |
| GOOG-16-013400 | Google Android 16 devices must have a Mobile Threat Detection (MTD) app installed. | Confirm an MTD app is installed on managed Google Android devices. This check procedure is performed on both the device management tool and the Google Android device. In the MDM console, verify that an MTD app is listed as a managed app bei | |
| GOOG-16-013500 | Google Android 16 must implement the management setting: disable Camera. | Determine if the site AO has approved the use of device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, |
40 of 40.