BaselineWatch
5 STIGs
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Mobile STIGs

5 STIGs followed · All platforms
All 40 CAT I 3CAT II 30CAT III 7 Browse in the Register

CAT III 7

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

  1. GOOG-16-007700 CAT III V-276760 · PP-MDF-333160

    Google Android 16 must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

    Maps to AC-8 via CCI-000048
    Check

    The DoW warning banner can be displayed by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each managed Android 16 device user (preferred method). 2. By configuring the warning banner text on the EMM console and installing the banner on each managed Android 16 mobile device. Determine which method is used at the Google Android 16 device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several Google Android 16 device users and verify that the agreement includes the required DoW warning banner text. Validation Procedure for Method #2: On the EMM console: COBO: 1. Open "Lock screen restrictions". 2. Select "Lock screen message". 3. Verify the message. COPE: 1. Open "Lock screen restrictions". 2. Select "Personal Profile". 3. Select "Lock screen message". 4. Verify the message. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed; or for Method #2, the EMM console device policy is not set to display a warning banner with the appropriate designated wording; or on the managed Google Android 16 device, the device policy is not set to display a warning banner with the appropriate designated wording, this is a finding.

    Fix

    Configure the DoW warning banner by either of the following methods (required text is found in the Discussion): 1. By placing the DoW warning banner text in the user agreement signed by each Google Android 16 device user (preferred method). 2. By configuring the warning banner text on the EMM console and installing the banner on each Google Android 16 mobile device. On the EMM console: COBO: 1. Open "Lock screen restrictions". 2. Select "Lock screen message". 3. Enter the message. COPE: 1. Open "Lock screen restrictions". 2. Select "Personal Profile". 3. Select "Lock screen message". 4. Enter the message. Configuration API: setDeviceOwnerLockScreenInfo

  2. GOOG-16-009400 CAT III V-276767 · PP-MDF-333320

    Google Android 16 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP).

    Maps to CM-7, CM-7(1) via CCI-000381, CCI-001761
    Check

    Determine if the authorizing official (AO) has approved the use of Bluetooth at the site. If the AO has not approved the use of Bluetooth, verify that Bluetooth has been disabled. On the EMM console: COBO: 1. Open the "User restrictions" section. 2. Verify that "Disallow Bluetooth" is toggled to "ON". COPE: 1. Open the "User restrictions on parent" section. 2. Verify that "Disallow Bluetooth" is toggled to "ON". On the managed Google Android 16 device: COBO and COPE: 1. Go to Settings >> Connected Devices >> Connection Preferences >> Bluetooth. 2. Verify that "Use Bluetooth" is set to "OFF" and cannot be toggled to "ON". If the AO has approved the use of Bluetooth, on the managed Android 16 device: 1. Go to Settings >> Connected Devices. 2. Verify that only approved Bluetooth-connected devices using approved profiles are listed. If the AO has not approved the use of Bluetooth, and Bluetooth use is not disabled via an EMM-managed device policy, this is a finding. If the AO has approved the use of Bluetooth, and Bluetooth devices using unauthorized Bluetooth profiles are listed on the device under "Connected devices", this is a finding.

    Fix

    Configure the Google Android 16 device to disable Bluetooth, or if the AO has approved the use of Bluetooth (for example, for car hands-free use), train the user to connect to only authorized Bluetooth devices using only HSP, HFP, or SPP Bluetooth-capable devices (User-Based Enforcement). To disable Bluetooth, use the following procedure: On the EMM console: COBO: 1. Open the "User restrictions" section. 2. Toggle "Disallow Bluetooth" to "ON". COPE: 1. Open the "User restrictions on parent" section. 2. Toggle "Disallow Bluetooth" to "ON". The user training requirement is satisfied in GOOG-16-009800. Configuration API: DISALLOW_CONFIG_BLUETOOTH

  3. GOOG-16-010900 CAT III V-276778 · PP-MDF-993300

    Android 16 devices must be configured to disable the use of third-party keyboards.

    Maps to CM-6 via CCI-000366
    Check

    Review the managed Google Android 16 configuration settings to confirm that no third-party keyboards are enabled. This procedure is performed on the EMM Administration Console. On the EMM console: COBO and COPE: 1. Open "Input methods". 2. Tap "Set input methods". 3. Verify that only the approved keyboards are selected. If third-party keyboards are allowed, this is a finding.

    Fix

    Configure the Google Android 16 device to disallow the use of third-party keyboards. On the EMM console: COBO and COPE: 1. Open "Input methods". 2. Tap "Set input methods". 3. Select only the approved keyboard. Admins can also configure application allowlists for Google Play that do not have any third-party keyboards for user installation.

  4. GOOG-16-011000 CAT III V-276779 · PP-MDF-993300

    Android 16 devices must be configured to enable Common Criteria (CC) Mode.

    Maps to CM-6 via CCI-000366
    Check

    Review the managed Google Android 16 configuration settings to confirm CC Mode is enabled. This procedure is performed on the EMM Administration Console. COBO and COPE: 1. Open Device owner management. 2. Verify that "Enable Common Criteria mode" is toggled to "ON". If CC Mode is not enabled, this is a finding.

    Fix

    Configure the Google Android 16 device to implement CC Mode. On the EMM console: COBO and COPE: 1. Open Device owner management. 2. Toggle "Enable Common Criteria mode" to "ON". Configuration API: setCommonCriteriaModeEnabled

  5. GOOG-16-012400 CAT III V-276782 · PP-MDF-993300

    Google Android 16 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub.

    Maps to SC-4 via CCI-001090
    Check

    Review the EMM configuration to confirm phone hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify that "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming policy". 4. Verify that "Nearby app streaming policy" is set to "Disabled". If on the management tool the "Nearby Streaming Policy" is not set to "Disabled" and "Nearby app streaming policy" is not set to "Disabled", this is a finding. Note: From a Chromebook, if a device is connected to the Phone Hub, try to set up the Notifications. It will fail to connect to the device to complete the setup if Phone Hub has been disabled on the DoW Android device.

    Fix

    Configure the Google Android 16 device to disable the nearby notification streaming policy to disable Phone Hub. On the EMM console: COBO and COPE: 1. Open "Nearby notification streaming policy". 2. Set "Nearby notification streaming policy" to "Disabled". 3. Open "Nearby app streaming policy". 4. Set "Nearby app streaming policy" to "Disabled". Configuration API: setNearbyNotificationStreamingPolicy to NEARBY_STREAMING_DISABLED

  6. GOOG-16-013200 CAT III V-276786 · PP-MDF-993300

    Google Android 16 must disable wireless printing.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm that wireless printing has been disabled. This check procedure is performed on the device management tool and the Google Android 16 device. On the MDM console: COBO and COPE: 1. Open user restrictions. 2. Verify that "Disallow printing" is enabled. On the managed Google Android 16 device: COBO and COPE: 1. Open a document or image from the file app and try to print. 2. Verify that printing is not possible. If wireless printing has not been disabled, this is a finding.

    Fix

    Configure Google Android 16 device to disable wireless printing. On the MDM console, do the following: COBO and COPE: 1. Open user restrictions. 2. Enable "Disallow printing". Configuration API: PRINTING_DISALLOWED

  7. GOOG-16-013300 CAT III V-276787 · PP-MDF-993300

    Google Android 16 must disable screen capture.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm that screen capture has been disabled. This check procedure is performed on the device management tool and the Google Android 16 device. On the MDM console: COBO and COPE: 1. Open Camera, screen capture, and audio section. 2. Verify that the "Disable Screen Capture" setting is enabled. On the managed Google Android 16 device: COBO and COPE: 1. Press the Power button and the volume down button at the same time. 2. Verify that the message "Taking screenshots is blocked by your admin" appears. If screen capture has not been disabled, this is a finding.

    Fix

    Install a configuration profile to disable screen capture. On the MDM console, do the following: COBO and COPE: 1. Open Camera, screen capture, and audio section. 2. Enable the "Disable Screen Capture" setting. Configuration API: screenCaptureDisabled