STIGQter: STIG Summary: Google Android 14 MDFPP 3.3 BYOAD Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

Google Android 14 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

DISA Rule

SV-260131r958804_rule

Vulnerability Number

V-260131

Group Title

PP-MDF-333060

Rule Version

GOOG-14-706600

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure the Google Android 14 device to use an application allowlist.

On the EMM Console:

1. Go to the Android app catalog for managed Google Play.
2. Select apps to be available (only approved apps).
3. Push updated policy to the device.

Note: Managed Google Play is an allowed App Store.

Check Contents

Review managed Google Android 14 device configuration settings to determine if the mobile device has an application allowlist configured. Verify all applications listed on the allowlist have been approved by the Approving Official (AO).

On the EMM console:

1. Go to the Android app catalog for managed Google Play.
2. Verify all selected apps are AO approved.

On the managed Google Android 14 device:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allowlist will only include approved core applications (included in the OS by the OS vendor) and pre-installed applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and pre-installed applications. For Google Android, there are no pre-installed applications.

Vulnerability Number

V-260131

Documentable

False

Rule Version

GOOG-14-706600

Severity Override Guidance

Review managed Google Android 14 device configuration settings to determine if the mobile device has an application allowlist configured. Verify all applications listed on the allowlist have been approved by the Approving Official (AO).

On the EMM console:

1. Go to the Android app catalog for managed Google Play.
2. Verify all selected apps are AO approved.

On the managed Google Android 14 device:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allowlist will only include approved core applications (included in the OS by the OS vendor) and pre-installed applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and pre-installed applications. For Google Android, there are no pre-installed applications.

Check Content Reference

M

Target Key

5589