STIGQter: STIG Summary: Google Android 15 COBO Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 13 May 2026:

Google Android 15 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

DISA Rule

SV-267436r1033112_rule

Vulnerability Number

V-267436

Group Title

PP-MDF-333060

Rule Version

GOOG-15-006600

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure the Google Android 15 device to use an application allow list.

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Select apps to be available (only approved apps).
3. Push updated policy to the device.

Note: Managed Google Play is an allowed App Store.

Check Contents

Review managed Google Android 15 device configuration settings to determine if the mobile device has an application allow list configured. Verify all applications on the allow list have been approved by the authorizing official (AO).

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Verify all selected apps are AO approved.

On the managed Google Android 15 device:

COBO and COPE:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allow list will include approved core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. For Google Android, there are no preinstalled applications.

Vulnerability Number

V-267436

Documentable

False

Rule Version

GOOG-15-006600

Severity Override Guidance

Review managed Google Android 15 device configuration settings to determine if the mobile device has an application allow list configured. Verify all applications on the allow list have been approved by the authorizing official (AO).

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Verify all selected apps are AO approved.

On the managed Google Android 15 device:

COBO and COPE:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allow list will include approved core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. For Google Android, there are no preinstalled applications.

Check Content Reference

M

Target Key

5653