STIGQter: STIG Summary: Google Android 15 COBO Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 13 May 2026: STIGQter: STIG Summary: Google Android 15 COBO Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 13 May 2026:SV-267437r1134411_rule
V-267437
PP-MDF-333070
GOOG-15-006700
CAT II
10
Configure the Google Android 15 device application allowlist to exclude applications with the following characteristics:
- Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services);
- Transmits MD diagnostic data to non-DOD servers;
- Voice assistant application (if available) when MD is locked;
- Voice dialing application (if available) when MD is locked;
- Allows synchronization of data or applications between devices associated with user;
- Payment processing;
- Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers;
- Backs up own data to a remote system;
- Renders TV shows and movies.
On the EMM console:
1. Go to the Android app catalog for managed Google Play.
2. Before selecting an app, review the app details and privacy policy to ensure the app does not include prohibited characteristics.
Managed Google Play is always an allowlisted App Store.
Review managed Google Android 15 device configuration settings to determine if the mobile device has an application allowlist configured and that the application allowlist does not include applications with the following characteristics:
- Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services);
- Transmits MD diagnostic data to non-DOD servers;
- Voice assistant application (if available) when MD is locked;
- Voice dialing application (if available) when MD is locked;
- Allows synchronization of data or applications between devices associated with user;
- Payment processing;
- Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers;
- Backs up own data to a remote system.
- Renders TV shows and movies.
This validation procedure is performed only on the EMM Administration Console.
On the EMM console:
1. Review the list of selected Managed Google Play apps.
2. Review the details and privacy policy of each selected app to verify that the app does not include prohibited characteristics.
If the EMM console device policy includes applications with unauthorized characteristics, this is a finding.
V-267437
False
GOOG-15-006700
Review managed Google Android 15 device configuration settings to determine if the mobile device has an application allowlist configured and that the application allowlist does not include applications with the following characteristics:
- Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services);
- Transmits MD diagnostic data to non-DOD servers;
- Voice assistant application (if available) when MD is locked;
- Voice dialing application (if available) when MD is locked;
- Allows synchronization of data or applications between devices associated with user;
- Payment processing;
- Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers;
- Backs up own data to a remote system.
- Renders TV shows and movies.
This validation procedure is performed only on the EMM Administration Console.
On the EMM console:
1. Review the list of selected Managed Google Play apps.
2. Review the details and privacy policy of each selected app to verify that the app does not include prohibited characteristics.
If the EMM console device policy includes applications with unauthorized characteristics, this is a finding.
M
5653