STIGQter: STIG Summary: Samsung Android 16 COPE Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 13 May 2026:

Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.

DISA Rule

SV-276652r1139478_rule

Vulnerability Number

V-276652

Group Title

PP-MDF-333100

Rule Version

KNOX-16-006000

Severity

CAT I

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Configure the Samsung Android devices to enable data-at-rest protection for removable media, or alternatively, disable their use.

This requirement is not applicable for devices that do not support removable storage media.

On the management tool, in the device restrictions, set "Mount physical media" to "Disallow".

This disables the use of all removable storage, e.g., microSD cards, USB thumb drives, etc.

If the deployment requires the use of microSD cards, Knox Platform for Enterprise (KPE) can be used to allow them in a STIG-approved configuration. In this case, do not configure this policy, and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Enforce external storage encryption" with value "enable".

API: addUserRestriction, DISALLOW_MOUNT_PHYSICAL_MEDIA

Check Contents

Review the configuration to determine if the Samsung Android devices are either enabling data-at-rest protection for removable media or disabling their use.

This requirement is not applicable for devices that do not support removable storage media.

This validation procedure is performed on both the management tool and the Samsung Android device.

On the management tool, in the device restrictions, verify "Mount physical media" is set to "Disallow".

On the Samsung Android device, verify that a microSD card cannot be mounted.

The device should ignore the inserted SD card and no notifications for the transfer of media files should appear, nor should any files be listed using a file browser, such as Samsung My Files.

If on the management tool "Mount physical media" is not set to "Disallow", or on the Samsung Android device a microSD card can be mounted, this is a finding.

Vulnerability Number

V-276652

Documentable

False

Rule Version

KNOX-16-006000

Severity Override Guidance

Review the configuration to determine if the Samsung Android devices are either enabling data-at-rest protection for removable media or disabling their use.

This requirement is not applicable for devices that do not support removable storage media.

This validation procedure is performed on both the management tool and the Samsung Android device.

On the management tool, in the device restrictions, verify "Mount physical media" is set to "Disallow".

On the Samsung Android device, verify that a microSD card cannot be mounted.

The device should ignore the inserted SD card and no notifications for the transfer of media files should appear, nor should any files be listed using a file browser, such as Samsung My Files.

If on the management tool "Mount physical media" is not set to "Disallow", or on the Samsung Android device a microSD card can be mounted, this is a finding.

Check Content Reference

M

Target Key

5715