STIGQter: STIG Summary: Google Android 16 COBO Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 13 May 2026:

Google Android 16 allowlist must be configured to not include applications with the following characteristics: - Backs up mobile device (MD) data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; - Payment processing; - Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs or printers; - Backs up own data to a remote system; - Renders TV shows and movies.

DISA Rule

SV-276755r1140057_rule

Vulnerability Number

V-276755

Group Title

PP-MDF-333070

Rule Version

GOOG-16-006700

Severity

CAT II

CCI(s)

CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

Fix Recommendation

Configure the Google Android 16 device application allowlist to exclude applications with the following characteristics:
- Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services);
- Transmits MD diagnostic data to non-DOD servers;
- Voice assistant application (if available) when MD is locked;
- Voice dialing application (if available) when MD is locked;
- Allows synchronization of data or applications between devices associated with user;
- Payment processing;
- Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers;
- Backs up own data to a remote system;
- Renders TV shows and movies.

On the EMM console:

1. Go to the Android app catalog for managed Google Play.
2. Before selecting an app, review the app details and privacy policy to ensure the app does not include prohibited characteristics.

Managed Google Play is always an allowlisted App Store.

Check Contents

Review managed Google Android 16 device configuration settings to determine if the mobile device has an application allowlist configured and that the application allowlist does not include applications with the following characteristics:
- Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services);
- Transmits MD diagnostic data to non-DOD servers;
- Voice assistant application (if available) when MD is locked;
- Voice dialing application (if available) when MD is locked;
- Allows synchronization of data or applications between devices associated with user;
- Payment processing;
- Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers;
- Backs up own data to a remote system.
- Renders TV shows and movies.

This validation procedure is performed only on the EMM Administration Console.

On the EMM console:

1. Review the list of selected Managed Google Play apps.
2. Review the details and privacy policy of each selected app to ensure the app does not include prohibited characteristics.

If the EMM console device policy includes applications with unauthorized characteristics, this is a finding.

Vulnerability Number

V-276755

Documentable

False

Rule Version

GOOG-16-006700

Severity Override Guidance

Check Content Reference

Target Key

5716