STIGQter: STIG Summary: Google Android 16 COPE Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 13 May 2026:

Google Android 16 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

DISA Rule

SV-276856r1140360_rule

Vulnerability Number

V-276856

Group Title

PP-MDF-333060

Rule Version

GOOG-16-006600

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Configure the Google Android 16 device to use an application allowlist.

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Select apps to be available (only approved apps).
3. Push updated policy to the device.

Note: Managed Google Play is an allowed App Store.

Check Contents

Review managed Google Android 16 device configuration settings to determine if the mobile device has an application allowlist configured. Verify that all applications listed on the allowlist have been approved by the authorizing official (AO).

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Verify that all selected apps are AO approved.

On the managed Google Android 16 device:

COBO and COPE:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allowlist will include approved core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. For Google Android, there are no preinstalled applications.

Vulnerability Number

V-276856

Documentable

False

Rule Version

GOOG-16-006600

Severity Override Guidance

Review managed Google Android 16 device configuration settings to determine if the mobile device has an application allowlist configured. Verify that all applications listed on the allowlist have been approved by the authorizing official (AO).

On the EMM console:

COBO and COPE:

1. Go to the Android app catalog for managed Google Play.
2. Verify that all selected apps are AO approved.

On the managed Google Android 16 device:

COBO and COPE:

1. Open the managed Google Play Store.
2. Verify that only the approved apps are visible.

Note: Managed Google Play is an allowed App Store.

If the EMM console list of selected managed Google Play apps includes nonapproved apps, this is a finding.

Note: The application allowlist will include approved core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. For Google Android, there are no preinstalled applications.

Check Content Reference

M

Target Key

5717