GOOG-13-002800 - Google Android 13 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-254733r959010_rule

STIG-ID|GOOG-13-002800

Vuln-ID|V-254733

GOOG-13-006000 - Google Android 13 must be configured to enforce a minimum password length of six characters.

CCI|CCI-000205

CCI|CCI-004066

Rule-ID|SV-254734r1015721_rule

STIG-ID|GOOG-13-006000

Vuln-ID|V-254734

GOOG-13-006100 - Google Android 13 must be configured to not allow passwords that include more than four repeating or sequential characters - Alphanumeric

CCI|CCI-000366

Rule-ID|SV-254735r959010_rule

STIG-ID|GOOG-13-006100

Vuln-ID|V-254735

GOOG-13-006100 - Google Android 13 must be configured to not allow passwords that include more than four repeating or sequential characters - Complex Characters

GOOG-13-006200 - Google Android 13 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.

CCI|CCI-000057

Rule-ID|SV-254736r958402_rule

STIG-ID|GOOG-13-006200

Vuln-ID|V-254736

GOOG-13-006300 - Google Android 13 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

Rule-ID|SV-254737r958402_rule

STIG-ID|GOOG-13-006300

Vuln-ID|V-254737

GOOG-13-006400 - Google Android 13 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-254738r958388_rule

STIG-ID|GOOG-13-006400

Vuln-ID|V-254738

GOOG-13-006500 - Google Android 13 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

Rule-ID|SV-254739r959010_rule

STIG-ID|GOOG-13-006500

Vuln-ID|V-254739

GOOG-13-006600 - Google Android 13 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-254740r959010_rule

STIG-ID|GOOG-13-006600

Vuln-ID|V-254740

GOOG-13-006700 - Google Android 13 allowlist must be configured to not include applications with the following characteristics:

Rule-ID|SV-254741r959010_rule

STIG-ID|GOOG-13-006700

Vuln-ID|V-254741

GOOG-13-006800 - Google Android 13 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-254742r959010_rule

STIG-ID|GOOG-13-006800

Vuln-ID|V-254742

GOOG-13-007200 - Google Android 13 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000765

CCI|CCI-000767

Rule-ID|SV-254743r1015722_rule

STIG-ID|GOOG-13-007200

Vuln-ID|V-254743

GOOG-13-007400 - Google Android 13 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-254744r958478_rule

STIG-ID|GOOG-13-007400

Vuln-ID|V-254744

GOOG-13-007700 - Google Android 13 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-254745r958390_rule

STIG-ID|GOOG-13-007700

Vuln-ID|V-254745

GOOG-13-007800 - Google Android 13 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-254746r958442_rule

STIG-ID|GOOG-13-007800

Vuln-ID|V-254746

GOOG-13-008400 - Google Android 13 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-254747r958478_rule

STIG-ID|GOOG-13-008400

Vuln-ID|V-254747

GOOG-13-008500 - Google Android 13 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-254748r959010_rule

STIG-ID|GOOG-13-008500

Vuln-ID|V-254748

GOOG-13-008600 - Google Android 13 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-254749r959010_rule

STIG-ID|GOOG-13-008600

Vuln-ID|V-254749

GOOG-13-009000 - Google Android 13 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-254750r959010_rule

STIG-ID|GOOG-13-009000

Vuln-ID|V-254750

GOOG-13-009400 - Google Android 13 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP) - SPP.

CCI|CCI-001761

Rule-ID|SV-254751r959010_rule

STIG-ID|GOOG-13-009400

Vuln-ID|V-254751

GOOG-13-009500 - Google Android 13 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-254752r1042500_rule

STIG-ID|GOOG-13-009500

Vuln-ID|V-254752

GOOG-13-009800 - Google Android 13 users must complete required training.

Rule-ID|SV-254753r1042502_rule

STIG-ID|GOOG-13-009800

Vuln-ID|V-254753

GOOG-13-009900 - Google Android 13 must be configured to enforce that Wi-Fi Sharing is disabled.

Rule-ID|SV-254754r959010_rule

STIG-ID|GOOG-13-009900

Vuln-ID|V-254754

GOOG-13-010000 - Google Android 13 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-254755r959010_rule

STIG-ID|GOOG-13-010000

Vuln-ID|V-254755

GOOG-13-010200 - The Google Android 13 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-254756r959010_rule

STIG-ID|GOOG-13-010200

Vuln-ID|V-254756

GOOG-13-010600 - Google Android 13 must be configured to disallow configuration of date and time.

Rule-ID|SV-254757r959010_rule

STIG-ID|GOOG-13-010600

Vuln-ID|V-254757

GOOG-13-010800 - Android 13 devices must have the latest available Google Android 13 operating system installed.

CAT|I

Rule-ID|SV-254758r959010_rule

STIG-ID|GOOG-13-010800

Vuln-ID|V-254758

GOOG-13-010900 - Android 13 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-254759r959010_rule

STIG-ID|GOOG-13-010900

Vuln-ID|V-254759

GOOG-13-011000 - Android 13 devices must be configured to enable Common Criteria Mode (CC Mode) - CC Mode.

Rule-ID|SV-254760r959010_rule

STIG-ID|GOOG-13-011000

Vuln-ID|V-254760

GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-254761r959010_rule

STIG-ID|GOOG-13-012200

Vuln-ID|V-254761

GOOG-13-012300 - The Google Android 13 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-254762r970707_rule

STIG-ID|GOOG-13-012300

Vuln-ID|V-254762

GOOG-13-012400 - Google Android 13 must allow only the Administrator (MDM) to perform the following management function: Disable Phone Hub.

Detections

Analytics

MobileIron - DISA Google Android 13 COBO STIG v2r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

MobileIron - DISA Google Android 13 COBO STIG v2r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

MobileIron - DISA Google Android 13 COBO STIG v2r2