GOOG-13-002800 - Google Android 13 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-254764r959010_rule

STIG-ID|GOOG-13-002800

Vuln-ID|V-254764

GOOG-13-006000 - Google Android 13 must be configured to enforce a minimum password length of six characters.

CCI|CCI-000205

CCI|CCI-004066

Rule-ID|SV-254765r1015723_rule

STIG-ID|GOOG-13-006000

Vuln-ID|V-254765

GOOG-13-006100 - Google Android 13 must be configured to not allow passwords that include more than four repeating or sequential characters - Alphanumeric

CCI|CCI-000366

Rule-ID|SV-254766r959010_rule

STIG-ID|GOOG-13-006100

Vuln-ID|V-254766

GOOG-13-006100 - Google Android 13 must be configured to not allow passwords that include more than four repeating or sequential characters - Complex Characters

GOOG-13-006200 - Google Android 13 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.

CCI|CCI-000057

Rule-ID|SV-254767r958402_rule

STIG-ID|GOOG-13-006200

Vuln-ID|V-254767

GOOG-13-006300 - Google Android 13 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

Rule-ID|SV-254768r958402_rule

STIG-ID|GOOG-13-006300

Vuln-ID|V-254768

GOOG-13-006400 - Google Android 13 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-254769r958388_rule

STIG-ID|GOOG-13-006400

Vuln-ID|V-254769

GOOG-13-006500 - Google Android 13 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

Rule-ID|SV-254770r959010_rule

STIG-ID|GOOG-13-006500

Vuln-ID|V-254770

GOOG-13-006600 - Google Android 13 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-254771r959010_rule

STIG-ID|GOOG-13-006600

Vuln-ID|V-254771

GOOG-13-006700 - Google Android 13 allowlist must be configured to not include applications with the following characteristics:

Rule-ID|SV-254772r959010_rule

STIG-ID|GOOG-13-006700

Vuln-ID|V-254772

GOOG-13-006800 - Google Android 13 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-254773r959010_rule

STIG-ID|GOOG-13-006800

Vuln-ID|V-254773

GOOG-13-007200 - Google Android 13 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000765

CCI|CCI-000767

Rule-ID|SV-254774r1015724_rule

STIG-ID|GOOG-13-007200

Vuln-ID|V-254774

GOOG-13-007400 - Google Android 13 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-254775r958478_rule

STIG-ID|GOOG-13-007400

Vuln-ID|V-254775

GOOG-13-007700 - Google Android 13 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-254776r958390_rule

STIG-ID|GOOG-13-007700

Vuln-ID|V-254776

GOOG-13-007800 - Google Android 13 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-254777r958442_rule

STIG-ID|GOOG-13-007800

Vuln-ID|V-254777

GOOG-13-008400 - Google Android 13 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-254778r958478_rule

STIG-ID|GOOG-13-008400

Vuln-ID|V-254778

GOOG-13-008500 - Google Android 13 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-254779r959010_rule

STIG-ID|GOOG-13-008500

Vuln-ID|V-254779

GOOG-13-008600 - Google Android 13 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-254780r959010_rule

STIG-ID|GOOG-13-008600

Vuln-ID|V-254780

GOOG-13-008900 - Google Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].

CCI|CCI-002233

CCI|CCI-002530

Rule-ID|SV-254781r959010_rule

STIG-ID|GOOG-13-008900

Vuln-ID|V-254781

GOOG-13-009000 - Google Android 13 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-254782r959010_rule

STIG-ID|GOOG-13-009000

Vuln-ID|V-254782

GOOG-13-009400 - Google Android 13 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP) - SPP.

CCI|CCI-001761

Rule-ID|SV-254783r959010_rule

STIG-ID|GOOG-13-009400

Vuln-ID|V-254783

GOOG-13-009500 - Google Android 13 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-254784r1042505_rule

STIG-ID|GOOG-13-009500

Vuln-ID|V-254784

GOOG-13-009800 - Google Android 13 users must complete required training.

Rule-ID|SV-254785r1042507_rule

STIG-ID|GOOG-13-009800

Vuln-ID|V-254785

GOOG-13-009900 - Google Android 13 must be configured to enforce that Wi-Fi Sharing is disabled.

Rule-ID|SV-254786r959010_rule

STIG-ID|GOOG-13-009900

Vuln-ID|V-254786

GOOG-13-010000 - Google Android 13 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-254787r959010_rule

STIG-ID|GOOG-13-010000

Vuln-ID|V-254787

GOOG-13-010100 - The Google Android 13 work profile must be configured to prevent users from adding personal email accounts to the work email app.

Rule-ID|SV-254788r959010_rule

STIG-ID|GOOG-13-010100

Vuln-ID|V-254788

GOOG-13-010200 - The Google Android 13 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-254789r959010_rule

STIG-ID|GOOG-13-010200

Vuln-ID|V-254789

GOOG-13-010300 - Google Android 13 must be provisioned as a fully managed device and configured to create a work profile.

Rule-ID|SV-254790r959010_rule

STIG-ID|GOOG-13-010300

Vuln-ID|V-254790

GOOG-13-010400 - The Google Android 13 work profile must be configured to disable automatic completion of work space internet browser text input.

Rule-ID|SV-254791r959010_rule

STIG-ID|GOOG-13-010400

Vuln-ID|V-254791

GOOG-13-010500 - The Google Android 13 work profile must be configured to disable the autofill services.

Rule-ID|SV-254792r959010_rule

STIG-ID|GOOG-13-010500

Vuln-ID|V-254792

GOOG-13-010600 - Google Android 13 must be configured to disallow configuration of date and time.

Rule-ID|SV-254793r959010_rule

STIG-ID|GOOG-13-010600

Vuln-ID|V-254793

GOOG-13-010800 - Android 13 devices must have the latest available Google Android 13 operating system installed.

CAT|I

Rule-ID|SV-254794r959010_rule

STIG-ID|GOOG-13-010800

Vuln-ID|V-254794

GOOG-13-010900 - Android 13 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-254795r959010_rule

STIG-ID|GOOG-13-010900

Vuln-ID|V-254795

GOOG-13-011000 - Android 13 devices must be configured to enable Common Criteria Mode (CC Mode) - CC Mode.

Rule-ID|SV-254796r959010_rule

STIG-ID|GOOG-13-011000

Vuln-ID|V-254796

GOOG-13-012200 - Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-254797r959010_rule

STIG-ID|GOOG-13-012200

Vuln-ID|V-254797

GOOG-13-012300 - The Google Android 13 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-254798r970707_rule

STIG-ID|GOOG-13-012300

Vuln-ID|V-254798

GOOG-13-012400 - Google Android 13 must allow only the Administrator (MDM) to perform the following management function: Disable Phone Hub.

Detections

Analytics

MobileIron - DISA Google Android 13 COPE STIG v2r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

MobileIron - DISA Google Android 13 COPE STIG v2r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

MobileIron - DISA Google Android 13 COPE STIG v2r2