GOOG-14-002800 - Google Android 14 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-258377r959010_rule

STIG-ID|GOOG-14-002800

Vuln-ID|V-258377

GOOG-14-006000 - Google Android 14 must be configured to enforce a minimum password length of six characters.

CCI|CCI-004066

Rule-ID|SV-258378r985879_rule

STIG-ID|GOOG-14-006000

Vuln-ID|V-258378

GOOG-14-006100 - Google Android 14 must be configured to not allow passwords that include more than four repeating or sequential characters - Characters

Rule-ID|SV-258379r985880_rule

STIG-ID|GOOG-14-006100

Vuln-ID|V-258379

GOOG-14-006100 - Google Android 14 must be configured to not allow passwords that include more than four repeating or sequential characters - Numbers

GOOG-14-006300 - Google Android 14 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

CCI|CCI-000057

Rule-ID|SV-258381r971318_rule

STIG-ID|GOOG-14-006300

Vuln-ID|V-258381

GOOG-14-006400 - Google Android 14 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-258382r958388_rule

STIG-ID|GOOG-14-006400

Vuln-ID|V-258382

GOOG-14-006500 - Google Android 14 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

CCI|CCI-000366

Rule-ID|SV-258383r959010_rule

STIG-ID|GOOG-14-006500

Vuln-ID|V-258383

GOOG-14-006600 - Google Android 14 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-258384r958804_rule

STIG-ID|GOOG-14-006600

Vuln-ID|V-258384

GOOG-14-006700 - Google Android 14 allowlist must be configured to not include applications with the following characteristics:

CCI|CCI-000803

Rule-ID|SV-258385r1032950_rule

STIG-ID|GOOG-14-006700

Vuln-ID|V-258385

GOOG-14-006800 - Google Android 14 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-258386r958404_rule

STIG-ID|GOOG-14-006800

Vuln-ID|V-258386

GOOG-14-007200 - Google Android 14 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000765

Rule-ID|SV-258387r985881_rule

STIG-ID|GOOG-14-007200

Vuln-ID|V-258387

GOOG-14-007400 - Google Android 14 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-258388r958478_rule

STIG-ID|GOOG-14-007400

Vuln-ID|V-258388

GOOG-14-007700 - Google Android 14 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-258389r958390_rule

STIG-ID|GOOG-14-007700

Vuln-ID|V-258389

GOOG-14-007800 - Google Android 14 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-258390r958442_rule

STIG-ID|GOOG-14-007800

Vuln-ID|V-258390

GOOG-14-008400 - Google Android 14 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-258391r958896_rule

STIG-ID|GOOG-14-008400

Vuln-ID|V-258391

GOOG-14-008500 - Google Android 14 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-258392r958524_rule

STIG-ID|GOOG-14-008500

Vuln-ID|V-258392

GOOG-14-008600 - Google Android 14 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-258393r958524_rule

STIG-ID|GOOG-14-008600

Vuln-ID|V-258393

GOOG-14-009000 - Google Android 14 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-258394r959010_rule

STIG-ID|GOOG-14-009000

Vuln-ID|V-258394

GOOG-14-009400 - Google Android 14 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile) - SPP.

CCI|CCI-001761

Rule-ID|SV-258395r958478_rule

STIG-ID|GOOG-14-009400

Vuln-ID|V-258395

GOOG-14-009500 - Google Android 14 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-258396r1042510_rule

STIG-ID|GOOG-14-009500

Vuln-ID|V-258396

GOOG-14-009800 - Google Android 14 users must complete required training.

Rule-ID|SV-258397r1042512_rule

STIG-ID|GOOG-14-009800

Vuln-ID|V-258397

GOOG-14-009900 - Google Android 14 must be configured to enforce that Wi-Fi Sharing is disabled.

Rule-ID|SV-258398r959010_rule

STIG-ID|GOOG-14-009900

Vuln-ID|V-258398

GOOG-14-010000 - Google Android 14 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-258399r959010_rule

STIG-ID|GOOG-14-010000

Vuln-ID|V-258399

GOOG-14-010200 - The Google Android 14 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-258400r959010_rule

STIG-ID|GOOG-14-010200

Vuln-ID|V-258400

GOOG-14-010600 - Google Android 14 must be configured to disallow configuration of date and time.

Rule-ID|SV-258401r959010_rule

STIG-ID|GOOG-14-010600

Vuln-ID|V-258401

GOOG-14-010800 - Android 14 devices must have the latest available Google Android 14 operating system installed.

CAT|I

Rule-ID|SV-258402r959010_rule

STIG-ID|GOOG-14-010800

Vuln-ID|V-258402

GOOG-14-010900 - Android 14 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-258403r959010_rule

STIG-ID|GOOG-14-010900

Vuln-ID|V-258403

GOOG-14-011000 - Android 14 devices must be configured to enable Common Criteria Mode (CC Mode) - CC Mode.

Rule-ID|SV-258404r959010_rule

STIG-ID|GOOG-14-011000

Vuln-ID|V-258404

GOOG-14-012200 - Google Android 14 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-258405r959010_rule

STIG-ID|GOOG-14-012200

Vuln-ID|V-258405

GOOG-14-012300 - The Google Android 14 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates - EMM to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-258406r959010_rule

STIG-ID|GOOG-14-012300

Vuln-ID|V-258406

GOOG-14-012400 - Google Android 14 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub - MDM to perform the following management function: Disable Phone Hub.

Detections

Analytics

AirWatch - DISA Google Android 14 COBO STIG v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.