GOOG-14-002800 - Google Android 14 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-258408r959010_rule

STIG-ID|GOOG-14-002800

Vuln-ID|V-258408

GOOG-14-006000 - Google Android 14 must be configured to enforce a minimum password length of six characters.

CCI|CCI-004066

Rule-ID|SV-258409r985868_rule

STIG-ID|GOOG-14-006000

Vuln-ID|V-258409

GOOG-14-006100 - Google Android 14 must be configured to not allow passwords that include more than four repeating or sequential characters - Alphanumeric

Rule-ID|SV-258410r985869_rule

STIG-ID|GOOG-14-006100

Vuln-ID|V-258410

GOOG-14-006100 - Google Android 14 must be configured to not allow passwords that include more than four repeating or sequential characters - Complex Characters

GOOG-14-006300 - Google Android 14 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

CCI|CCI-000057

Rule-ID|SV-258412r971318_rule

STIG-ID|GOOG-14-006300

Vuln-ID|V-258412

GOOG-14-006400 - Google Android 14 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-258413r958388_rule

STIG-ID|GOOG-14-006400

Vuln-ID|V-258413

GOOG-14-006500 - Google Android 14 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

CCI|CCI-000366

Rule-ID|SV-258414r959010_rule

STIG-ID|GOOG-14-006500

Vuln-ID|V-258414

GOOG-14-006600 - Google Android 14 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-258415r958804_rule

STIG-ID|GOOG-14-006600

Vuln-ID|V-258415

GOOG-14-006700 - Google Android 14 allowlist must be configured to not include applications with the following characteristics:

CCI|CCI-000803

Rule-ID|SV-258416r1032950_rule

STIG-ID|GOOG-14-006700

Vuln-ID|V-258416

GOOG-14-006800 - Google Android 14 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-258417r958404_rule

STIG-ID|GOOG-14-006800

Vuln-ID|V-258417

GOOG-14-007200 - Google Android 14 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000765

Rule-ID|SV-258418r985870_rule

STIG-ID|GOOG-14-007200

Vuln-ID|V-258418

GOOG-14-007400 - Google Android 14 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-258419r958478_rule

STIG-ID|GOOG-14-007400

Vuln-ID|V-258419

GOOG-14-007700 - Google Android 14 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-258420r958390_rule

STIG-ID|GOOG-14-007700

Vuln-ID|V-258420

GOOG-14-007800 - Google Android 14 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-258421r958442_rule

STIG-ID|GOOG-14-007800

Vuln-ID|V-258421

GOOG-14-008400 - Google Android 14 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-258422r958896_rule

STIG-ID|GOOG-14-008400

Vuln-ID|V-258422

GOOG-14-008500 - Google Android 14 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-258423r958524_rule

STIG-ID|GOOG-14-008500

Vuln-ID|V-258423

GOOG-14-008600 - Google Android 14 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-258424r958524_rule

STIG-ID|GOOG-14-008600

Vuln-ID|V-258424

GOOG-14-008900 - Google Android 14 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].

CCI|CCI-002233

CCI|CCI-002530

Rule-ID|SV-258425r958878_rule

STIG-ID|GOOG-14-008900

Vuln-ID|V-258425

GOOG-14-009000 - Google Android 14 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-258426r959010_rule

STIG-ID|GOOG-14-009000

Vuln-ID|V-258426

GOOG-14-009400 - Google Android 14 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile) - SPP.

CCI|CCI-001761

Rule-ID|SV-258427r958478_rule

STIG-ID|GOOG-14-009400

Vuln-ID|V-258427

GOOG-14-009500 - Google Android 14 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-258428r1042515_rule

STIG-ID|GOOG-14-009500

Vuln-ID|V-258428

GOOG-14-009800 - Google Android 14 users must complete required training.

Rule-ID|SV-258429r1042517_rule

STIG-ID|GOOG-14-009800

Vuln-ID|V-258429

GOOG-14-009900 - Google Android 14 must be configured to enforce that Wi-Fi Sharing is disabled.

Rule-ID|SV-258430r959010_rule

STIG-ID|GOOG-14-009900

Vuln-ID|V-258430

GOOG-14-010000 - Google Android 14 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-258431r959010_rule

STIG-ID|GOOG-14-010000

Vuln-ID|V-258431

GOOG-14-010100 - The Google Android 14 work profile must be configured to prevent users from adding personal email accounts to the work email app.

Rule-ID|SV-258432r959010_rule

STIG-ID|GOOG-14-010100

Vuln-ID|V-258432

GOOG-14-010200 - The Google Android 14 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-258433r959010_rule

STIG-ID|GOOG-14-010200

Vuln-ID|V-258433

GOOG-14-010300 - Google Android 14 must be provisioned as a fully managed device and configured to create a work profile.

Rule-ID|SV-258434r959010_rule

STIG-ID|GOOG-14-010300

Vuln-ID|V-258434

GOOG-14-010400 - The Google Android 14 work profile must be configured to disable automatic completion of workspace internet browser text input.

Rule-ID|SV-258435r959010_rule

STIG-ID|GOOG-14-010400

Vuln-ID|V-258435

GOOG-14-010500 - The Google Android 14 work profile must be configured to disable the autofill services.

Rule-ID|SV-258436r959010_rule

STIG-ID|GOOG-14-010500

Vuln-ID|V-258436

GOOG-14-010600 - Google Android 14 must be configured to disallow configuration of date and time.

Rule-ID|SV-258437r959010_rule

STIG-ID|GOOG-14-010600

Vuln-ID|V-258437

GOOG-14-010800 - Android 14 devices must have the latest available Google Android 14 operating system installed.

CAT|I

Rule-ID|SV-258438r959010_rule

STIG-ID|GOOG-14-010800

Vuln-ID|V-258438

GOOG-14-010900 - Android 14 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-258439r959010_rule

STIG-ID|GOOG-14-010900

Vuln-ID|V-258439

GOOG-14-011000 - Android 14 devices must be configured to enable Common Criteria Mode (CC Mode) - CC Mode.

Rule-ID|SV-258440r959010_rule

STIG-ID|GOOG-14-011000

Vuln-ID|V-258440

GOOG-14-012200 - Google Android 14 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-258441r959010_rule

STIG-ID|GOOG-14-012200

Vuln-ID|V-258441

GOOG-14-012300 - The Google Android 14 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates - EMM to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-258442r959010_rule

STIG-ID|GOOG-14-012300

Vuln-ID|V-258442

GOOG-14-012400 - Google Android 14 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub - MDM to perform the following management function: Disable Phone Hub.

Detections

Analytics

MobileIron - DISA Google Android 14 COPE STIG v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.