GOOG-15-002800 - Google Android 15 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-267430r1031475_rule

STIG-ID|GOOG-15-002800

Vuln-ID|V-267430

GOOG-15-006000 - Google Android 15 must be configured to enforce a minimum password length of six characters.

CCI|CCI-004066

Rule-ID|SV-267431r1031478_rule

STIG-ID|GOOG-15-006000

Vuln-ID|V-267431

GOOG-15-006100 - Google Android 15 must be configured to not allow passwords that include more than four repeating or sequential characters - Alphanumeric

Rule-ID|SV-267432r1031481_rule

STIG-ID|GOOG-15-006100

Vuln-ID|V-267432

GOOG-15-006100 - Google Android 15 must be configured to not allow passwords that include more than four repeating or sequential characters - Complex Characters

GOOG-15-006300 - Google Android 15 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

CCI|CCI-000057

Rule-ID|SV-267433r1031484_rule

STIG-ID|GOOG-15-006300

Vuln-ID|V-267433

GOOG-15-006400 - Google Android 15 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-267434r1033027_rule

STIG-ID|GOOG-15-006400

Vuln-ID|V-267434

GOOG-15-006500 - Google Android 15 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

CCI|CCI-000366

Rule-ID|SV-267435r1031490_rule

STIG-ID|GOOG-15-006500

Vuln-ID|V-267435

GOOG-15-006600 - Google Android 15 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-267436r1033112_rule

STIG-ID|GOOG-15-006600

Vuln-ID|V-267436

GOOG-15-006700 - Google Android 15 allow list must be configured to not include applications with the following characteristics:

CCI|CCI-000803

Rule-ID|SV-267437r1033032_rule

STIG-ID|GOOG-15-006700

Vuln-ID|V-267437

GOOG-15-006750 - Google Android 15 allow list must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.

Rule-ID|SV-267533r1033066_rule

STIG-ID|GOOG-15-006750

Vuln-ID|V-267533

GOOG-15-006800 - Google Android 15 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-267439r1031502_rule

STIG-ID|GOOG-15-006800

Vuln-ID|V-267439

GOOG-15-007200 - Google Android 15 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000767

Rule-ID|SV-267440r1031505_rule

STIG-ID|GOOG-15-007200

Vuln-ID|V-267440

GOOG-15-007400 - Google Android 15 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-267441r1033036_rule

STIG-ID|GOOG-15-007400

Vuln-ID|V-267441

GOOG-15-007700 - Google Android 15 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-267442r1031511_rule

STIG-ID|GOOG-15-007700

Vuln-ID|V-267442

GOOG-15-007800 - Google Android 15 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-267443r1031514_rule

STIG-ID|GOOG-15-007800

Vuln-ID|V-267443

GOOG-15-008400 - Google Android 15 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-267444r1031517_rule

STIG-ID|GOOG-15-008400

Vuln-ID|V-267444

GOOG-15-008500 - Google Android 15 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-267445r1031520_rule

STIG-ID|GOOG-15-008500

Vuln-ID|V-267445

GOOG-15-008600 - Google Android 15 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-267446r1031523_rule

STIG-ID|GOOG-15-008600

Vuln-ID|V-267446

GOOG-15-008700 - Google Android 15 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.

CCI|CCI-001443

CCI|CCI-002314

Rule-ID|SV-267542r1031811_rule

STIG-ID|GOOG-15-008700

Vuln-ID|V-267542

GOOG-15-009000 - Google Android 15 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-267448r1033039_rule

STIG-ID|GOOG-15-009000

Vuln-ID|V-267448

GOOG-15-009400 - Google Android 15 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile) - SPP.

CCI|CCI-001761

Rule-ID|SV-267449r1031532_rule

STIG-ID|GOOG-15-009400

Vuln-ID|V-267449

GOOG-15-009500 - Google Android 15 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-267450r1031535_rule

STIG-ID|GOOG-15-009500

Vuln-ID|V-267450

GOOG-15-009800 - Google Android 15 users must complete required training.

Rule-ID|SV-267451r1033041_rule

STIG-ID|GOOG-15-009800

Vuln-ID|V-267451

GOOG-15-009900 - Google Android 15 must be configured to disable Wi-Fi Sharing.

Rule-ID|SV-267452r1031541_rule

STIG-ID|GOOG-15-009900

Vuln-ID|V-267452

GOOG-15-009950 - Google Android 15 must be configured to enforce a password for Wi-Fi and Bluetooth hotspot, if approved for use by the authorizing official (AO). If not approved for use, Wi-Fi and Bluetooth hotspot must be disabled.

Rule-ID|SV-267549r1031832_rule

STIG-ID|GOOG-15-009950

Vuln-ID|V-267549

GOOG-15-010000 - Google Android 15 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-267454r1031547_rule

STIG-ID|GOOG-15-010000

Vuln-ID|V-267454

GOOG-15-010200 - The Google Android 15 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-267455r1033044_rule

STIG-ID|GOOG-15-010200

Vuln-ID|V-267455

GOOG-15-010400 - The Google Android 15 work profile must be configured to disable automatic completion of workspace internet browser text input.

Rule-ID|SV-267554r1031847_rule

STIG-ID|GOOG-15-010400

Vuln-ID|V-267554

GOOG-15-010500 - The Google Android 15 work profile must be configured to disable the autofill services.

Rule-ID|SV-267555r1031850_rule

STIG-ID|GOOG-15-010500

Vuln-ID|V-267555

GOOG-15-010600 - Google Android 15 must be configured to disallow configuration of date and time.

Rule-ID|SV-267458r1031559_rule

STIG-ID|GOOG-15-010600

Vuln-ID|V-267458

GOOG-15-010800 - Android 15 devices must have the latest available Google Android 15 operating system installed.

CAT|I

Rule-ID|SV-267459r1031562_rule

STIG-ID|GOOG-15-010800

Vuln-ID|V-267459

GOOG-15-010900 - Android 15 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-267460r1033046_rule

STIG-ID|GOOG-15-010900

Vuln-ID|V-267460

GOOG-15-011000 - Android 15 devices must be configured to enable Common Criteria Mode (CC Mode) - CC Mode.

Rule-ID|SV-267461r1031568_rule

STIG-ID|GOOG-15-011000

Vuln-ID|V-267461

GOOG-15-012200 - Google Android 15 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-267462r1033049_rule

STIG-ID|GOOG-15-012200

Vuln-ID|V-267462

GOOG-15-012300 - The Google Android 15 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates - EMM to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-267463r1033052_rule

STIG-ID|GOOG-15-012300

Vuln-ID|V-267463

GOOG-15-012400 - Google Android 15 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub - MDM to perform the following management function: Disable Phone Hub.

Rule-ID|SV-267464r1033054_rule

STIG-ID|GOOG-15-012400

Vuln-ID|V-267464

GOOG-15-012500 - Google Android 15 must be configured to disable 'Private Space' use.

Detections

Analytics

MobileIron - DISA Google Android 15 COBO STIG v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

MobileIron - DISA Google Android 15 COBO STIG v1r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

MobileIron - DISA Google Android 15 COBO STIG v1r2