GOOG-15-002800 - Google Android 15 must be configured to enable audit logging.

CAT|II

CCI|CCI-000154

Rule-ID|SV-267525r1031760_rule

STIG-ID|GOOG-15-002800

Vuln-ID|V-267525

GOOG-15-006000 - Google Android 15 must be configured to enforce a minimum password length of six characters.

CCI|CCI-004066

Rule-ID|SV-267526r1031763_rule

STIG-ID|GOOG-15-006000

Vuln-ID|V-267526

GOOG-15-006100 - Google Android 15 must be configured to not allow passwords that include more than four repeating or sequential characters - Alphanumeric

Rule-ID|SV-267527r1031766_rule

STIG-ID|GOOG-15-006100

Vuln-ID|V-267527

GOOG-15-006100 - Google Android 15 must be configured to not allow passwords that include more than four repeating or sequential characters - Complex Characters

GOOG-15-006300 - Google Android 15 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

CCI|CCI-000057

Rule-ID|SV-267528r1031769_rule

STIG-ID|GOOG-15-006300

Vuln-ID|V-267528

GOOG-15-006400 - Google Android 15 must be configured to not allow more than 10 consecutive failed authentication attempts.

CCI|CCI-000044

Rule-ID|SV-267529r1033058_rule

STIG-ID|GOOG-15-006400

Vuln-ID|V-267529

GOOG-15-006500 - Google Android 15 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].

CCI|CCI-000366

Rule-ID|SV-267530r1031775_rule

STIG-ID|GOOG-15-006500

Vuln-ID|V-267530

GOOG-15-006600 - Google Android 15 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

CCI|CCI-001764

Rule-ID|SV-267531r1033118_rule

STIG-ID|GOOG-15-006600

Vuln-ID|V-267531

GOOG-15-006700 - Google Android 15 allow list must be configured to not include applications with the following characteristics:

CCI|CCI-000803

Rule-ID|SV-267532r1033064_rule

STIG-ID|GOOG-15-006700

Vuln-ID|V-267532

GOOG-15-006750 - Google Android 15 allow list must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.

Rule-ID|SV-267533r1033066_rule

STIG-ID|GOOG-15-006750

Vuln-ID|V-267533

GOOG-15-006800 - Google Android 15 must be configured to not display the following (work profile) notifications when the device is locked:

CCI|CCI-000060

Rule-ID|SV-267534r1031787_rule

STIG-ID|GOOG-15-006800

Vuln-ID|V-267534

GOOG-15-007200 - Google Android 15 must be configured to disable trust agents - NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.

CCI|CCI-000767

Rule-ID|SV-267535r1031790_rule

STIG-ID|GOOG-15-007200

Vuln-ID|V-267535

GOOG-15-007400 - Google Android 15 must be configured to disable developer modes.

CCI|CCI-000381

Rule-ID|SV-267536r1033068_rule

STIG-ID|GOOG-15-007400

Vuln-ID|V-267536

GOOG-15-007700 - Google Android 15 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-267537r1031796_rule

STIG-ID|GOOG-15-007700

Vuln-ID|V-267537

GOOG-15-007800 - Google Android 15 must be configured to generate audit records for the following auditable events: Detected integrity violations.

CCI|CCI-000169

Rule-ID|SV-267538r1031799_rule

STIG-ID|GOOG-15-007800

Vuln-ID|V-267538

GOOG-15-008400 - Google Android 15 must be configured to disable USB mass storage mode.

CCI|CCI-002546

Rule-ID|SV-267539r1031802_rule

STIG-ID|GOOG-15-008400

Vuln-ID|V-267539

GOOG-15-008500 - Google Android 15 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

CCI|CCI-001090

Rule-ID|SV-267540r1031805_rule

STIG-ID|GOOG-15-008500

Vuln-ID|V-267540

GOOG-15-008600 - Google Android 15 must be configured to not allow backup of [all applications, configuration data] to remote systems.

Rule-ID|SV-267541r1031808_rule

STIG-ID|GOOG-15-008600

Vuln-ID|V-267541

GOOG-15-008700 - Google Android 15 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.

CCI|CCI-001443

CCI|CCI-002314

Rule-ID|SV-267542r1031811_rule

STIG-ID|GOOG-15-008700

Vuln-ID|V-267542

GOOG-15-008900 - Google Android 15 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].

CCI|CCI-002233

CCI|CCI-002530

Rule-ID|SV-267543r1031814_rule

STIG-ID|GOOG-15-008900

Vuln-ID|V-267543

GOOG-15-009000 - Google Android 15 must be configured to disable multiuser modes.

CCI|CCI-002110

Rule-ID|SV-267544r1033070_rule

STIG-ID|GOOG-15-009000

Vuln-ID|V-267544

GOOG-15-009400 - Google Android 15 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile) - SPP.

CCI|CCI-001761

Rule-ID|SV-267545r1031820_rule

STIG-ID|GOOG-15-009400

Vuln-ID|V-267545

GOOG-15-009500 - Google Android 15 must be configured to disable ad hoc wireless client-to-client connection capability.

CCI|CCI-002536

Rule-ID|SV-267546r1035630_rule

STIG-ID|GOOG-15-009500

Vuln-ID|V-267546

GOOG-15-009800 - Google Android 15 users must complete required training.

Rule-ID|SV-267547r1033072_rule

STIG-ID|GOOG-15-009800

Vuln-ID|V-267547

GOOG-15-009900 - Google Android 15 must be configured to disable Wi-Fi Sharing.

Rule-ID|SV-267548r1031829_rule

STIG-ID|GOOG-15-009900

Vuln-ID|V-267548

GOOG-15-009950 - Google Android 15 must be configured to enforce a password for Wi-Fi and Bluetooth hotspot, if approved for use by the authorizing official (AO). If not approved for use, Wi-Fi and Bluetooth hotspot must be disabled.

Rule-ID|SV-267549r1031832_rule

STIG-ID|GOOG-15-009950

Vuln-ID|V-267549

GOOG-15-010000 - Google Android 15 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-267550r1031835_rule

STIG-ID|GOOG-15-010000

Vuln-ID|V-267550

GOOG-15-010100 - The Google Android 15 work profile must be configured to prevent users from adding personal email accounts to the work email app.

Rule-ID|SV-267551r1033120_rule

STIG-ID|GOOG-15-010100

Vuln-ID|V-267551

GOOG-15-010200 - The Google Android 15 work profile must be configured to enforce the system application disable list.

Rule-ID|SV-267552r1033075_rule

STIG-ID|GOOG-15-010200

Vuln-ID|V-267552

GOOG-15-010300 - Google Android 15 must be provisioned as a fully managed device and configured to create a work profile.

Rule-ID|SV-267553r1031844_rule

STIG-ID|GOOG-15-010300

Vuln-ID|V-267553

GOOG-15-010400 - The Google Android 15 work profile must be configured to disable automatic completion of workspace internet browser text input.

Rule-ID|SV-267554r1031847_rule

STIG-ID|GOOG-15-010400

Vuln-ID|V-267554

GOOG-15-010500 - The Google Android 15 work profile must be configured to disable the autofill services.

Rule-ID|SV-267555r1031850_rule

STIG-ID|GOOG-15-010500

Vuln-ID|V-267555

GOOG-15-010600 - Google Android 15 must be configured to disallow configuration of date and time.

Rule-ID|SV-267556r1031853_rule

STIG-ID|GOOG-15-010600

Vuln-ID|V-267556

GOOG-15-010800 - Android 15 devices must have the latest available Google Android 15 operating system installed.

CAT|I

Rule-ID|SV-267557r1031856_rule

STIG-ID|GOOG-15-010800

Vuln-ID|V-267557

GOOG-15-010900 - Android 15 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-267558r1033077_rule

STIG-ID|GOOG-15-010900

Vuln-ID|V-267558

GOOG-15-011000 - Android 15 devices must be configured to enable Common Criteria (CC) Mode - CC Mode.

Rule-ID|SV-267559r1031862_rule

STIG-ID|GOOG-15-011000

Vuln-ID|V-267559

GOOG-15-012200 - Google Android 15 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)] - for example, USB].

CCI|CCI-002235

Rule-ID|SV-267560r1033080_rule

STIG-ID|GOOG-15-012200

Vuln-ID|V-267560

GOOG-15-012300 - The Google Android 15 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates - EMM to install/remove DOD root and intermediate PKI certificates.

CCI|CCI-000370

Rule-ID|SV-267561r1033083_rule

STIG-ID|GOOG-15-012300

Vuln-ID|V-267561

GOOG-15-012400 - Google Android 15 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub - MDM to perform the following management function: Disable Phone Hub.

Rule-ID|SV-267562r1033086_rule

STIG-ID|GOOG-15-012400

Vuln-ID|V-267562

GOOG-15-012500 - Google Android 15 must be configured to disable 'Private Space' use.

Detections

Analytics

MobileIron - DISA Google Android 15 COPE STIG v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 6, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

MobileIron - DISA Google Android 15 COPE STIG v1r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

MobileIron - DISA Google Android 15 COPE STIG v1r2