| 1.1 Ensure device firmware is up to date | MobileIron - CIS Google Android v1.6.0 L1 | MDM | SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Ensure 'Power button instantly locks' is set to 'Enabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | IDENTIFICATION AND AUTHENTICATION |
| 1.6 Ensure 'Lock Screen Message' is configured | MobileIron - CIS Google Android v1.6.0 L1 | MDM | ACCESS CONTROL |
| 1.7 Do not connect to untrusted Wi-Fi networks | MobileIron - CIS Google Android v1.6.0 L2 | MDM | ACCESS CONTROL |
| 1.11 Do not root a user device | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 1.14 Ensure 'Use network-provided time' and 'Use network-provided time zone' are set to 'Enabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | AUDIT AND ACCOUNTABILITY |
| 1.23 Ensure 'Add users from lock screen' is set to 'Disabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 1.25 Review app permissions periodically | MobileIron - CIS Google Android v1.6.0 L1 | MDM | ACCESS CONTROL |
| 2.3 Ensure 'Web and App Activity' is set to 'Disabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.5 Ensure 'Voice & Audio Activity' is set to 'Disabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.9 Ensure 'Opt out of Ads Personalization' is set to 'Enabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | ACCESS CONTROL |
| 2.10 Ensure 'Wi-Fi scanning' Is 'Disabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.2 Ensure 'Location' is set to 'Enabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | ACCESS CONTROL |
| 3.3 Ensure 'Allow third-party cookies' is set to 'Disabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.4 Ensure 'Safe Browsing' is set to 'Enabled' | MobileIron - CIS Google Android v1.6.0 L1 | MDM | SYSTEM AND INFORMATION INTEGRITY |
| 3.5 Ensure 'Search and URL suggestions' is set to 'Disabled' | MobileIron - CIS Google Android v1.6.0 L2 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-09-001100 - The Google Android Pie whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers. | MobileIron - DISA Google Android 9.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-09-001400 - The Google Android Pie must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only HSP (Headset Profile), HFP (HandsFree Profile), or SPP (Serial Port Profile) capable devices. | MobileIron - DISA Google Android 9.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-09-004500 - The Google Android Pie must be configured to disable exceptions to the access control policy that prevents application processes from accessing all data stored by other application processes - Sharing data into the profile | MobileIron - DISA Google Android 9.x v2r1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GOOG-09-008800 - Google Android Pie must be configured to enforce that Wi-Fi Sharing is disabled. | MobileIron - DISA Google Android 9.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-09-009000 - Google Android Pie must have the DoD root and intermediate PKI certificates installed. | MobileIron - DISA Google Android 9.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-09-009200 - The Google Android Pie Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | MobileIron - DISA Google Android 9.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-10-001100 - Google Android 10 whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers. | MobileIron - DISA Google Android 10.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-10-001400 - Google Android 10 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), HandsFree Profile (HFP), and Serial Port Profile (SPP) - Serial Port Profile capable devices. | MobileIron - DISA Google Android 10.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-10-003400 - Google Android 10 must be configured to display the DoD advisory warning message at start-up or each time the user unlocks the device. | MobileIron - DISA Google Android 10.x v2r1 | MDM | ACCESS CONTROL |
| GOOG-10-004500 - Google Android 10 must be configured to disable exceptions to the access control policy that prevents application processes from accessing all data stored by other application processes - Sharing data into the profile | MobileIron - DISA Google Android 10.x v2r1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GOOG-10-009200 - The Google Android 10 Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | MobileIron - DISA Google Android 10.x v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-11-000400 - Google Android 11 must be configured to lock the display after 15 minutes (or less) of inactivity. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | ACCESS CONTROL |
| GOOG-11-004500 - Google Android 11 must be configured to disable exceptions to the access control policy that prevents application processes from accessing all data stored by other application processes - Copy/Paste | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GOOG-11-008700 - Google Android 11 users must complete required training. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-11-008800 - Google Android 11 must be configured to enforce that Wi-Fi Sharing is disabled. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-13-701100 - Google Android 13 must prohibit DOD VPN profiles in the Personal Profile. | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-13-706400 - Google Android 13 must be configured to not allow more than 10 consecutive failed authentication attempts. | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | ACCESS CONTROL |
| GOOG-13-706700 - Google Android 13 allowlist must be configured to not include applications with the following characteristics (work profile only): | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-13-708900 - Google Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes]. | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-13-710000 - Google Android 13 must have the DOD root and intermediate PKI certificates installed (work profile only). | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-13-710100 - The Google Android 13 work profile must be configured to prevent users from adding personal email accounts to the work email app. | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-13-710400 - The Google Android 13 work profile must be configured to disable automatic completion of workspace internet browser text input. | MobileIron - DISA Google Android 13 BYOAD v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-17-008100 - Google Android 17 must be configured to disable ad hoc wireless client-to-client connection capability. | AirWatch - DISA Google Android 17 COPE STIG v1r1 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-17-008900 - Google Android 17 must be provisioned as a fully managed device and configured to create a work profile. | MobileIron - DISA Google Android 17 COPE STIG v1r1 | MDM | CONFIGURATION MANAGEMENT |
| MOTO-09-010000 - Motorola Android Pie Work Profile must be configured to disable the autofill services. | MobileIron - DISA Motorola Android Pie.x COPE v1r2 | MDM | CONFIGURATION MANAGEMENT |
| MOTS-11-999999 - All Motorola Solutions Android 11 installations must be removed. | AirWatch - DISA Motorola Solutions Android 11 COBO v1r3 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-010000 - Microsoft Android 11 Work Profile must be configured to disable the autofill services. | MobileIron - DISA Microsoft Android 11 COPE v1r2 | MDM | CONFIGURATION MANAGEMENT |
| ZEBR-10-010000 - Zebra Android 10 Work Profile must be configured to disable the autofill services. | MobileIron - DISA Zebra Android 10 COPE v1r2 | MDM | CONFIGURATION MANAGEMENT |
| ZEBR-13-006800 - Zebra Android 13 must be configured to not display the following (work profile) notifications when the device is locked: [selection: | MobileIron - DISA Zebra Android 13 COPE STIG v1r2 | MDM | ACCESS CONTROL |
| ZEBR-13-007400 - Zebra Android 13 must be configured to disable developer modes. | MobileIron - DISA Zebra Android 13 COPE STIG v1r2 | MDM | CONFIGURATION MANAGEMENT |
| ZEBR-13-008400 - Zebra Android 13 must be configured to disable USB mass storage mode. | MobileIron - DISA Zebra Android 13 COPE STIG v1r2 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| ZEBR-14-006300 - Zebra Android 14 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity. | MobileIron - DISA Zebra Android 14 COPE STIG v1r2 | MDM | ACCESS CONTROL |
| ZEBR-14-007400 - Zebra Android 14 must be configured to disable developer modes. | MobileIron - DISA Zebra Android 14 COPE STIG v1r2 | MDM | CONFIGURATION MANAGEMENT |
| ZEBR-14-013100 - Zebra Android 14 must disable the use of assistants (including Zebra Assistant) unless required to meet Section 508 compliance requirements. | AirWatch - DISA Zebra Android 14 COPE STIG v1r2 | MDM | CONFIGURATION MANAGEMENT |
