What changed in Google Android 9.x STIG V2R1V2R1 changes

Google Android 9.x STIG V2R1 (2022-10-27) replaced V1R1 (2019-08-23): 34 checks added, 33 removed. It has 34 checks, against 33 in V1R1.

V2R1 checklistV1R1 checklist Compare V1R1 and V2R1 in STIG Compare

  • 34 added
  • 33 removed
  • 0 updated

Added in V2R1 (34)

  • V-228278CAT IIThe Google Android Pie must be configured to enforce a minimum password length of six characters.
  • V-228279CAT IIThe Google Android Pie must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-228280CAT IIThe Google Android Pie must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-228281CAT IIThe Google Android Pie must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-228282CAT IIIThe Google Android Pie must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-228283CAT IIThe Google Android Pie must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoD-approved commercial app repository, MDM server, mobile application store].
  • V-228284CAT IIThe Google Android Pie must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].
  • V-228285CAT IIThe Google Android Pie whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-228286CAT IIIThe Google Android Pie must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only HSP (Headset Profile), HFP (HandsFree Profile), or SPP (Serial Port Profile) capable devices.
  • V-228287CAT IIThe Google Android Pie must be configured to not display the following (work profile) notifications when the device is locked: [selection: - email notifications - calendar appointments - contact associated with phone call notification - text message notification - other application-based notifications - all notifications].
  • V-228288CAT IIGoogle Android Pie must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-228289CAT IIThe Google Android Pie must be configured to disable developer modes.
  • V-228290CAT IIIThe Google Android Pie must be configured to display the DoD advisory warning message at start-up or each time the user unlocks the device.
  • V-228291CAT IIThe Google Android Pie must be configured to disable USB mass storage mode.
  • V-228292CAT IIThe Google Android Pie must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-228293CAT IIThe Google Android Pie must be configured to not allow backup of all applications and configuration data to remote systems.
  • V-228294CAT IIThe Google Android Pie must be configured to disable exceptions to the access control policy that prevents application processes from accessing all data stored by other application processes.
  • V-228295CAT IIThe Google Android Pie must be configured to disable multi-user modes.
  • V-228296CAT IIThe Google Android Pie must be configured to enable audit logging.
  • V-228297CAT IIIThe Google Android Pie must be configured to generate audit records for the following auditable events: detected integrity violations.
  • V-228298CAT IIGoogle Android Pie users must complete required training.
  • V-228299CAT IIGoogle Android Pie must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-228300CAT IIGoogle Android Pie must have the DoD root and intermediate PKI certificates installed.
  • V-228301CAT IIGoogle Android Pie must allow only the administrator (MDM) to install/remove DoD root and intermediate PKI certificates.
  • V-228302CAT IIThe Google Android Pie Work Profile must be configured to prevent users from adding personal email accounts to the work email app.
  • V-228303CAT IIGoogle Android Pie work profile must be configured to enforce the system application disable list.
  • V-228304CAT IIGoogle Android Pie must be provisioned as a fully managed device and configured to create a work profile.
  • V-228305CAT IIGoogle Android Pie work profile must be configured to disable automatic completion of work space Internet browser text input.
  • V-228306CAT IIGoogle Android Pie Work Profile must be configured to disable the autofill services.
  • V-228307CAT IIGoogle Android Pie must be configured to disallow configuration of date and time.
  • V-228308CAT IIGoogle Android Pie must configured to disallow outgoing beam.
  • V-228309CAT IGoogle Android Pie devices must have the latest available Google Android Pie operating system installed.
  • V-228310CAT IGoogle Android Pie devices must have a NIAP validated Google Android Pie operating system installed.
  • V-254524CAT IAll Google Android 9 installations must be removed.

Removed since V1R1 (33)

  • V-97305CAT IIThe Google Android Pie must be configured to enforce a minimum password length of six characters.
  • V-97307CAT IIThe Google Android Pie must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-97309CAT IIThe Google Android Pie must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-97311CAT IIThe Google Android Pie must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-97313CAT IIIThe Google Android Pie must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-97315CAT IIThe Google Android Pie must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoD-approved commercial app repository, MDM server, mobile application store].
  • V-97317CAT IIThe Google Android Pie must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].
  • V-97319CAT IIThe Google Android Pie whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-97321CAT IIIThe Google Android Pie must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only HSP (Headset Profile), HFP (HandsFree Profile), or SPP (Serial Port Profile) capable devices.
  • V-97323CAT IIThe Google Android Pie must be configured to not display the following (work profile) notifications when the device is locked: [selection: - email notifications - calendar appointments - contact associated with phone call notification - text message notification - other application-based notifications - all notifications].
  • V-97325CAT IIGoogle Android Pie must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-97327CAT IIThe Google Android Pie must be configured to disable developer modes.
  • V-97329CAT IIIThe Google Android Pie must be configured to display the DoD advisory warning message at start-up or each time the user unlocks the device.
  • V-97331CAT IIThe Google Android Pie must be configured to disable USB mass storage mode.
  • V-97333CAT IIThe Google Android Pie must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-97335CAT IIThe Google Android Pie must be configured to not allow backup of all applications and configuration data to remote systems.
  • V-97337CAT IIThe Google Android Pie must be configured to disable exceptions to the access control policy that prevents application processes from accessing all data stored by other application processes.
  • V-97339CAT IIThe Google Android Pie must be configured to disable multi-user modes.
  • V-97341CAT IIThe Google Android Pie must be configured to enable audit logging.
  • V-97343CAT IIIThe Google Android Pie must be configured to generate audit records for the following auditable events: detected integrity violations.
  • V-97345CAT IIGoogle Android Pie users must complete required training.
  • V-97347CAT IIGoogle Android Pie must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-97349CAT IIGoogle Android Pie must have the DoD root and intermediate PKI certificates installed.
  • V-97351CAT IIGoogle Android Pie must allow only the administrator (MDM) to install/remove DoD root and intermediate PKI certificates.
  • V-97353CAT IIThe Google Android Pie Work Profile must be configured to prevent users from adding personal email accounts to the work email app.
  • V-97355CAT IIGoogle Android Pie work profile must be configured to enforce the system application disable list.
  • V-97357CAT IIGoogle Android Pie must be provisioned as a fully managed device and configured to create a work profile.
  • V-97359CAT IIGoogle Android Pie work profile must be configured to disable automatic completion of work space Internet browser text input.
  • V-97361CAT IIGoogle Android Pie Work Profile must be configured to disable the autofill services.
  • V-97363CAT IIGoogle Android Pie must be configured to disallow configuration of date and time.
  • V-97365CAT IIGoogle Android Pie must configured to disallow outgoing beam.
  • V-97367CAT IGoogle Android Pie devices must have the latest available Google Android Pie operating system installed.
  • V-97369CAT IGoogle Android Pie devices must have a NIAP validated Google Android Pie operating system installed.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.