MSFT-11-000100 - Microsoft Android 11 must be configured to enforce a minimum password length of six characters.

800-53|IA-5(1)(a)

CAT|II

CCI|CCI-000205

Rule-ID|SV-255201r870814_rule

STIG-ID|MSFT-11-000100

Vuln-ID|V-255201

MSFT-11-000200 - Microsoft Android 11 must be configured to not allow passwords that include more than two repeating or sequential characters - Characters

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-255202r870815_rule

STIG-ID|MSFT-11-000200

Vuln-ID|V-255202

MSFT-11-000200 - Microsoft Android 11 must be configured to not allow passwords that include more than two repeating or sequential characters - Numbers

MSFT-11-000300 - Microsoft Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.

800-53|AC-11a.

CCI|CCI-000057

Rule-ID|SV-255203r877009_rule

STIG-ID|MSFT-11-000300

Vuln-ID|V-255203

MSFT-11-000400 - Microsoft Android 11 must be configured to lock the display after 15 minutes (or less) of inactivity - or less of inactivity.

Rule-ID|SV-255204r870817_rule

STIG-ID|MSFT-11-000400

Vuln-ID|V-255204

MSFT-11-000500 - Microsoft Android 11 must be configured to not allow more than 10 consecutive failed authentication attempts.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-255205r870818_rule

STIG-ID|MSFT-11-000500

Vuln-ID|V-255205

MSFT-11-000800 - Microsoft Android 11 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, EMM server, mobile application store] - Unknown Sources

Rule-ID|SV-255206r870819_rule

STIG-ID|MSFT-11-000800

Vuln-ID|V-255206

MSFT-11-001000 - Microsoft Android 11 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].

800-53|CM-7(2)

CCI|CCI-001764

Rule-ID|SV-255207r870820_rule

STIG-ID|MSFT-11-001000

Vuln-ID|V-255207

MSFT-11-001100 - Microsoft Android 11 allow list must be configured to not include applications with the following characteristics: - Back up MD data to non-DOD cloud servers (including user and application access to cloud backup services);- Transmit MD diagnostic data to non-DOD servers;- Voice assistant application if available when MD is locked;- Voice dialing application if available when MD is locked;- Allows synchronization of data or applications between devices associated with user; and- Allows unencrypted (or encrypted but not FIPS 140-2/FIPS 140-3 validated) data sharing with other MDs or printers.

Rule-ID|SV-255208r870821_rule

STIG-ID|MSFT-11-001100

Vuln-ID|V-255208

MSFT-11-001400 - Microsoft Android 11 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), HandsFree Profile (HFP), and Serial Port Profile (SPP) - Serial Port Profile capable devices.

800-53|CM-7(1)(b)

CAT|III

CCI|CCI-001761

Rule-ID|SV-255209r870822_rule

STIG-ID|MSFT-11-001400

Vuln-ID|V-255209

MSFT-11-001600 - Microsoft Android 11 must be configured to not display the following (work profile) notifications when the device is locked: [selection:- Email notifications - Calendar appointments - Contact associated with phone call notification - Text message notification- Other application-based notifications- All notifications] - work profile notifications when the device is locked:

800-53|AC-11(1)

CCI|CCI-000060

Rule-ID|SV-255210r870823_rule

STIG-ID|MSFT-11-001600

Vuln-ID|V-255210

MSFT-11-002000 - Microsoft Android 11 must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.

800-53|AC-6(10)

800-53|SC-28

CAT|I

CCI|CCI-001199

CCI|CCI-002235

Rule-ID|SV-255211r870824_rule

STIG-ID|MSFT-11-002000

Vuln-ID|V-255211

MSFT-11-002300 - Microsoft Android 11 must be configured to disable trust agents.  Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation - NA for specific biometric authentication factors included in the products Common Criteria evaluation.

800-53|CM-6(1)

800-53|CM-7a.

CCI|CCI-000370

CCI|CCI-000381

Rule-ID|SV-255212r870825_rule

STIG-ID|MSFT-11-002300

Vuln-ID|V-255212

MSFT-11-002800 - Microsoft Android 11 must be configured to disable developer modes.

Rule-ID|SV-255213r870826_rule

STIG-ID|MSFT-11-002800

Vuln-ID|V-255213

MSFT-11-003400 - Microsoft Android 11 must be configured to display the DOD advisory warning message at start-up or each time the user unlocks the device.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-255214r870827_rule

STIG-ID|MSFT-11-003400

Vuln-ID|V-255214

MSFT-11-003500 - Microsoft Android 11 must be configured to disable USB mass storage mode.

800-53|SC-41

CCI|CCI-002546

Rule-ID|SV-255215r870828_rule

STIG-ID|MSFT-11-003500

Vuln-ID|V-255215

MSFT-11-003700 - Microsoft Android 11 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-255216r870829_rule

STIG-ID|MSFT-11-003700

Vuln-ID|V-255216

MSFT-11-003900 - Microsoft Android 11 must be configured to not allow backup of all applications and configuration data to remote systems.

Rule-ID|SV-255217r870830_rule

STIG-ID|MSFT-11-003900

Vuln-ID|V-255217

MSFT-11-004500 - Microsoft Android 11 must be configured to disable exceptions to the access control policy that prevent application processes from accessing all data stored by other application processes.

800-53|AC-6(8)

800-53|SC-39

CCI|CCI-002233

CCI|CCI-002530

Rule-ID|SV-255218r870756_rule

STIG-ID|MSFT-11-004500

Vuln-ID|V-255218

MSFT-11-004700 - Microsoft Android 11 must be configured to disable multi-user modes.

800-53|AC-2a.

CCI|CCI-002110

Rule-ID|SV-255219r870831_rule

STIG-ID|MSFT-11-004700

Vuln-ID|V-255219

MSFT-11-005200 - The mobile operating system must allow only the Administrator (MDM) to perform the following management function: Enable/disable location services.

Rule-ID|SV-255220r870832_rule

STIG-ID|MSFT-11-005200

Vuln-ID|V-255220

MSFT-11-005400 - Microsoft Android 11 must allow the Administrator (EMM) to perform the following management function: Wipe Enterprise data.

800-53|AC-7(2)

CCI|CCI-002242

Rule-ID|SV-255221r870833_rule

STIG-ID|MSFT-11-005400

Vuln-ID|V-255221

MSFT-11-005505 - Microsoft Android 11 must be configured to enable audit logging.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-255222r870834_rule

STIG-ID|MSFT-11-005505

Vuln-ID|V-255222

MSFT-11-006100 - Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations.

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-255223r870835_rule

STIG-ID|MSFT-11-006100

Vuln-ID|V-255223

MSFT-11-008700 - Microsoft Android 11 users must complete required training.

Rule-ID|SV-255224r870836_rule

STIG-ID|MSFT-11-008700

Vuln-ID|V-255224

MSFT-11-008800 - Microsoft Android 11 must be configured to enforce that Wi-Fi Sharing is disabled.

Rule-ID|SV-255225r870837_rule

STIG-ID|MSFT-11-008800

Vuln-ID|V-255225

MSFT-11-009000 - Microsoft Android 11 must have the DOD root and intermediate PKI certificates installed.

Rule-ID|SV-255226r870838_rule

STIG-ID|MSFT-11-009000

Vuln-ID|V-255226

MSFT-11-009100 - Microsoft Android 11 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates - MDM to install/remove DoD root and intermediate PKI certificates.

Rule-ID|SV-255227r870839_rule

STIG-ID|MSFT-11-009100

Vuln-ID|V-255227

MSFT-11-009200 - The Microsoft Android 11 Work Profile must be configured to prevent users from adding personal email accounts to the work email app.

Rule-ID|SV-255228r870840_rule

STIG-ID|MSFT-11-009200

Vuln-ID|V-255228

MSFT-11-009400 - Microsoft Android 11 Work Profile must be configured to enforce the system application disable list.

Rule-ID|SV-255229r870841_rule

STIG-ID|MSFT-11-009400

Vuln-ID|V-255229

MSFT-11-009600 - Microsoft Android 11 must be provisioned as a fully managed device and configured to create a work profile.

Rule-ID|SV-255230r870779_rule

STIG-ID|MSFT-11-009600

Vuln-ID|V-255230

MSFT-11-009800 - Microsoft Android 11 Work Profile must be configured to disable automatic completion of work space internet browser text input.

Rule-ID|SV-255231r870812_rule

STIG-ID|MSFT-11-009800

Vuln-ID|V-255231

MSFT-11-010000 - Microsoft Android 11 Work Profile must be configured to disable the autofill services.

Rule-ID|SV-255232r870842_rule

STIG-ID|MSFT-11-010000

Vuln-ID|V-255232

MSFT-11-010200 - Microsoft Android 11 must be configured to disallow configuration of date and time.

Rule-ID|SV-255233r870843_rule

STIG-ID|MSFT-11-010200

Vuln-ID|V-255233

MSFT-11-010800 - Microsoft Android 11 devices must have the latest available Microsoft Android 11 operating system installed.

Rule-ID|SV-255234r870844_rule

STIG-ID|MSFT-11-010800

Vuln-ID|V-255234

MSFT-11-011000 - Microsoft Android 11 devices must be configured to disable the use of third-party keyboards.

Rule-ID|SV-255235r870845_rule

STIG-ID|MSFT-11-011000

Vuln-ID|V-255235

MSFT-11-011100 - Microsoft Android 11 devices must be configured to enable Common Criteria Mode (CC Mode).

Rule-ID|SV-255236r870846_rule

STIG-ID|MSFT-11-011100

Vuln-ID|V-255236

Detections

Analytics

AirWatch - DISA Microsoft Android 11 COPE v1r1

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous