← Back to Google Android 17 COPE Security Technical Implementation Guide

V-284833

CAT II (Medium)

Google Android 17 must be provisioned as a fully managed device and configured to create a work profile.

Rule ID

SV-284833r1240433_rule

STIG

Google Android 17 COPE Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

The Android Enterprise work profile is the designated application group for the COPE use case. SFR ID: FMT_SMF.1.1 #47

Check Content

Verify that managed Google Android 17 is configured as Corporate-Owned Work-Managed.
 
This procedure is performed on both the EMM administration console and the managed Google Android 17 device. 
 
On the EMM console, configure the default enrollment as Corporate-Owned and select "Use for Work & Personal".
 
On the managed Google Android 17 device: 

1. Go to the application drawer.
2. Ensure a "Personal" tab and a "Work" tab are present.

If on the EMM console account the default enrollment is set to Corporate-Owned Work-Managed, or on the managed Android 17 device the user does not have a "Work" tab, this is a finding.

Fix Text

Configure the Google Android 17 device as corporate-owned with a work profile.

On the EMM console, configure the default enrollment as Corporate-Owned, and select "Use for Work & Personal".

Refer to the EMM documentation to determine how to configure the device.