Zebra Technologies Android 14 COBO Security Technical Implementation Guide

Version: 1

Updated: 27 Feb 2026

Findings: 38

Findings

V-283484 - Zebra Android 14 must be configured to enable audit logging. (medium)
V-283507 - Zebra Android 14 must be configured to enforce a minimum password length of six characters. (medium)
V-283508 - Zebra Android 14 must be configured to not allow passwords that include more than four repeating or sequential characters. (medium)
V-283509 - Zebra Android 14 must be configured to lock the display after 15 minutes (or less) of inactivity. (medium)
V-283510 - Zebra Android 14 must be configured to not allow more than 10 consecutive failed authentication attempts. (medium)
V-283511 - Zebra Android 14 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store]. (medium)
V-283512 - Zebra Android 14 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version]. (medium)
V-283513 - Zebra Android 14 allowlist must be configured to not include applications with the following characteristics: - Backs up mobile device (MD) data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; - Payment processing; - Allows unencrypted (or encrypted but not FIPS 140-2/140-3 validated) data sharing with other MDs or printers; - Backs up own data to a remote system; - Renders TV shows and movies. (medium)
V-283514 - Zebra Android 14 must be configured to not display the following (work profile) notifications when the device is locked: [selection: a. email notifications b. calendar appointments c. contact associated with phone call notification d. text message notification e. other application-based notifications f. all notifications]. (medium)
V-283518 - Zebra Android 14 must be configured to disable trust agents. (medium)
V-283520 - Zebra Android 14 must be configured to disable developer modes. (medium)
V-283523 - Zebra Android 14 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device. (low)
V-283524 - Zebra Android 14 must be configured to generate audit records for the following auditable events: Detected integrity violations. (medium)
V-283528 - Zebra Android 14 must be configured to disable USB mass storage mode. (medium)
V-283529 - Zebra Android 14 must be configured to not allow backup of [all applications, configuration data] to locally connected systems. (medium)
V-283530 - Zebra Android 14 must be configured to not allow backup of [all applications, configuration data] to remote systems. (medium)
V-283531 - Zebra Android 14 must be configured to enable authentication of personal hotspot connections to the device using a preshared key. (medium)
V-283533 - Zebra Android 14 must be configured to disable multiuser modes. (medium)
V-283537 - Zebra Android 14 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile). (low)
V-283538 - Zebra Android 14 must be configured to disable ad hoc wireless client-to-client connection capability. (medium)
V-283540 - Zebra Android 14 users must complete required training. (medium)
V-283541 - Zebra Android 14 must be configured to enforce that Wi-Fi Sharing is disabled. (medium)
V-283542 - Zebra Android 14 must have the DOD root and intermediate PKI certificates installed. (medium)
V-283543 - The Zebra Android 14 work profile must be configured to enforce the system application disable list. (medium)
V-283544 - Zebra Android 14 must be configured to disallow configuration of date and time. (medium)
V-283546 - Zebra Android 14 devices must have the latest available Zebra Android 14 operating system installed. (high)
V-283547 - Android 14 devices must be configured to disable the use of third-party keyboards. (low)
V-283548 - Android 14 devices must be configured to enable Common Criteria mode (CC mode). (low)
V-283549 - Zebra Android 14 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)]. (medium)
V-283550 - Zebra Android 14 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates. (medium)
V-283551 - Zebra Android 14 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub. (low)
V-283552 - Zebra Android 14 must disable the user's ability to wipe the device. (medium)
V-283553 - Zebra Android 14 must disable the use of assistants (including Zebra Assistant) unless required to meet Section 508 compliance requirements. (low)
V-283554 - Zebra Android 14 must disable wireless printing. (low)
V-283555 - Zebra Android 14 must disable screen capture. (low)
V-283556 - Zebra Android 14 devices must have a Mobile Threat Detection (MTD) app installed. (medium)
V-283557 - Zebra Android 14 must implement the management setting: disable Camera. (medium)
V-283559 - Zebra Android must implement the management setting: disable the Bluetooth radio. (medium)