Zebra Android 13 STIG Checklist

18 items · Security · Medium difficulty · 2 hours

Secure Zebra Android 13 devices with this STIG-based compliance checklist.

• Enroll device in enterprise mobility management (EMM/MDM)

  Use an approved EMM that supports Zebra Android 13 and required security controls.

• Apply latest OS security patches and vendor firmware updates

  Install Android security patches and Zebra firmware; verify build and patch levels.

• Enable verified boot / device attestation

  Activate verified boot or attestation to protect boot integrity where supported.

• Enable full-disk or file-based encryption

  Ensure encryption is hardware-backed and keys are protected by device keystore.

• Enforce strong lock screen and authentication

  Require strong PIN/password or approved biometric; prevent simple patterns.

• Set minimum PIN length to 8 characters

  Configure policy to require at least an 8-character PIN for device unlock.

• Configure device wipe or lock after repeated failed attempts

  Set automatic lock or factory wipe after a defined failed attempt threshold.

• Configure screen lock timeout and auto-lock

  Set short idle timeout (e.g., 1-5 minutes) and require reauthentication on wake.

• Disable USB debugging and developer options

  Turn off ADB and developer features to prevent device tampering.

• Disable unknown sources and block sideloading

  Prevent installation from unknown sources or disable sideloading via policy.

• Restrict app installs to managed app store via EMM

  Allow only approved enterprise apps and revoke installation rights for unmanaged apps.

• Configure enterprise Wi‑Fi with WPA2/WPA3 Enterprise (EAP)

  Use certificate or EAP-based authentication and trusted CAs for Wi‑Fi access.

• Require VPN for remote or untrusted network access

  Enforce device-level VPN for access to sensitive resources off-network.

• Enable SELinux enforcing mode and verify device integrity

  Confirm SELinux is enforcing and run integrity checks or attestation tools.

• Disable or restrict Bluetooth, NFC, and external ports when not needed

  Limit wireless interfaces and external port access via policy when unused.

• Configure remote wipe, lock, and geolocation capabilities in EMM

  Ensure EMM can lock, locate, and wipe lost or compromised devices.

• Audit logs and run vulnerability scans to verify STIG compliance

  Collect device logs, review settings against STIG, and run regular scans.

• Document approved exceptions and obtain authorizing official (AO) approval for CUI risks

  Record any deviations with justification and AO approval for storing CUI in apps.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.