STIG 9 compliance for fully managed devices with a work profile using UEM and KSP

NOTE—This section provides high-level instructions to set up and configure STIG policies on a fully managed device with a work profile using VMware Workspace ONE UEM console. For detailed information on configuring STIG policies VMware Workspace ONE UEM console, see VMware AirWatch v9.x MDM STIG.

To reference a video describing STIG compliance for fully managed devices with a work profile, go to: STIG compliance for fully managed devices with a work profile.

VMware Workspace ONE UEM does not currently provide native support for all STIG policies necessary for compliance. IT admins can use KSP from within Workspace ONE to ensure compliance with STIG policies.

NOTE—Currently, you can create a Personal space—also known as Personal profile in Android Enterprise—on fully managed device with a work profile using VMware Workspace ONE UEM, but cannot use KSP to apply additional policies to the Personal space. This results in an inability to use KSP to enforce STIG compliance for Personal space policies.

To apply STIG compliance policies:

Set the fully managed device with a work profile mode on your UEM console.
Implement the fully managed device with a work profile method of AE deployment on your devices.
Add KSP as an app in DO and PO as described in Step 1: VMware Workspace ONE UEM - Add to UEM.
Create new DO and PO profiles with appropriate policy restrictions as described in Step 2: VMware Workspace ONE UEM - Configure.
In your UEM console, go to Devices > Profiles & Resources > Profiles. The Profiles page opens.
On this page, click Add > Add profile. The select platform to start page opens.
On this page, double-click Android. The Add a New Android Profile page opens to show a left navigation menu of items you can configure for your device profile.
Edit the STIG compliance policies using the items on the left navigation menu. edit the Save your changes.
From the UEM console home page, go to Devices > Device Settings > Android > Android EMM Registration > fully managed device enrollments list, set the value to Corporate Owned Personally Enabled.
Enable audit logging as follows:
1. From the UEM console home page, go to Devices > Device Settings > Android > Intelligent Hub Settings > Samsung Knox settings.
2. Set the value of the Enable Audit Logging field to Enabled.
3. Save your changes.
Set additional policies and values using KSP.
Deploy KSP policy changes to a fully managed device with a work profile as described in Step 3: VMware Workspace ONE UEM - Deploy.

Settings for STIG compliance

NOTE—The policies, values, and configuration options described in the tables below are supported by KSP and designed to work within your unique UEM environment.

Primary profile (DO)

Policy Group	Policy Rule	Available Options	Applicable Configuration Items	Supported by KSP
Knox Bluetooth	Allow these profiles	HSP, HFP, PBAP, A2DP, AVRCP, SPP, NAP, BNEP, HID, BPP, DUN, SAP	HFP, HSP, SPP	ü
Knox Wi-Fi	Allow connections to an unsecured hotspot	Select OR Unselect	Unselect	ü
Knox application	Disable system applications	Configure	Add all non-AO-approved system app packages Add all system app packages that are identified as having non-DoD-approved characteristics Add all preinstalled public cloud backup system apps	ü
Knox audit log	Enable audit log	Select OR Unselect	Select	ü
Knox banner	Show banner text	Configure	Add DoD-mandated warning banner text	ü
Knox certificate	Enable OCSP check	Configure	Enable for all apps	ü
Knox certificate	Enable revocation check	Configure	Enable for all apps	ü
Knox encryption	Enable encryption of external storage devices	Select OR Unselect	Select	ü
Knox password constraints	Maximum number of sequential characters allowed in passwords	0+	2	ü
Knox password constraints	Maximum number of sequential numbers allowed in passwords	0+	2	ü
Knox restrictions	Add items to USB host mode exception list	APP, AUD, CDC, COM, CON, CSC, HID, HUB, MAS, MIS, PER, PHY, PRI, STI, VEN, VID, WIR	HID	ü
Knox restrictions	Enable CC mode	Select OR Unselect	Select	ü

Managed Profile (PO)

Policy Group	Policy Rule	Available Options	Applicable Configuration Items	Suuported by KSP
Knox RCP	Allow moving applications from Personal space to Managed Workspace	Select OR Unselect	Unselect	ü
Knox RCP	Allow moving files from Managed Workspace to Personal space	Select OR Unselect	Unselect	ü
Knox RCP	Allow sharing data from the Managed Workspace clipboard to the Personal space	Select OR Unselect	Unselect	ü
Knox RCP	Allow syncing Managed Workspace calendar to Personal space	Select OR Unselect	Unselect	ü
Knox RCP	Allow syncing Managed Workspace contacts to Personal space	Select OR Unselect	Unselect	ü
Knox application	Disable system applications	Configure	Add all non-AO-approved system app packages Add all system app packages that are identified as having non-DoD-approved characteristics Add all preinstalled public cloud backup system apps	ü
Knox certificate	OCSP check	Configure	Enable for all apps	ü
Knox certificate	revocation check	Configure	Enable for all apps	ü
Knox restrictions	Disallow share via list	Select OR Unselect	Select	ü
Knox restrictions	allow auto-fill	Select OR Unselect	Unselect	ü
Knox restrictions	allow google accounts auto sync	Select OR Unselect	Unselect	ü