STIGhub
STIGs
RMF Controls
Compare
← AC-17 (1) — Remote Access
CCI-002314
Definition
Employ automated mechanisms to control remote access methods.
Parent Control
AC-17 (1)
Remote Access
Access Control
Linked STIG Checks (139)
V-279072
CAT II
The ColdFusion error messages must be restricted to only authorized users.
Adobe ColdFusion Security Technical Implementation Guide
V-279074
CAT II
ColdFusion must control remote access to the Administrator Console.
Adobe ColdFusion Security Technical Implementation Guide
V-279075
CAT I
ColdFusion must control remote access to Exposed Services.
Adobe ColdFusion Security Technical Implementation Guide
V-274027
CAT II
Amazon Linux 2023 must have the firewalld package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274028
CAT II
Amazon Linux 2023 must have the firewalld service active.
Amazon Linux 2023 Security Technical Implementation Guide
V-274158
CAT II
Amazon Linux 2023 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.
Amazon Linux 2023 Security Technical Implementation Guide
V-268078
CAT II
NixOS must enable the built-in firewall.
Anduril NixOS Security Technical Implementation Guide
V-214259
CAT II
The Apache web server must restrict inbound connections from nonsecure zones.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214343
CAT II
The Apache web server must restrict inbound connections from nonsecure zones.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214388
CAT II
The Apache web server must restrict inbound connections from nonsecure zones.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-222980
CAT II
LockOutRealms must be used for management of Tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-254612
CAT II
Apple iOS/iPadOS 16 must implement the management setting: Disable Allow MailDrop.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-258346
CAT II
Apple iOS/iPadOS 17 must implement the management setting: Disable Allow MailDrop.
Apple iOS/iPadOS 17 Security Technical Implementation Guide
V-268033
CAT II
Apple iOS/iPadOS 18 must implement the management setting: disable Allow MailDrop.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-278792
CAT II
Apple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-276395
CAT II
Apple visionOS 2 must implement the management setting: disable Allow MailDrop.
Apple visionOS 2 Security Technical Implementation Guide
V-282804
CAT II
Apple visionOS 26 must implement the management setting: disable Allow MailDrop.
Apple visionOS 26 Security Technical Implementation Guide
V-204978
CAT II
The ALG providing intermediary services for remote access communications traffic must control remote access methods.
Application Layer Gateway Security Requirements Guide
V-204782
CAT II
The application server must control remote access methods.
Application Server Security Requirements Guide
V-256845
CAT II
Compliance Guardian must control remote access methods.
AvePoint Compliance Guardian Security Technical Implementation Guide
V-253517
CAT II
DocAve must control remote access methods.
AvePoint DocAve 6 Security Technical Implementation Guide
V-237384
CAT II
The CA API Gateway providing intermediary services for remote access communications traffic must control remote access methods.
CA API Gateway ALG Security Technical Implementation Guide
V-219161
CAT II
The Ubuntu operating system must have an application firewall installed in order to control remote access methods.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219337
CAT II
The Ubuntu operating system must enable and run the uncomplicated firewall(ufw).
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238354
CAT II
The Ubuntu operating system must have an application firewall installed in order to control remote access methods.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238355
CAT II
The Ubuntu operating system must enable and run the uncomplicated firewall(ufw).
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260514
CAT II
Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access methods.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260515
CAT II
Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw).
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270654
CAT II
Ubuntu 24.04 LTS must have an application firewall installed in order to control remote access methods.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270655
CAT II
Ubuntu 24.04 LTS must enable and run the Uncomplicated Firewall (ufw).
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-269245
CAT II
The firewalld service on AlmaLinux OS 9 must be active.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269358
CAT II
AlmaLinux OS 9 must have the firewalld package installed.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-215726
CAT II
The BIG-IP APM module access policy profile must control remote access methods to virtual servers.
F5 BIG-IP Access Policy Manager Security Technical Implementation Guide
V-215772
CAT II
The BIG-IP Core implementation providing intermediary services for remote access communications traffic must control remote access methods to virtual servers.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-203686
CAT II
The operating system must control remote access methods.
General Purpose Operating System Security Requirements Guide
V-267447
CAT II
Google Android 15 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Google Android 15 COBO Security Technical Implementation Guide
V-267542
CAT II
Google Android 15 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Google Android 15 COPE Security Technical Implementation Guide
V-276765
CAT II
Google Android 16 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Google Android 16 COBO Security Technical Implementation Guide
V-276867
CAT II
Google Android 16 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Google Android 16 COPE Security Technical Implementation Guide
V-255263
CAT II
SSMC web server must restrict connections from nonsecure zones.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-237818
CAT I
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-255272
CAT I
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide
V-283038
CAT II
The HPE Alletra Storage ArcusOS device must disable remote access.
HPE Alletra Storage ArcusOS Web Server Security Technical Implementation Guide
V-274307
CAT II
Honeywell Android 13 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Honeywell Android 13 COBO Security Technical Implementation Guide
V-274402
CAT II
Honeywell Android 13 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Honeywell Android 13 COPE Security Technical Implementation Guide
V-215233
CAT I
AIX must be able to control the ability of remote login for users.
IBM AIX 7.x Security Technical Implementation Guide
V-250341
CAT I
Application security must be enabled on the WebSphere Liberty Server.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255826
CAT I
The WebSphere Application Server administrative security must be enabled.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-255828
CAT II
The WebSphere Application Server users in a local user registry group must be authorized for that group.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223600
CAT II
IBM z//OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223821
CAT II
IBM z/OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
IBM z/OS RACF Security Technical Implementation Guide
V-224062
CAT II
IBM z//OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
IBM z/OS TSS Security Technical Implementation Guide
V-258587
CAT III
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-218812
CAT II
The IIS 10.0 web server must restrict inbound connections from non-secure zones.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-220972
CAT II
The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
Microsoft Windows 10 Security Technical Implementation Guide
V-253495
CAT II
The "Deny log on through Remote Desktop Services" user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
Microsoft Windows 11 Security Technical Implementation Guide
V-225004
CAT II
The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225019
CAT II
The "Deny log on through Remote Desktop Services" user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205732
CAT II
Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205733
CAT II
Windows Server 2019 "Deny log on through Remote Desktop Services" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254425
CAT II
Windows Server 2022 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254439
CAT II
Windows Server 2022 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278174
CAT II
The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain controllers must be configured to prevent unauthenticated access.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278188
CAT II
The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-272188
CAT II
Motorola Solutions Android 13 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Motorola Solutions Android 13 COBO Security Technical Implementation Guide
V-272334
CAT II
Motorola Solutions Android 13 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Motorola Solutions Android 13 COPE Security Technical Implementation Guide
V-254098
CAT II
Nutanix AOS must disable Remote Support Sessions.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-254124
CAT II
Nutanix AOS must control remote access methods.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279532
CAT II
Nutanix OS must configure the firewall to control remote access methods.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-221297
CAT II
Remote access to OHS must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221298
CAT II
OHS must have the Order, Allow, and Deny directives set within the Directory directives set to restrict inbound connections from nonsecure zones.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221299
CAT II
OHS must have the Order, Allow, and Deny directives set within the Files directives set to restrict inbound connections from nonsecure zones.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221300
CAT II
OHS must have the Order, Allow, and Deny directives set within the Location directives set to restrict inbound connections from nonsecure zones.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221839
CAT II
The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.
Oracle Linux 7 Security Technical Implementation Guide
V-248839
CAT II
An OL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
Oracle Linux 8 Security Technical Implementation Guide
V-248840
CAT II
A firewall must be installed on OL 8.
Oracle Linux 8 Security Technical Implementation Guide
V-248841
CAT II
A firewall must be active on OL 8.
Oracle Linux 8 Security Technical Implementation Guide
V-271469
CAT II
OL 9 must have the firewalld package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271470
CAT II
OL 9 must be configured so that the firewalld service is active.
Oracle Linux 9 Security Technical Implementation Guide
V-271472
CAT II
OL 9 must control remote access methods.
Oracle Linux 9 Security Technical Implementation Guide
V-228854
CAT II
The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must control remote access methods (inspect and filter traffic).
Palo Alto Networks ALG Security Technical Implementation Guide
V-280955
CAT II
RHEL 10 must have the "firewalld" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280956
CAT II
RHEL 10 must have the "firewalld" service set to active.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280957
CAT II
RHEL 10 must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281332
CAT II
RHEL 10 must control remote access methods.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204577
CAT II
The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-230504
CAT II
A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-230505
CAT II
A firewall must be installed on RHEL 8.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-244544
CAT II
A firewall must be active on RHEL 8.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-257935
CAT II
RHEL 9 must have the firewalld package installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257936
CAT II
The firewalld service on RHEL 9 must be active.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-275608
CAT II
Ubuntu OS must have an application firewall installed to control remote access methods.
Riverbed NetIM OS Security Technical Implementation Guide
V-275609
CAT II
Ubuntu OS must enable and run the Uncomplicated Firewall (ufw).
Riverbed NetIM OS Security Technical Implementation Guide
V-261310
CAT II
SLEM 5 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217261
CAT II
The SUSE operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-276539
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Samsung Android 16 COBO Security Technical Implementation Guide
V-276645
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Samsung Android 16 COPE Security Technical Implementation Guide
V-255122
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Samsung Android OS 13 with Knox 3.x COBO Security Technical Implementation Guide
V-255151
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a pre-shared key.
Samsung Android OS 13 with Knox 3.x COPE Security Technical Implementation Guide
V-258641
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key. - Disallow config tethering.
Samsung Android OS 14 with Knox 3.x COBO Security Technical Implementation Guide
V-258677
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a pre-shared key.
Samsung Android OS 14 with Knox 3.x COPE Security Technical Implementation Guide
V-268952
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a pre-shared key.
Samsung Android OS 15 with Knox 3.x COBO Security Technical Implementation Guide
V-269050
CAT II
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Samsung Android OS 15 with Knox 3.x COPE Security Technical Implementation Guide
V-279203
CAT II
The Edge SWG must control remote access methods.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-241005
CAT II
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
Tanium 7.0 Security Technical Implementation Guide
V-234066
CAT II
Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.
Tanium 7.3 Security Technical Implementation Guide
V-253088
CAT II
A firewall must be installed on TOSS.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282486
CAT II
The firewalld service on TOSS 5 must be active.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-240074
CAT I
HAProxy must redirect all http traffic to use https.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240075
CAT II
HAProxy must restrict inbound connections from nonsecure zones.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240258
CAT I
Lighttpd must be configured to utilize the Common Information Model Object Manager.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240259
CAT II
Lighttpd must restrict inbound connections from nonsecure zones.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240498
CAT II
The SLES for vRealize must control remote access methods.
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide
V-240842
CAT I
tc Server ALL must be configured to the correct user authentication source.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240843
CAT II
tc Server HORIZON must be configured to use the https scheme.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240844
CAT II
tc Server VCAC must be configured to use the https scheme.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240949
CAT II
The vAMI account credentials must protected by site policies.
VMware vRealize Automation 7.x vAMI Security Technical Implementation Guide
V-239592
CAT II
The SLES for vRealize must control remote access methods.
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide
V-241697
CAT I
tc Server ALL must be configured to the correct user authentication source.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241698
CAT II
tc Server UI must be configured to use the https scheme.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241699
CAT II
tc Server CaSa must be configured to use the https scheme.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241700
CAT II
tc Server API must be configured to use the https scheme.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256400
CAT II
The ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).
VMware vSphere 7.0 ESXi Security Technical Implementation Guide
V-256647
CAT II
VAMI must use cryptography to protect the integrity of remote sessions.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256742
CAT II
Envoy must exclusively use the HTTPS protocol for client connections.
VMware vSphere 7.0 vCenter Appliance RhttpProxy Security Technical Implementation Guide
V-258754
CAT II
The ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).
VMware vSphere 8.0 ESXi Security Technical Implementation Guide
V-259138
CAT II
The vCenter VAMI service must use cryptography to protect the integrity of remote sessions.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-207435
CAT II
The VMM must control remote access methods.
Virtual Machine Manager Security Requirements Guide
V-207228
CAT II
The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.
Virtual Private Network (VPN) Security Requirements Guide
V-206416
CAT II
Remote access to the web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.
Web Server Security Requirements Guide
V-206417
CAT II
The web server must restrict inbound connections from nonsecure zones.
Web Server Security Requirements Guide
V-73773
CAT II
The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Windows Server 2016 Security Technical Implementation Guide
V-73773
CAT II
The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Windows Server 2016 Security Technical Implementation Guide
V-73775
CAT II
The Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.
Windows Server 2016 Security Technical Implementation Guide
V-73775
CAT II
The Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.
Windows Server 2016 Security Technical Implementation Guide
V-92963
CAT II
Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
Windows Server 2019 Security Technical Implementation Guide
V-92965
CAT II
Windows Server 2019 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
Windows Server 2019 Security Technical Implementation Guide
V-283531
CAT II
Zebra Android 14 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Zebra Technologies Android 14 COBO Security Technical Implementation Guide
V-283633
CAT II
Zebra Android 14 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Zebra Technologies Android 14 COPE Security Technical Implementation Guide