V-276881

Discussion

Authorizing official (AO) approval is required before the Google device Bluetooth radio can be enabled. All AO approvals must be documented and based on critical mission need. Use of Bluetooth may lead to the exposure of sensitive DOD information in some operational environments. SFR ID: FMT_MOF_EXT.1.2 #47

Check Content

Determine if the site AO has approved the use of Google device Bluetooth radios. Look for a document showing AO approval. All AO approvals must be documented and based on critical mission need. 

If not approved, review configuration settings on the MDM server to confirm Bluetooth has been disabled, and on the Google device, verify Bluetooth cannot be enabled. If approved, this requirement is not applicable.

This check procedure is performed on both the device management tool and managed Google device.

Note: If an organization has multiple configuration profiles, the Check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the management tool, verify Bluetooth is disabled ("DISALLOW_BLUETOOTH" enabled) in the configuration profile.

On the managed Google device verify the Bluetooth radio is disabled and cannot be enabled:
(Settings >> Connected devices >> Connection preferences > Bluetooth)

If Bluetooth has not been disabled in the device's MDM configuration profile or if Bluetooth can be enabled on the Google device, this is a finding.