A great deal of government and defense-industrial mobility handles data that matters enormously and is not classified — Controlled Unclassified Information, export-controlled technical data, law enforcement sensitive, critical infrastructure. The requirements are real, they are narrower than CSfC, and getting the distinction right saves programs a great deal of money.
A program hears "sensitive data on phones," reaches for the framework it has heard of, and starts scoping two VPN vendors, two certificate authorities and a registration package — for data that never required any of it. The result is a budget that does not survive review and a timeline measured in years instead of months.
The opposite failure. CUI carries real obligations — a mandatory STIG baseline on DoD networks, FIPS-validated cryptography, enforced device management, documented exceptions. Teams that treat "not classified" as "not governed" discover otherwise at assessment, with a fleet already deployed.
What is the actual classification of the data, in writing, from the authority that owns it? Not what someone assumes, not what the worst case might be. That single answer determines whether you are on this page or the classified one — and it is worth pinning down before a single product is evaluated.
The building blocks are the same components CSfC draws on — you simply need fewer of them, and you do not register a solution.
Current NIAP validation, one of the strongest FIPS portfolios in the industry, and a DISA STIG published within months of each release. For CUI mobility this is a first-class option — and for most organizations, the one already in people's pockets.
Clean AOSP baseline, seven-year support window on current models, and a published Google Android STIG. No Data-at-Rest complication here, because the second layer is not required.
Knox adds management depth that pays off at fleet scale regardless of classification, plus rugged and tactical hardware if the environment demands it. DualDAR is available but not required at this level.
Answer the questions and this narrows to the STIG you actually need and the OS-control mechanism your platform actually has. The differences are larger than most teams expect — one of these combinations cannot pin an OS version at all.
From the authority that owns the data. Everything downstream depends on it, and an assumption here is the most expensive kind of mistake available.
Platform, then manufacturer, then how it is enrolled. Enrollment mode decides more about what you can enforce than the hardware does.
Answer this before you shortlist anything. It eliminates more products than any other question here — and it decides which ones are even eligible to appear in the next step.
Grouped by the two authorizations that matter for federal use: NIAP validation against the Mobile Device Management Protection Profile, and FedRAMP authorization for the cloud service.
COBO and COPE ship as separate benchmarks, and BYOAD is a different STIG entirely. Loading the wrong one produces a clean checklist against the wrong requirements.
Choose a platform and deployment type to see which benchmark applies.
STIGs are versioned to OS releases. An uncontrolled update moves devices off your baseline — and can equally strand them on an unpatched build. What you can actually do about that varies sharply by platform.
Choose a platform to see the mechanism available to you.
Findings you cannot meet are normal and expected. Findings you cannot explain are what turn an assessment into a finding of your own.
We rebuild the report from your selections and send it as a formatted summary, with the caveats attached to each choice. A copy reaches us so we can follow up if you want it walked through.
Authorization status compiled from NIAP validation reports, the FedRAMP Marketplace and vendor documentation, August 2026. OS-control mechanisms per Apple Device Management, Android Enterprise and Samsung Knox documentation. Registries change — confirm current status before relying on any entry here.
If your data is classified, a different set of rules governs — two independent encryption layers, Components List devices, and a solution registered with NSA.
Our Samsung walkthrough covers the mechanics — obtaining benchmarks, the triage step, and applying policy through your UEM. Most of it generalizes to any platform.
It is the most common question we get, and usually the most valuable one to settle. Tell us what data you handle and we will tell you which framework actually governs it.