Merge pull request #7964 from Brenduns/13158881-common-criteria-via-device-restrictions

2207 - Primary doc edits for 131558881, a new setting for the Common Criteri…

Author: PRMerger14

memdocs/intune/configuration/device-restrictions-android-for-work.md

@@ -7,7 +7,7 @@ keywords:
 author: MandiOhlinger
 ms.author: mandia
 manager: dougeby
-ms.date: 07/12/2022
+ms.date: 07/26/2022
 ms.topic: conceptual
 ms.service: microsoft-intune
 ms.subservice: configuration
@@ -200,6 +200,22 @@ For corporate-owned devices with a work profile, some settings only apply in the
 
 - **Threat scan on apps**: **Require** (default) enables Google Play Protect to scan apps before and after they're installed. If it detects a threat, it may warn users to remove the app from the device. When set to **Not configured**, Intune doesn't change or update this setting. By default, the OS might not enable or run Google Play Protect to scan apps.
 
+- **Common Criteria mode**: **Require** enables an elevated set of security standards that are most often used in highly sensitive organizations, such as government establishments. Those settings include but are not limited to:
+
+  - AES-GCM encryption of Bluetooth Long Term Keys
+  - Wi-Fi configuration stores
+  - Blocks bootloader download mode, the manual method for software updates
+  - Mandates additional key zeroization on key deletion
+  - Prevents non-authenticated Bluetooth connections
+  - Requires that FOTA updates have 2048-bit RSA-PSS signature
+
+  When set to **Not configured** (default), Intune doesn't change or update this setting.
+
+  Learn more about Common Criteria:  
+  - [Common Criteria for Information Technology Security Evaluation](https://www.commoncriteriaportal.org) at commoncriteriaportal.org  
+  - [CommonCriteriaMode](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#commoncriteriamode) in the Android Management API documentation.  
+  - [Knox Deep Dive: Common Criteria Mode](https://www.samsungknox.com/blog/knox-deep-dive-common-criteria-mode) at samsungknox.com
+
 ### Device experience
 
 Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available.