Primary doc edits for 131558881, a new setting for the Common Criteria class of configurations

Author: Brenduns

memdocs/intune/configuration/device-restrictions-android-for-work.md

@@ -7,7 +7,7 @@ keywords:
 author: MandiOhlinger
 ms.author: mandia
 manager: dougeby
-ms.date: 06/21/2022
+ms.date: 07/19/2022
 ms.topic: conceptual
 ms.service: microsoft-intune
 ms.subservice: configuration
@@ -200,6 +200,22 @@ For corporate-owned devices with a work profile, some settings only apply in the
 
 - **Threat scan on apps**: **Require** (default) enables Google Play Protect to scan apps before and after they're installed. If it detects a threat, it may warn users to remove the app from the device. When set to **Not configured**, Intune doesn't change or update this setting. By default, the OS might not enable or run Google Play Protect to scan apps.
 
+- **Common Criteria mode**: By default, this setting is **Not configured**.
+
+   Set *Common Criteria mode* to **Require** to enable an elevated set of security standards that are most often used in highly sensitive organizations, such as government establishments. Those settings include but are not limited to:
+
+  - AES-GCM encryption of Bluetooth Long Term Keys
+  - Wi-Fi configuration stores
+  - Blocks bootloader download mode, the manual method for software updates
+  - Mandates additional key zeroization on key deletion
+  - Prevents non-authenticated Bluetooth connections
+  - Requires that FOTA updates have 2048-bit RSA-PSS signature
+
+  Learn more about Common Criteria:  
+  - [Common Criteria for Information Technology Security Evaluation](https://www.commoncriteriaportal.org) at commoncriteriaportal.org  
+  - [CommonCriteriaMode](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#commoncriteriamode) in the Android Management API documentation.  
+  - [Knox Deep Dive: Common Criteria Mode](https://www.samsungknox.com/blog/knox-deep-dive-common-criteria-mode) at samsungknox.com
+
 ### Device experience
 
 Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available.