A device policy controller, or DPC, is the Android enterprise app that enforces security rules on a managed device. It can set password strength, require encryption, control app installation, and manage when system and security updates are allowed to install. In practice, the DPC is the policy engine behind a corporate phone or tablet.
DPCs matter because they shape the attack window. A strict DPC can keep devices compliant and speed patch adoption, but it can also delay updates during freeze periods or staged rollouts, leaving known flaws unpatched for longer. Attackers benefit when managed devices sit below the required security patch level, while defenders use the DPC to monitor compliance, push fixes, and block risky configurations. In mobile security, the DPC is where administration becomes enforcement.