diff --git a/wpa_supplicant/hidl/1.2/sta_network.cpp b/wpa_supplicant/hidl/1.2/sta_network.cpp
index 38ed49a..a1bc73d 100644
--- a/wpa_supplicant/hidl/1.2/sta_network.cpp
+++ b/wpa_supplicant/hidl/1.2/sta_network.cpp
@@ -57,6 +57,13 @@
      static_cast<uint32_t>(ISupplicantStaNetwork::PairwiseCipherMask::CCMP) |
      static_cast<uint32_t>(
 	 ISupplicantStaNetwork::PairwiseCipherMask::GCMP_256));
+constexpr uint32_t kAllowedGroupMgmtCipherMask =
+	(static_cast<uint32_t>(
+			ISupplicantStaNetwork::GroupMgmtCipherMask::BIP_GMAC_128) |
+	 static_cast<uint32_t>(
+			 ISupplicantStaNetwork::GroupMgmtCipherMask::BIP_GMAC_256) |
+	 static_cast<uint32_t>(
+			 ISupplicantStaNetwork::GroupMgmtCipherMask::BIP_CMAC_256));
 
 constexpr uint32_t kEapMethodMax =
     static_cast<uint32_t>(ISupplicantStaNetwork::EapMethod::WFA_UNAUTH_TLS) + 1;
@@ -703,6 +710,22 @@
 	    &StaNetwork::setGroupCipherInternal, _hidl_cb, group_cipher_mask);
 }
 
+Return<void> StaNetwork::setGroupMgmtCipher(
+    uint32_t group_mgmt_cipher_mask, setGroupMgmtCipher_cb _hidl_cb)
+{
+	return validateAndCall(
+	    this, SupplicantStatusCode::FAILURE_NETWORK_INVALID,
+	    &StaNetwork::setGroupMgmtCipherInternal,
+		_hidl_cb, group_mgmt_cipher_mask);
+}
+
+Return<void> StaNetwork::getGroupMgmtCipher(getGroupMgmtCipher_cb _hidl_cb)
+{
+	return validateAndCall(
+	    this, SupplicantStatusCode::FAILURE_NETWORK_INVALID,
+	    &StaNetwork::getGroupMgmtCipherInternal, _hidl_cb);
+}
+
 Return<void> StaNetwork::setPairwiseCipher_1_2(
     uint32_t pairwise_cipher_mask, setPairwiseCipher_1_2_cb _hidl_cb)
 {
@@ -1957,6 +1980,27 @@
 	return {{SupplicantStatusCode::SUCCESS, ""}, mask};
 }
 
+SupplicantStatus StaNetwork::setGroupMgmtCipherInternal(uint32_t
+		group_mgmt_cipher_mask)
+{
+	struct wpa_ssid *wpa_ssid = retrieveNetworkPtr();
+	if (group_mgmt_cipher_mask & ~kAllowedGroupMgmtCipherMask) {
+		return {SupplicantStatusCode::FAILURE_ARGS_INVALID, ""};
+	}
+	wpa_ssid->group_mgmt_cipher = group_mgmt_cipher_mask;
+	wpa_printf(MSG_MSGDUMP, "group_mgmt_cipher: 0x%x",
+			wpa_ssid->group_mgmt_cipher);
+	resetInternalStateAfterParamsUpdate();
+	return {SupplicantStatusCode::SUCCESS, ""};
+}
+
+std::pair<SupplicantStatus, uint32_t> StaNetwork::getGroupMgmtCipherInternal()
+{
+	struct wpa_ssid *wpa_ssid = retrieveNetworkPtr();
+	return {{SupplicantStatusCode::SUCCESS, ""},
+		wpa_ssid->group_mgmt_cipher & kAllowedGroupMgmtCipherMask};
+}
+
 /**
  * Retrieve the underlying |wpa_ssid| struct pointer for
  * this network.
diff --git a/wpa_supplicant/hidl/1.2/sta_network.h b/wpa_supplicant/hidl/1.2/sta_network.h
index 3e267c0..5108ef4 100644
--- a/wpa_supplicant/hidl/1.2/sta_network.h
+++ b/wpa_supplicant/hidl/1.2/sta_network.h
@@ -210,6 +210,11 @@
 	    setGroupCipher_1_2_cb _hidl_cb) override;
 	Return<void> getGroupCipher_1_2(
 	    getGroupCipher_1_2_cb _hidl_cb) override;
+	Return<void> setGroupMgmtCipher(
+	    uint32_t group_mgmt_cipher_mask,
+	    setGroupMgmtCipher_cb _hidl_cb) override;
+	Return<void> getGroupMgmtCipher(
+	    getGroupMgmtCipher_cb _hidl_cb) override;
 	Return<void> enableTlsSuiteBEapPhase1Param(
 	    bool enable, enableTlsSuiteBEapPhase1Param_cb _hidl_cb) override;
 	Return<void> enableSuiteBEapOpenSslCiphers(
@@ -337,6 +342,8 @@
 	SupplicantStatus setSaePasswordIdInternal(
 	    const std::string& sae_password_id);
 	std::pair<SupplicantStatus, uint32_t> getKeyMgmtCapabilitiesInternal();
+	SupplicantStatus setGroupMgmtCipherInternal(uint32_t group_mgmt_cipher_mask);
+	std::pair<SupplicantStatus, uint32_t> getGroupMgmtCipherInternal();
 
 	struct wpa_ssid* retrieveNetworkPtr();
 	struct wpa_supplicant* retrieveIfacePtr();