diff --git a/doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V5R3.ckl b/doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V6R1.ckl similarity index 95% rename from doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V5R3.ckl rename to doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V6R1.ckl index 7f9eecb..8393134 100644 --- a/doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V5R3.ckl +++ b/doc/STIGQter-Application Security and Development Security Technical Implementation Guide_V6R1.ckl @@ -21,7 +21,7 @@ version - 5 + 6 classification @@ -40,11 +40,11 @@ filename - U_ASD_STIG_V5R3_Manual-xccdf.xml + U_ASD_STIG_V6R1_Manual-xccdf.xml releaseinfo - Release: 3 Benchmark Date: 26 Jul 2023 + Release: 1 Benchmark Date: 24 Jul 2024 title @@ -52,7 +52,7 @@ uuid - 8a9d14d8-a85e-4396-82b4-4320d925deda + a5af7c3c-08f1-4c3d-9fc0-dec7214559bf notice @@ -78,7 +78,7 @@ Rule_ID - SV-222387r879511_rule + SV-222387r960735_rule Rule_Ver @@ -166,7 +166,7 @@ If the application is not configured to limit the number of logon sessions per u STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -174,7 +174,7 @@ If the application is not configured to limit the number of logon sessions per u STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -213,7 +213,7 @@ If the application is not configured to limit the number of logon sessions per u Rule_ID - SV-222388r879673_rule + SV-222388r961221_rule Rule_Ver @@ -303,7 +303,7 @@ The application may use means other than cookies to store user information. If t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -311,7 +311,7 @@ The application may use means other than cookies to store user information. If t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -350,7 +350,7 @@ The application may use means other than cookies to store user information. If t Rule_ID - SV-222389r879673_rule + SV-222389r961221_rule Rule_Ver @@ -430,7 +430,7 @@ If the configuration setting is not set to time out user sessions after 15 minut STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -438,7 +438,7 @@ If the configuration setting is not set to time out user sessions after 15 minut STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -477,7 +477,7 @@ If the configuration setting is not set to time out user sessions after 15 minut Rule_ID - SV-222390r879673_rule + SV-222390r961221_rule Rule_Ver @@ -557,7 +557,7 @@ If the configuration setting is not set to time out admin user sessions after 10 STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -565,7 +565,7 @@ If the configuration setting is not set to time out admin user sessions after 10 STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -604,7 +604,7 @@ If the configuration setting is not set to time out admin user sessions after 10 Rule_ID - SV-222391r879674_rule + SV-222391r961224_rule Rule_Ver @@ -684,7 +684,7 @@ If the user session is not terminated or if the logoff function does not exist, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -692,7 +692,7 @@ If the user session is not terminated or if the logoff function does not exist, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -731,7 +731,7 @@ If the user session is not terminated or if the logoff function does not exist, Rule_ID - SV-222392r879675_rule + SV-222392r961227_rule Rule_Ver @@ -809,7 +809,7 @@ If the application does not provide an explicit logoff message indicating the us STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -817,7 +817,7 @@ If the application does not provide an explicit logoff message indicating the us STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -856,7 +856,7 @@ If the application does not provide an explicit logoff message indicating the us Rule_ID - SV-222393r879689_rule + SV-222393r961269_rule Rule_Ver @@ -946,7 +946,7 @@ If application data required to be marked is not marked and does not retain its STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -954,7 +954,7 @@ If application data required to be marked is not marked and does not retain its STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -993,7 +993,7 @@ If application data required to be marked is not marked and does not retain its Rule_ID - SV-222394r879690_rule + SV-222394r961272_rule Rule_Ver @@ -1081,7 +1081,7 @@ If application data required to be marked does not retain its marking while it i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1089,7 +1089,7 @@ If application data required to be marked does not retain its marking while it i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1128,7 +1128,7 @@ If application data required to be marked does not retain its marking while it i Rule_ID - SV-222395r879691_rule + SV-222395r961275_rule Rule_Ver @@ -1216,7 +1216,7 @@ If application data required to be marked does not retain its marking when it is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1224,7 +1224,7 @@ If application data required to be marked does not retain its marking when it is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1263,7 +1263,7 @@ If application data required to be marked does not retain its marking when it is Rule_ID - SV-222396r879519_rule + SV-222396r960759_rule Rule_Ver @@ -1347,7 +1347,7 @@ If the connection is not secured with TLS, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1355,7 +1355,7 @@ If the connection is not secured with TLS, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1394,7 +1394,7 @@ If the connection is not secured with TLS, this is a finding. Rule_ID - SV-222397r879520_rule + SV-222397r960762_rule Rule_Ver @@ -1478,7 +1478,7 @@ If the connection is not secured with TLS, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1486,7 +1486,7 @@ If the connection is not secured with TLS, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1525,7 +1525,7 @@ If the connection is not secured with TLS, this is a finding. Rule_ID - SV-222398r879520_rule + SV-222398r960762_rule Rule_Ver @@ -1615,7 +1615,7 @@ If SOAP messages requiring integrity do not have the Message ID, Service Request STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1623,7 +1623,7 @@ If SOAP messages requiring integrity do not have the Message ID, Service Request STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1662,7 +1662,7 @@ If SOAP messages requiring integrity do not have the Message ID, Service Request Rule_ID - SV-222399r879519_rule + SV-222399r960759_rule Rule_Ver @@ -1740,7 +1740,7 @@ If messages using WS Security do not contain time stamps, sequence numbers, and STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1748,7 +1748,7 @@ If messages using WS Security do not contain time stamps, sequence numbers, and STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1787,7 +1787,7 @@ If messages using WS Security do not contain time stamps, sequence numbers, and Rule_ID - SV-222400r879519_rule + SV-222400r960759_rule Rule_Ver @@ -1867,7 +1867,7 @@ If the design document does not exist, or does not indicate validity periods are STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -1875,7 +1875,7 @@ If the design document does not exist, or does not indicate validity periods are STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -1914,7 +1914,7 @@ If the design document does not exist, or does not indicate validity periods are Rule_ID - SV-222401r879519_rule + SV-222401r960759_rule Rule_Ver @@ -1994,7 +1994,7 @@ If the design document does not exist, or does not indicate SAML assertion ident STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2002,7 +2002,7 @@ If the design document does not exist, or does not indicate SAML assertion ident STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2041,7 +2041,7 @@ If the design document does not exist, or does not indicate SAML assertion ident Rule_ID - SV-222402r879519_rule + SV-222402r960759_rule Rule_Ver @@ -2123,7 +2123,7 @@ If the design document does not exist, or does not indicate all WS-Security toke STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2131,7 +2131,7 @@ If the design document does not exist, or does not indicate all WS-Security toke STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2170,7 +2170,7 @@ If the design document does not exist, or does not indicate all WS-Security toke Rule_ID - SV-222403r879519_rule + SV-222403r960759_rule Rule_Ver @@ -2252,7 +2252,7 @@ If SOAP messages do not contain <NotOnOrAfter> elements, this is a finding STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2260,7 +2260,7 @@ If SOAP messages do not contain <NotOnOrAfter> elements, this is a finding STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2299,7 +2299,7 @@ If SOAP messages do not contain <NotOnOrAfter> elements, this is a finding Rule_ID - SV-222404r879519_rule + SV-222404r960759_rule Rule_Ver @@ -2381,7 +2381,7 @@ If SOAP using the <Conditions> element does not contain <NotBefore> STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2389,7 +2389,7 @@ If SOAP using the <Conditions> element does not contain <NotBefore> STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2428,7 +2428,7 @@ If SOAP using the <Conditions> element does not contain <NotBefore> Rule_ID - SV-222405r879519_rule + SV-222405r960759_rule Rule_Ver @@ -2508,7 +2508,7 @@ If SOAP message uses more than one, OneTimeUse element in a SAML assertion, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2516,7 +2516,7 @@ If SOAP message uses more than one, OneTimeUse element in a SAML assertion, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2555,7 +2555,7 @@ If SOAP message uses more than one, OneTimeUse element in a SAML assertion, this Rule_ID - SV-222406r879519_rule + SV-222406r960759_rule Rule_Ver @@ -2635,7 +2635,7 @@ If the SessionIndex is tied to privacy information, and it is not encrypted, thi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2643,7 +2643,7 @@ If the SessionIndex is tied to privacy information, and it is not encrypted, thi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2682,7 +2682,7 @@ If the SessionIndex is tied to privacy information, and it is not encrypted, thi Rule_ID - SV-222407r879522_rule + SV-222407r960768_rule Rule_Ver @@ -2776,7 +2776,7 @@ If the account management process is manual in nature, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2784,7 +2784,7 @@ If the account management process is manual in nature, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2823,7 +2823,7 @@ If the account management process is manual in nature, this is a finding. Rule_ID - SV-222408r879694_rule + SV-222408r985902_rule Rule_Ver @@ -2845,7 +2845,7 @@ If the account management process is manual in nature, this is a finding.Check_Content Review the application documentation and determine if there is a requirement for shared or group accounts. -If there is no official requirement for shared or group application accounts, this requirement is not applicable. +If there is no official requirement for shared or group application accounts, this requirement is Not Applicable. Interview the application representative and identify shared/group accounts. @@ -2905,7 +2905,7 @@ If there is no process for handling group account credentials, this is a finding STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -2913,7 +2913,7 @@ If there is no process for handling group account credentials, this is a finding STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -2921,7 +2921,7 @@ If there is no process for handling group account credentials, this is a finding CCI_REF - CCI-002142 + CCI-000366 LEGACY_ID @@ -2952,7 +2952,7 @@ If there is no process for handling group account credentials, this is a finding Rule_ID - SV-222409r879523_rule + SV-222409r960771_rule Rule_Ver @@ -3040,7 +3040,7 @@ If the application has no ability to specify a user account as being temporary i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3048,7 +3048,7 @@ If the application has no ability to specify a user account as being temporary i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3087,7 +3087,7 @@ If the application has no ability to specify a user account as being temporary i Rule_ID - SV-222410r879887_rule + SV-222410r961863_rule Rule_Ver @@ -3173,7 +3173,7 @@ If a process, procedure, function or feature designed to prevent emergency accou STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3181,7 +3181,7 @@ If a process, procedure, function or feature designed to prevent emergency accou STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3220,7 +3220,7 @@ If a process, procedure, function or feature designed to prevent emergency accou Rule_ID - SV-222411r879524_rule + SV-222411r960774_rule Rule_Ver @@ -3308,7 +3308,7 @@ If the application is not set to expire inactive accounts after 35 days, or if t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3316,7 +3316,7 @@ If the application is not set to expire inactive accounts after 35 days, or if t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3355,7 +3355,7 @@ If the application is not set to expire inactive accounts after 35 days, or if t Rule_ID - SV-222412r879524_rule + SV-222412r960774_rule Rule_Ver @@ -3435,7 +3435,7 @@ If any accounts cannot be validated and are deemed to be unnecessary, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3443,7 +3443,7 @@ If any accounts cannot be validated and are deemed to be unnecessary, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3482,7 +3482,7 @@ If any accounts cannot be validated and are deemed to be unnecessary, this is a Rule_ID - SV-222413r879525_rule + SV-222413r960777_rule Rule_Ver @@ -3570,7 +3570,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3578,7 +3578,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3617,7 +3617,7 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_ID - SV-222414r879526_rule + SV-222414r960780_rule Rule_Ver @@ -3705,7 +3705,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3713,7 +3713,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3752,7 +3752,7 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_ID - SV-222415r879527_rule + SV-222415r960783_rule Rule_Ver @@ -3840,7 +3840,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3848,7 +3848,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -3887,7 +3887,7 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_ID - SV-222416r879528_rule + SV-222416r960786_rule Rule_Ver @@ -3975,7 +3975,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -3983,7 +3983,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4022,7 +4022,7 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_ID - SV-222417r879669_rule + SV-222417r985905_rule Rule_Ver @@ -4030,13 +4030,13 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_Title - The application must notify System Administrators and Information System Security Officers when accounts are created. + The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created. Vuln_Discuss - Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. + Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. -To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. +To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. IA_Controls @@ -4048,15 +4048,15 @@ To address access requirements, many application developers choose to integrate Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. -If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. +If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. -Ensure the application is configured to notify system administrators when new accounts are created by identifying system administrators who will be notified when new accounts are created, creating a test account and checking with system administrator to verify notification was received. +Ensure the application is configured to notify SAs when new accounts are created by identifying SAs who will be notified, creating a test account, and checking with SAs to verify the notification was received. -If system administrators and ISSOs are not notified when accounts are created, this is a finding. +If SAs and ISSOs are not notified when accounts are created, this is a finding. Fix_Text - Configure the application to notify the system administrator and the ISSO when application accounts are created. + Configure the application to notify the SA and the ISSO when application accounts are created. False_Positives @@ -4104,7 +4104,7 @@ If system administrators and ISSOs are not notified when accounts are created, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4112,7 +4112,7 @@ If system administrators and ISSOs are not notified when accounts are created, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4120,7 +4120,7 @@ If system administrators and ISSOs are not notified when accounts are created, t CCI_REF - CCI-001683 + CCI-000015 LEGACY_ID @@ -4151,7 +4151,7 @@ If system administrators and ISSOs are not notified when accounts are created, t Rule_ID - SV-222418r879670_rule + SV-222418r985908_rule Rule_Ver @@ -4159,13 +4159,13 @@ If system administrators and ISSOs are not notified when accounts are created, t Rule_Title - The application must notify System Administrators and Information System Security Officers when accounts are modified. + The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified. Vuln_Discuss - Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. + Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the modification of application user accounts and notifies administrators and ISSOs such accounts were modified. This type of process greatly reduces the risk that accounts will be surreptitiously modified and provides logging that can be used for forensic purposes. -To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. +To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. IA_Controls @@ -4177,17 +4177,17 @@ To address access requirements, many application developers choose to integrate Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. -If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. +If the application is configured to use an enterprise-based application user management capability that is STIG compliant, this requirement is Not Applicable. -Ensure the application is configured to notify system administrators when accounts are modified by identifying system administrators who will be notified when accounts are modified. +Ensure the application is configured to notify SAs when accounts are modified by identifying the SAs who will be notified when accounts are modified. -Modify a test account and check with a system administrator to verify notification was received. +Modify a test account and check with a SA to verify the notification was received. -If system administrators and ISSOs are not notified when accounts are modified, this is a finding. +If SAs and ISSOs are not notified when accounts are modified, this is a finding. Fix_Text - Configure the application to notify the system administrator and the ISSO when application accounts are modified. + Configure the application to notify the SA and the ISSO when application accounts are modified. False_Positives @@ -4235,7 +4235,7 @@ If system administrators and ISSOs are not notified when accounts are modified, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4243,7 +4243,7 @@ If system administrators and ISSOs are not notified when accounts are modified, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4251,7 +4251,7 @@ If system administrators and ISSOs are not notified when accounts are modified, CCI_REF - CCI-001684 + CCI-000015 LEGACY_ID @@ -4282,7 +4282,7 @@ If system administrators and ISSOs are not notified when accounts are modified, Rule_ID - SV-222419r879671_rule + SV-222419r985911_rule Rule_Ver @@ -4290,13 +4290,13 @@ If system administrators and ISSOs are not notified when accounts are modified, Rule_Title - The application must notify System Administrators and Information System Security Officers of account disabling actions. + The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions. Vuln_Discuss - Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. + Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. -To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. +To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. IA_Controls @@ -4308,17 +4308,17 @@ To address access requirements, many application developers choose to integrate Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. -If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. +If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. -Ensure application is configured to notify system administrators when accounts are disabled by identifying system administrators who will be notified when accounts are disabled. +Ensure the application is configured to notify SAs when accounts are disabled by identifying the SAs who will be notified when accounts are disabled. -Disable a test account and check with a system administrator to verify notification was received. +Disable a test account and check with a SA to verify the notification was received. -If system administrators and ISSOs are not notified when accounts are disabled, this is a finding. +If SAs and ISSOs are not notified when accounts are disabled, this is a finding. Fix_Text - Configure the application to notify the system administrator and the ISSO when application accounts are disabled. + Configure the application to notify the SA and the ISSO when application accounts are disabled. False_Positives @@ -4366,7 +4366,7 @@ If system administrators and ISSOs are not notified when accounts are disabled, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4374,7 +4374,7 @@ If system administrators and ISSOs are not notified when accounts are disabled, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4382,7 +4382,7 @@ If system administrators and ISSOs are not notified when accounts are disabled, CCI_REF - CCI-001685 + CCI-000015 LEGACY_ID @@ -4413,7 +4413,7 @@ If system administrators and ISSOs are not notified when accounts are disabled, Rule_ID - SV-222420r879672_rule + SV-222420r985914_rule Rule_Ver @@ -4421,13 +4421,13 @@ If system administrators and ISSOs are not notified when accounts are disabled, Rule_Title - The application must notify System Administrators and Information System Security Officers of account removal actions. + The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions. Vuln_Discuss - Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. + Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to remove an account. Notification of account removal is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the removal of application user accounts and notifies administrators and ISSOs such accounts no longer exist. This type of process greatly reduces the risk that accounts will be surreptitiously removed and provides logging that can be used for forensic purposes. -To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. +To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. IA_Controls @@ -4439,17 +4439,17 @@ To address access requirements, many application developers choose to integrate Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. -If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. +If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. -Ensure application is configured to notify system administrators when accounts are removed by identifying system administrators who will be notified when accounts are removed. +Ensure the application is configured to notify SAs when accounts are removed by identifying the SAs who will be notified when accounts are removed. -Remove a test account and check with a system administrator to verify notification was received. +Remove a test account and check with a SA to verify the notification was received. -If system administrators and ISSOs are not notified when accounts are removed, this is a finding. +If SAs and ISSOs are not notified when accounts are removed, this is a finding. Fix_Text - Configure the application to notify the system administrator and the ISSO when application accounts are removed. + Configure the application to notify the SA and the ISSO when application accounts are removed. False_Positives @@ -4497,7 +4497,7 @@ If system administrators and ISSOs are not notified when accounts are removed, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4505,7 +4505,7 @@ If system administrators and ISSOs are not notified when accounts are removed, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4513,7 +4513,7 @@ If system administrators and ISSOs are not notified when accounts are removed, t CCI_REF - CCI-001686 + CCI-000015 LEGACY_ID @@ -4544,7 +4544,7 @@ If system administrators and ISSOs are not notified when accounts are removed, t Rule_ID - SV-222421r918115_rule + SV-222421r961290_rule Rule_Ver @@ -4632,7 +4632,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4640,7 +4640,7 @@ At a minimum, ensure account name, date and time of the event are recorded. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4679,7 +4679,7 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_ID - SV-222422r879697_rule + SV-222422r985917_rule Rule_Ver @@ -4687,13 +4687,13 @@ At a minimum, ensure account name, date and time of the event are recorded. Rule_Title - The application must notify System Administrators and Information System Security Officers of account enabling actions. + The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions. Vuln_Discuss - Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply enable an existing account that has been previously disabled. Notification when account enabling actions occur is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the enabling of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. + Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to enable an account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the enabling of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously enabled and provides logging that can be used for forensic purposes. -To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. +To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality. IA_Controls @@ -4705,17 +4705,17 @@ To address access requirements, many application developers choose to integrate Interview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. -If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. +If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. -Ensure application is configured to notify system administrators when accounts are enabled by identifying system administrators who will be notified when accounts are enabled. +Ensure the application is configured to notify SAs when accounts are enabled by identifying the SAs who will be notified when accounts are enabled. -Disable and then enable a test account and check with system administrator to verify notification was received to indicate the account was enabled. +Disable and then enable a test account and check with the SA to verify the notification was received to indicate the account was enabled. -If system administrators and ISSOs are not notified when accounts are enabled, this is a finding. +If SAs and ISSOs are not notified when accounts are enabled, this is a finding. Fix_Text - Configure the application to notify the system administrator and the ISSO when application accounts are enabled. + Configure the application to notify the SA and the ISSO when application accounts are enabled. False_Positives @@ -4763,7 +4763,7 @@ If system administrators and ISSOs are not notified when accounts are enabled, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4771,7 +4771,7 @@ If system administrators and ISSOs are not notified when accounts are enabled, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4779,7 +4779,7 @@ If system administrators and ISSOs are not notified when accounts are enabled, t CCI_REF - CCI-002132 + CCI-000015 LEGACY_ID @@ -4810,7 +4810,7 @@ If system administrators and ISSOs are not notified when accounts are enabled, t Rule_ID - SV-222423r879700_rule + SV-222423r961302_rule Rule_Ver @@ -4892,7 +4892,7 @@ If the application data protection requirements are not documented, this is a fi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -4900,7 +4900,7 @@ If the application data protection requirements are not documented, this is a fi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -4939,7 +4939,7 @@ If the application data protection requirements are not documented, this is a fi Rule_ID - SV-222424r879701_rule + SV-222424r961305_rule Rule_Ver @@ -5035,7 +5035,7 @@ If the application requirements specify protections for data mining and the appl STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5043,7 +5043,7 @@ If the application requirements specify protections for data mining and the appl STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5082,7 +5082,7 @@ If the application requirements specify protections for data mining and the appl Rule_ID - SV-222425r879530_rule + SV-222425r960792_rule Rule_Ver @@ -5188,7 +5188,7 @@ If the enforcement of configured access restrictions is not performed, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5196,7 +5196,7 @@ If the enforcement of configured access restrictions is not performed, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5235,7 +5235,7 @@ If the enforcement of configured access restrictions is not performed, this is a Rule_ID - SV-222426r879705_rule + SV-222426r961317_rule Rule_Ver @@ -5329,7 +5329,7 @@ If the enforcement of configured access restrictions is not performed, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5337,7 +5337,7 @@ If the enforcement of configured access restrictions is not performed, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5376,7 +5376,7 @@ If the enforcement of configured access restrictions is not performed, this is a Rule_ID - SV-222427r879533_rule + SV-222427r960801_rule Rule_Ver @@ -5477,7 +5477,7 @@ If the application does not enforce the approved authorizations for controlling STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5485,7 +5485,7 @@ If the application does not enforce the approved authorizations for controlling STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5524,7 +5524,7 @@ If the application does not enforce the approved authorizations for controlling Rule_ID - SV-222428r879534_rule + SV-222428r960804_rule Rule_Ver @@ -5627,7 +5627,7 @@ If the application does not enforce the approved authorizations for controlling STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5635,7 +5635,7 @@ If the application does not enforce the approved authorizations for controlling STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5674,7 +5674,7 @@ If the application does not enforce the approved authorizations for controlling Rule_ID - SV-222429r879717_rule + SV-222429r961353_rule Rule_Ver @@ -5768,7 +5768,7 @@ The finding details should note the full path of the file(s) and the associated STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5776,7 +5776,7 @@ The finding details should note the full path of the file(s) and the associated STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5815,7 +5815,7 @@ The finding details should note the full path of the file(s) and the associated Rule_ID - SV-222430r879719_rule + SV-222430r961359_rule Rule_Ver @@ -5901,7 +5901,7 @@ If the application user account has excessive OS privileges such as being in the STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -5909,7 +5909,7 @@ If the application user account has excessive OS privileges such as being in the STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -5948,7 +5948,7 @@ If the application user account has excessive OS privileges such as being in the Rule_ID - SV-222431r879720_rule + SV-222431r961362_rule Rule_Ver @@ -6032,7 +6032,7 @@ If the execution of privileged functionality is not logged, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6040,7 +6040,7 @@ If the execution of privileged functionality is not logged, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6079,7 +6079,7 @@ If the execution of privileged functionality is not logged, this is a finding. Rule_ID - SV-222432r879546_rule + SV-222432r960840_rule Rule_Ver @@ -6167,7 +6167,7 @@ If the logon is successful upon the 4th attempt the account was not locked after STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6175,7 +6175,7 @@ If the logon is successful upon the 4th attempt the account was not locked after STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6214,7 +6214,7 @@ If the logon is successful upon the 4th attempt the account was not locked after Rule_ID - SV-222433r879722_rule + SV-222433r961368_rule Rule_Ver @@ -6304,7 +6304,7 @@ Use that process when unlocking application user accounts. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6312,7 +6312,7 @@ Use that process when unlocking application user accounts. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6351,7 +6351,7 @@ Use that process when unlocking application user accounts. Rule_ID - SV-222434r879547_rule + SV-222434r960843_rule Rule_Ver @@ -6453,7 +6453,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6461,7 +6461,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6500,7 +6500,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, Rule_ID - SV-222435r879548_rule + SV-222435r960846_rule Rule_Ver @@ -6580,7 +6580,7 @@ If the banner is not displayed or no action must be taken to accept terms of use STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6588,7 +6588,7 @@ If the banner is not displayed or no action must be taken to accept terms of use STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6627,7 +6627,7 @@ If the banner is not displayed or no action must be taken to accept terms of use Rule_ID - SV-222436r879549_rule + SV-222436r960849_rule Rule_Ver @@ -6725,7 +6725,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6733,7 +6733,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6788,7 +6788,7 @@ If the standard DoD-approved banner is not displayed prior to obtaining access, Rule_ID - SV-222437r879551_rule + SV-222437r987626_rule Rule_Ver @@ -6876,7 +6876,7 @@ If the date and time the user account was last granted access to the application STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -6884,7 +6884,7 @@ If the date and time the user account was last granted access to the application STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -6923,7 +6923,7 @@ If the date and time the user account was last granted access to the application Rule_ID - SV-222438r879554_rule + SV-222438r960864_rule Rule_Ver @@ -7011,7 +7011,7 @@ If the application is required to provide non-repudiation services and does not, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7019,7 +7019,7 @@ If the application is required to provide non-repudiation services and does not, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7058,7 +7058,7 @@ If the application is required to provide non-repudiation services and does not, Rule_ID - SV-222439r879557_rule + SV-222439r960873_rule Rule_Ver @@ -7146,7 +7146,7 @@ If the log dates and times do not correlate when the logs are aggregated, this i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7154,7 +7154,7 @@ If the log dates and times do not correlate when the logs are aggregated, this i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7193,7 +7193,7 @@ If the log dates and times do not correlate when the logs are aggregated, this i Rule_ID - SV-222441r879559_rule + SV-222441r960879_rule Rule_Ver @@ -7283,7 +7283,7 @@ If the application generates session ID creation event logs by default, and that STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7291,7 +7291,7 @@ If the application generates session ID creation event logs by default, and that STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7330,7 +7330,7 @@ If the application generates session ID creation event logs by default, and that Rule_ID - SV-222442r879559_rule + SV-222442r960879_rule Rule_Ver @@ -7414,7 +7414,7 @@ If the application generates audit logs by default when session IDs are destroye STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7422,7 +7422,7 @@ If the application generates audit logs by default when session IDs are destroye STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7461,7 +7461,7 @@ If the application generates audit logs by default when session IDs are destroye Rule_ID - SV-222443r879559_rule + SV-222443r960879_rule Rule_Ver @@ -7559,7 +7559,7 @@ If the application is not configured to log session ID renewal events this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7567,7 +7567,7 @@ If the application is not configured to log session ID renewal events this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7606,7 +7606,7 @@ If the application is not configured to log session ID renewal events this is a Rule_ID - SV-222444r879559_rule + SV-222444r960879_rule Rule_Ver @@ -7694,7 +7694,7 @@ If the application logs sensitive data such as session IDs, application source c STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7702,7 +7702,7 @@ If the application logs sensitive data such as session IDs, application source c STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7741,7 +7741,7 @@ If the application logs sensitive data such as session IDs, application source c Rule_ID - SV-222445r879559_rule + SV-222445r960879_rule Rule_Ver @@ -7841,7 +7841,7 @@ If the session timeout event is not recorded in the logs, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7849,7 +7849,7 @@ If the session timeout event is not recorded in the logs, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -7888,7 +7888,7 @@ If the session timeout event is not recorded in the logs, this is a finding. Rule_ID - SV-222446r879559_rule + SV-222446r960879_rule Rule_Ver @@ -7962,7 +7962,7 @@ If the time the event occurred is not included as part of the event, this is a f STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -7970,7 +7970,7 @@ If the time the event occurred is not included as part of the event, this is a f STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8009,7 +8009,7 @@ If the time the event occurred is not included as part of the event, this is a f Rule_ID - SV-222447r879559_rule + SV-222447r960879_rule Rule_Ver @@ -8109,7 +8109,7 @@ If HTTP headers are not logged, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8117,7 +8117,7 @@ If HTTP headers are not logged, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8156,7 +8156,7 @@ If HTTP headers are not logged, this is a finding. Rule_ID - SV-222448r879559_rule + SV-222448r960879_rule Rule_Ver @@ -8238,7 +8238,7 @@ If the IP addresses of the systems that connect to the application are not recor STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8246,7 +8246,7 @@ If the IP addresses of the systems that connect to the application are not recor STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8285,7 +8285,7 @@ If the IP addresses of the systems that connect to the application are not recor Rule_ID - SV-222449r879559_rule + SV-222449r960879_rule Rule_Ver @@ -8363,7 +8363,7 @@ If the user ID is not recorded along with the event in the event log, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8371,7 +8371,7 @@ If the user ID is not recorded along with the event in the event log, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8410,7 +8410,7 @@ If the user ID is not recorded along with the event in the event log, this is a Rule_ID - SV-222450r879561_rule + SV-222450r960885_rule Rule_Ver @@ -8498,7 +8498,7 @@ If the application does not log when successful and unsuccessful attempts to gra STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8506,7 +8506,7 @@ If the application does not log when successful and unsuccessful attempts to gra STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8545,7 +8545,7 @@ If the application does not log when successful and unsuccessful attempts to gra Rule_ID - SV-222451r879863_rule + SV-222451r961791_rule Rule_Ver @@ -8632,7 +8632,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8640,7 +8640,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8679,7 +8679,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222452r879864_rule + SV-222452r961794_rule Rule_Ver @@ -8765,7 +8765,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8773,7 +8773,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8812,7 +8812,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222453r879865_rule + SV-222453r961797_rule Rule_Ver @@ -8904,7 +8904,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -8912,7 +8912,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -8951,7 +8951,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222454r879866_rule + SV-222454r961800_rule Rule_Ver @@ -9037,7 +9037,7 @@ If the application does not log when successful and unsuccessful attempts to mod STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9045,7 +9045,7 @@ If the application does not log when successful and unsuccessful attempts to mod STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9084,7 +9084,7 @@ If the application does not log when successful and unsuccessful attempts to mod Rule_ID - SV-222455r879867_rule + SV-222455r961803_rule Rule_Ver @@ -9171,7 +9171,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9179,7 +9179,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9218,7 +9218,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222456r879868_rule + SV-222456r961806_rule Rule_Ver @@ -9308,7 +9308,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9316,7 +9316,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9355,7 +9355,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222457r879869_rule + SV-222457r961809_rule Rule_Ver @@ -9447,7 +9447,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9455,7 +9455,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9494,7 +9494,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222458r879870_rule + SV-222458r961812_rule Rule_Ver @@ -9580,7 +9580,7 @@ If the application does not log when successful and unsuccessful attempts to del STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9588,7 +9588,7 @@ If the application does not log when successful and unsuccessful attempts to del STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9627,7 +9627,7 @@ If the application does not log when successful and unsuccessful attempts to del Rule_ID - SV-222459r879871_rule + SV-222459r961815_rule Rule_Ver @@ -9717,7 +9717,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9725,7 +9725,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9764,7 +9764,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222460r879872_rule + SV-222460r961818_rule Rule_Ver @@ -9850,7 +9850,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9858,7 +9858,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -9897,7 +9897,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222461r879873_rule + SV-222461r961821_rule Rule_Ver @@ -9989,7 +9989,7 @@ If the application does not generate an audit record when successful and unsucce STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -9997,7 +9997,7 @@ If the application does not generate an audit record when successful and unsucce STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10036,7 +10036,7 @@ If the application does not generate an audit record when successful and unsucce Rule_ID - SV-222462r879874_rule + SV-222462r961824_rule Rule_Ver @@ -10120,7 +10120,7 @@ If successful and unsuccessful logon events are not recorded in the logs, this i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10128,7 +10128,7 @@ If successful and unsuccessful logon events are not recorded in the logs, this i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10167,7 +10167,7 @@ If successful and unsuccessful logon events are not recorded in the logs, this i Rule_ID - SV-222463r879875_rule + SV-222463r961827_rule Rule_Ver @@ -10249,7 +10249,7 @@ If log events that correspond with the actions performed are not recorded in the STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10257,7 +10257,7 @@ If log events that correspond with the actions performed are not recorded in the STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10296,7 +10296,7 @@ If log events that correspond with the actions performed are not recorded in the Rule_ID - SV-222464r879876_rule + SV-222464r961830_rule Rule_Ver @@ -10374,7 +10374,7 @@ If the start and the end time of the session are not recorded in the logs, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10382,7 +10382,7 @@ If the start and the end time of the session are not recorded in the logs, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10421,7 +10421,7 @@ If the start and the end time of the session are not recorded in the logs, this Rule_ID - SV-222465r879878_rule + SV-222465r961836_rule Rule_Ver @@ -10505,7 +10505,7 @@ If the application does not log application object access, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10513,7 +10513,7 @@ If the application does not log application object access, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10552,7 +10552,7 @@ If the application does not log application object access, this is a finding. Rule_ID - SV-222466r879879_rule + SV-222466r961839_rule Rule_Ver @@ -10643,7 +10643,7 @@ If the application does not log all direct access to the system, this is a findi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10651,7 +10651,7 @@ If the application does not log all direct access to the system, this is a findi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10690,7 +10690,7 @@ If the application does not log all direct access to the system, this is a findi Rule_ID - SV-222467r918117_rule + SV-222467r961842_rule Rule_Ver @@ -10790,7 +10790,7 @@ Findings should document which of the events was not logged. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10798,7 +10798,7 @@ Findings should document which of the events was not logged. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10837,7 +10837,7 @@ Findings should document which of the events was not logged. Rule_ID - SV-222468r879562_rule + SV-222468r960888_rule Rule_Ver @@ -10925,7 +10925,7 @@ If the application does not begin logging events upon start up, this is a findin STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -10933,7 +10933,7 @@ If the application does not begin logging events upon start up, this is a findin STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -10972,7 +10972,7 @@ If the application does not begin logging events upon start up, this is a findin Rule_ID - SV-222469r879563_rule + SV-222469r960891_rule Rule_Ver @@ -11052,7 +11052,7 @@ If the application is not recording application shutdown events in either the ap STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11060,7 +11060,7 @@ If the application is not recording application shutdown events in either the ap STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11099,7 +11099,7 @@ If the application is not recording application shutdown events in either the ap Rule_ID - SV-222470r879563_rule + SV-222470r960891_rule Rule_Ver @@ -11185,7 +11185,7 @@ If the IP address of the remote system is not recorded along with the event in t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11193,7 +11193,7 @@ If the IP address of the remote system is not recorded along with the event in t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11232,7 +11232,7 @@ If the IP address of the remote system is not recorded along with the event in t Rule_ID - SV-222471r879563_rule + SV-222471r960891_rule Rule_Ver @@ -11314,7 +11314,7 @@ If successful access to application data elements is not recorded in the logs, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11322,7 +11322,7 @@ If successful access to application data elements is not recorded in the logs, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11361,7 +11361,7 @@ If successful access to application data elements is not recorded in the logs, t Rule_ID - SV-222472r879563_rule + SV-222472r960891_rule Rule_Ver @@ -11445,7 +11445,7 @@ If successful changes/modifications to application data elements are not recorde STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11453,7 +11453,7 @@ If successful changes/modifications to application data elements are not recorde STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11492,7 +11492,7 @@ If successful changes/modifications to application data elements are not recorde Rule_ID - SV-222473r879564_rule + SV-222473r960894_rule Rule_Ver @@ -11568,7 +11568,7 @@ If the audit logs do not have a corresponding date and time associated with each STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11576,7 +11576,7 @@ If the audit logs do not have a corresponding date and time associated with each STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11615,7 +11615,7 @@ If the audit logs do not have a corresponding date and time associated with each Rule_ID - SV-222474r879565_rule + SV-222474r960897_rule Rule_Ver @@ -11715,7 +11715,7 @@ If the audit logs do not contain enough data in the logs to establish which comp STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11723,7 +11723,7 @@ If the audit logs do not contain enough data in the logs to establish which comp STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11762,7 +11762,7 @@ If the audit logs do not contain enough data in the logs to establish which comp Rule_ID - SV-222475r879566_rule + SV-222475r960900_rule Rule_Ver @@ -11850,7 +11850,7 @@ If the application name and the hosts or client names are not identified, this i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11858,7 +11858,7 @@ If the application name and the hosts or client names are not identified, this i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -11897,7 +11897,7 @@ If the application name and the hosts or client names are not identified, this i Rule_ID - SV-222476r879567_rule + SV-222476r960903_rule Rule_Ver @@ -11983,7 +11983,7 @@ If the application does not produce audit records that contain information regar STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -11991,7 +11991,7 @@ If the application does not produce audit records that contain information regar STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12030,7 +12030,7 @@ If the application does not produce audit records that contain information regar Rule_ID - SV-222477r879568_rule + SV-222477r960906_rule Rule_Ver @@ -12111,7 +12111,7 @@ If the event logs do not include the appropriate identifier or identifiers, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12119,7 +12119,7 @@ If the event logs do not include the appropriate identifier or identifiers, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12158,7 +12158,7 @@ If the event logs do not include the appropriate identifier or identifiers, this Rule_ID - SV-222478r879569_rule + SV-222478r960909_rule Rule_Ver @@ -12246,7 +12246,7 @@ If the application does not log the full text recording of privileged commands o STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12254,7 +12254,7 @@ If the application does not log the full text recording of privileged commands o STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12293,7 +12293,7 @@ If the application does not log the full text recording of privileged commands o Rule_ID - SV-222479r879569_rule + SV-222479r960909_rule Rule_Ver @@ -12371,7 +12371,7 @@ If the application is not configured to utilize transaction logging, this is a f STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12379,7 +12379,7 @@ If the application is not configured to utilize transaction logging, this is a f STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12418,7 +12418,7 @@ If the application is not configured to utilize transaction logging, this is a f Rule_ID - SV-222480r879729_rule + SV-222480r985972_rule Rule_Ver @@ -12444,7 +12444,7 @@ This requirement applies to centralized management applications or similar types Check_Content Review the application documentation and interview the application administrator to determine the logging architecture of the application. -If the application is configured to log application event entries to a centralized, enterprise based logging solution that meets this requirement, the requirement is not applicable. +If the application is configured to log application event entries to a centralized, enterprise based logging solution that meets this requirement, this requirement is Not Applicable. Review the application components and the log management capabilities of the application. @@ -12502,7 +12502,7 @@ If the application does not provide the ability to centrally manage the content STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12510,7 +12510,7 @@ If the application does not provide the ability to centrally manage the content STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12518,7 +12518,7 @@ If the application does not provide the ability to centrally manage the content CCI_REF - CCI-001844 + CCI-000154 LEGACY_ID @@ -12549,7 +12549,7 @@ If the application does not provide the ability to centrally manage the content Rule_ID - SV-222481r879731_rule + SV-222481r961395_rule Rule_Ver @@ -12637,7 +12637,7 @@ If the logs are not automatically moved off the system as per approved schedule, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12645,7 +12645,7 @@ If the logs are not automatically moved off the system as per approved schedule, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12684,7 +12684,7 @@ If the logs are not automatically moved off the system as per approved schedule, Rule_ID - SV-222482r879886_rule + SV-222482r961860_rule Rule_Ver @@ -12766,7 +12766,7 @@ If the system is not configured to write the application logs to the centralized STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12774,7 +12774,7 @@ If the system is not configured to write the application logs to the centralized STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12813,7 +12813,7 @@ If the system is not configured to write the application logs to the centralized Rule_ID - SV-222483r879732_rule + SV-222483r961398_rule Rule_Ver @@ -12899,7 +12899,7 @@ If the application is not configured to send an alarm when storage volume exceed STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -12907,7 +12907,7 @@ If the application is not configured to send an alarm when storage volume exceed STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -12946,7 +12946,7 @@ If the application is not configured to send an alarm when storage volume exceed Rule_ID - SV-222484r879733_rule + SV-222484r961401_rule Rule_Ver @@ -13034,7 +13034,7 @@ Configure the log alerts to be immediately sent to the application admin/SA and STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13042,7 +13042,7 @@ Configure the log alerts to be immediately sent to the application admin/SA and STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13081,7 +13081,7 @@ Configure the log alerts to be immediately sent to the application admin/SA and Rule_ID - SV-222485r879570_rule + SV-222485r960912_rule Rule_Ver @@ -13171,7 +13171,7 @@ If the application is not configured to alarm on alerts that indicate the audit STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13179,7 +13179,7 @@ If the application is not configured to alarm on alerts that indicate the audit STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13218,7 +13218,7 @@ If the application is not configured to alarm on alerts that indicate the audit Rule_ID - SV-222486r879571_rule + SV-222486r960915_rule Rule_Ver @@ -13310,7 +13310,7 @@ If the application does not shut down processing when an audit failure is detect STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13318,7 +13318,7 @@ If the application does not shut down processing when an audit failure is detect STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13357,7 +13357,7 @@ If the application does not shut down processing when an audit failure is detect Rule_ID - SV-222487r879572_rule + SV-222487r960918_rule Rule_Ver @@ -13439,7 +13439,7 @@ If all of the application logs are not reviewable from a central location, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13447,7 +13447,7 @@ If all of the application logs are not reviewable from a central location, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13486,7 +13486,7 @@ If all of the application logs are not reviewable from a central location, this Rule_ID - SV-222488r879574_rule + SV-222488r960924_rule Rule_Ver @@ -13581,7 +13581,7 @@ If the application does not provide the ability to filter audit events, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13589,7 +13589,7 @@ If the application does not provide the ability to filter audit events, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13628,7 +13628,7 @@ If the application does not provide the ability to filter audit events, this is Rule_ID - SV-222489r879618_rule + SV-222489r961056_rule Rule_Ver @@ -13727,7 +13727,7 @@ If the application does not provide on demand reports based on the filtered audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13735,7 +13735,7 @@ If the application does not provide on demand reports based on the filtered audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13774,7 +13774,7 @@ If the application does not provide on demand reports based on the filtered audi Rule_ID - SV-222490r879737_rule + SV-222490r961413_rule Rule_Ver @@ -13873,7 +13873,7 @@ If the application does not provide an audit reduction capability that supports STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -13881,7 +13881,7 @@ If the application does not provide an audit reduction capability that supports STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -13920,7 +13920,7 @@ If the application does not provide an audit reduction capability that supports Rule_ID - SV-222491r879738_rule + SV-222491r961416_rule Rule_Ver @@ -14014,7 +14014,7 @@ If the application does not provide an audit reduction (event filtering) capabil STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14022,7 +14022,7 @@ If the application does not provide an audit reduction (event filtering) capabil STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14061,7 +14061,7 @@ If the application does not provide an audit reduction (event filtering) capabil Rule_ID - SV-222492r879739_rule + SV-222492r961419_rule Rule_Ver @@ -14151,7 +14151,7 @@ If the application does not provide an immediate, ad-hoc audit review and analys STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14159,7 +14159,7 @@ If the application does not provide an immediate, ad-hoc audit review and analys STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14198,7 +14198,7 @@ If the application does not provide an immediate, ad-hoc audit review and analys Rule_ID - SV-222493r879740_rule + SV-222493r961422_rule Rule_Ver @@ -14286,7 +14286,7 @@ If the application does not provide customizable, immediate, ad-hoc audit log re STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14294,7 +14294,7 @@ If the application does not provide customizable, immediate, ad-hoc audit log re STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14333,7 +14333,7 @@ If the application does not provide customizable, immediate, ad-hoc audit log re Rule_ID - SV-222494r879741_rule + SV-222494r961425_rule Rule_Ver @@ -14421,7 +14421,7 @@ If the application does not have a report generation capability that supports af STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14429,7 +14429,7 @@ If the application does not have a report generation capability that supports af STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14468,7 +14468,7 @@ If the application does not have a report generation capability that supports af Rule_ID - SV-222495r879742_rule + SV-222495r961428_rule Rule_Ver @@ -14562,7 +14562,7 @@ If the application of event filters modifies the original log records, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14570,7 +14570,7 @@ If the application of event filters modifies the original log records, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14609,7 +14609,7 @@ If the application of event filters modifies the original log records, this is a Rule_ID - SV-222496r879743_rule + SV-222496r961431_rule Rule_Ver @@ -14703,7 +14703,7 @@ If the application of event filters modifies the original log records, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14711,7 +14711,7 @@ If the application of event filters modifies the original log records, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14750,7 +14750,7 @@ If the application of event filters modifies the original log records, this is a Rule_ID - SV-222497r879575_rule + SV-222497r960927_rule Rule_Ver @@ -14836,7 +14836,7 @@ If the application doesn't use the internal system clocks to generate time stamp STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14844,7 +14844,7 @@ If the application doesn't use the internal system clocks to generate time stamp STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -14883,7 +14883,7 @@ If the application doesn't use the internal system clocks to generate time stamp Rule_ID - SV-222498r879747_rule + SV-222498r961443_rule Rule_Ver @@ -14967,7 +14967,7 @@ If the application is not configured to map to UTC or GMT, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -14975,7 +14975,7 @@ If the application is not configured to map to UTC or GMT, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15014,7 +15014,7 @@ If the application is not configured to map to UTC or GMT, this is a finding. Rule_ID - SV-222499r879748_rule + SV-222499r961446_rule Rule_Ver @@ -15094,7 +15094,7 @@ If the application audit log time stamps differ from the OS time source by more STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15102,7 +15102,7 @@ If the application audit log time stamps differ from the OS time source by more STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15141,7 +15141,7 @@ If the application audit log time stamps differ from the OS time source by more Rule_ID - SV-222500r879576_rule + SV-222500r960930_rule Rule_Ver @@ -15237,7 +15237,7 @@ If a non-privileged user account is allowed to access the audit data or the audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15245,7 +15245,7 @@ If a non-privileged user account is allowed to access the audit data or the audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15284,7 +15284,7 @@ If a non-privileged user account is allowed to access the audit data or the audi Rule_ID - SV-222501r879577_rule + SV-222501r960933_rule Rule_Ver @@ -15380,7 +15380,7 @@ If a non-privileged user account is allowed to modify the audit data or the audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15388,7 +15388,7 @@ If a non-privileged user account is allowed to modify the audit data or the audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15427,7 +15427,7 @@ If a non-privileged user account is allowed to modify the audit data or the audi Rule_ID - SV-222502r879578_rule + SV-222502r960936_rule Rule_Ver @@ -15523,7 +15523,7 @@ If a non-privileged user account is allowed to delete the audit data or the audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15531,7 +15531,7 @@ If a non-privileged user account is allowed to delete the audit data or the audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15570,7 +15570,7 @@ If a non-privileged user account is allowed to delete the audit data or the audi Rule_ID - SV-222503r879579_rule + SV-222503r960939_rule Rule_Ver @@ -15662,7 +15662,7 @@ If a non-privileged user account is allowed to access the audit data or the audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15670,7 +15670,7 @@ If a non-privileged user account is allowed to access the audit data or the audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15709,7 +15709,7 @@ If a non-privileged user account is allowed to access the audit data or the audi Rule_ID - SV-222504r879580_rule + SV-222504r960942_rule Rule_Ver @@ -15799,7 +15799,7 @@ If file permissions are configured so as to allow unapproved modifications to th STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15807,7 +15807,7 @@ If file permissions are configured so as to allow unapproved modifications to th STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15846,7 +15846,7 @@ If file permissions are configured so as to allow unapproved modifications to th Rule_ID - SV-222505r879581_rule + SV-222505r960945_rule Rule_Ver @@ -15936,7 +15936,7 @@ If file permissions are configured to allow unapproved deletions of the audit to STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -15944,7 +15944,7 @@ If file permissions are configured to allow unapproved deletions of the audit to STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -15983,7 +15983,7 @@ If file permissions are configured to allow unapproved deletions of the audit to Rule_ID - SV-222506r879582_rule + SV-222506r960948_rule Rule_Ver @@ -16067,7 +16067,7 @@ If the application backup settings are not configured to backup application audi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16075,7 +16075,7 @@ If the application backup settings are not configured to backup application audi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16114,7 +16114,7 @@ If the application backup settings are not configured to backup application audi Rule_ID - SV-222507r879583_rule + SV-222507r960951_rule Rule_Ver @@ -16200,7 +16200,7 @@ If an integrity check is not created to protect the integrity of the audit infor STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16208,7 +16208,7 @@ If an integrity check is not created to protect the integrity of the audit infor STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16247,7 +16247,7 @@ If an integrity check is not created to protect the integrity of the audit infor Rule_ID - SV-222508r879668_rule + SV-222508r961206_rule Rule_Ver @@ -16343,7 +16343,7 @@ If a cryptographic checksum or hash value of the audit tool file is not created STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16351,7 +16351,7 @@ If a cryptographic checksum or hash value of the audit tool file is not created STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16390,7 +16390,7 @@ If a cryptographic checksum or hash value of the audit tool file is not created Rule_ID - SV-222509r879668_rule + SV-222509r961206_rule Rule_Ver @@ -16480,7 +16480,7 @@ If a cryptographic checksum or hash value of the audit tool file is not periodic STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16488,7 +16488,7 @@ If a cryptographic checksum or hash value of the audit tool file is not periodic STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16527,7 +16527,7 @@ If a cryptographic checksum or hash value of the audit tool file is not periodic Rule_ID - SV-222510r879751_rule + SV-222510r985919_rule Rule_Ver @@ -16539,13 +16539,13 @@ If a cryptographic checksum or hash value of the audit tool file is not periodic Vuln_Discuss - Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. + Allowing regular users to install software without explicit privileges creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. Application functionality will vary, and while users are not permitted to install unapproved applications, there may be instances where the organization allows the user to install approved software packages such as from an approved software repository. The application must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. -This requirement applies, for example, to applications that provide the ability to extend application functionality (e.g., plug-ins, add-ons) and software management applications. +For example, this requirement applies to applications that provide the ability to extend application functionality (e.g., plug-ins, add-ons) and software management applications. IA_Controls @@ -16555,9 +16555,9 @@ This requirement applies, for example, to applications that provide the ability Check_Content Review the application documentation and interview the application administrator to determine the capabilities of the application as it relates to software installation or product function extension. -Identify any software configuration change capabilities which are allowed by design and incorporated into the user interface. An example is utilizing a known software repository of tested and approved extensions, plugins or modules which can be used by application users to extend application features or functions. +Identify any software configuration change capabilities which are allowed by design and incorporated into the user interface. An example is utilizing a known software repository of tested and approved extensions, plugins, or modules which can be used by application users to extend application features or functions. -If the application does not provide the ability to install software components, modules, plugins, or extensions, the requirement is not applicable. +If the application does not provide the ability to install software components, modules, plugins, or extensions, the requirement is Not Applicable. Access the application user interface as a regular user, navigate to the application screen that provides the software installation function and attempt to install software components, modules, extensions, or plugins. @@ -16615,7 +16615,7 @@ If the application allows regular users to install untested or unapproved softwa STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16623,7 +16623,7 @@ If the application allows regular users to install untested or unapproved softwa STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16631,7 +16631,7 @@ If the application allows regular users to install untested or unapproved softwa CCI_REF - CCI-001812 + CCI-000366 LEGACY_ID @@ -16662,7 +16662,7 @@ If the application allows regular users to install untested or unapproved softwa Rule_ID - SV-222511r879753_rule + SV-222511r961461_rule Rule_Ver @@ -16750,7 +16750,7 @@ If access permissions to configuration files are not restricted to application a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16758,7 +16758,7 @@ If access permissions to configuration files are not restricted to application a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16797,7 +16797,7 @@ If access permissions to configuration files are not restricted to application a Rule_ID - SV-222512r879754_rule + SV-222512r985920_rule Rule_Ver @@ -16811,7 +16811,7 @@ If access permissions to configuration files are not restricted to application a Vuln_Discuss Without auditing the enforcement of access restrictions against changes to the application configuration, it will be difficult to identify attempted attacks and an audit trail will not be available for forensic investigation for after-the-fact actions. -Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after-the-fact. +Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact. If application configuration is maintained by using a text editor to modify a configuration file, this function may be delegated to an operating system file monitoring/auditing capability. @@ -16885,7 +16885,7 @@ If the user account used to make the changes is not logged in the audit records, STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -16893,7 +16893,7 @@ If the user account used to make the changes is not logged in the audit records, STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -16901,7 +16901,7 @@ If the user account used to make the changes is not logged in the audit records, CCI_REF - CCI-001814 + CCI-000366 LEGACY_ID @@ -16932,7 +16932,7 @@ If the user account used to make the changes is not logged in the audit records, Rule_ID - SV-222513r879584_rule + SV-222513r985922_rule Rule_Ver @@ -16948,7 +16948,7 @@ If the user account used to make the changes is not logged in the audit records, Accordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization. -Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA. +Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DOD certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA). If this capability is not present, the vendor must provide a cryptographic hash value that can be verified by a system administrator prior to installation. @@ -17018,7 +17018,7 @@ Provide a cryptographic hash value that can be verified by a system administrato STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17026,7 +17026,7 @@ Provide a cryptographic hash value that can be verified by a system administrato STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17034,7 +17034,7 @@ Provide a cryptographic hash value that can be verified by a system administrato CCI_REF - CCI-001749 + CCI-000366 LEGACY_ID @@ -17065,7 +17065,7 @@ Provide a cryptographic hash value that can be verified by a system administrato Rule_ID - SV-222514r879586_rule + SV-222514r960960_rule Rule_Ver @@ -17151,7 +17151,7 @@ If file restrictions do not limit write access to library files and if the appli STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17159,7 +17159,7 @@ If file restrictions do not limit write access to library files and if the appli STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17198,7 +17198,7 @@ If file restrictions do not limit write access to library files and if the appli Rule_ID - SV-222515r879887_rule + SV-222515r961863_rule Rule_Ver @@ -17303,7 +17303,7 @@ If the high risk issues identified in the report have not been fixed or mitigate STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17311,7 +17311,7 @@ If the high risk issues identified in the report have not been fixed or mitigate STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17350,7 +17350,7 @@ If the high risk issues identified in the report have not been fixed or mitigate Rule_ID - SV-222516r879757_rule + SV-222516r961473_rule Rule_Ver @@ -17434,7 +17434,7 @@ If application requirements or policy documents specify application execution re STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17442,7 +17442,7 @@ If application requirements or policy documents specify application execution re STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17481,7 +17481,7 @@ If application requirements or policy documents specify application execution re Rule_ID - SV-222517r879759_rule + SV-222517r961479_rule Rule_Ver @@ -17567,7 +17567,7 @@ If application whitelisting is not utilized or does not follow a deny-all, permi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17575,7 +17575,7 @@ If application whitelisting is not utilized or does not follow a deny-all, permi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17614,7 +17614,7 @@ If application whitelisting is not utilized or does not follow a deny-all, permi Rule_ID - SV-222518r879587_rule + SV-222518r960963_rule Rule_Ver @@ -17700,7 +17700,7 @@ If the application is operating with extraneous capabilities that have not been STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17708,7 +17708,7 @@ If the application is operating with extraneous capabilities that have not been STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17747,7 +17747,7 @@ If the application is operating with extraneous capabilities that have not been Rule_ID - SV-222519r918119_rule + SV-222519r960966_rule Rule_Ver @@ -17837,7 +17837,7 @@ If the ports are not approved by the PPSM CAL, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17845,7 +17845,7 @@ If the ports are not approved by the PPSM CAL, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -17884,7 +17884,7 @@ If the ports are not approved by the PPSM CAL, this is a finding. Rule_ID - SV-222520r879762_rule + SV-222520r987687_rule Rule_Ver @@ -17910,7 +17910,7 @@ In addition to the reauthentication requirements associated with session locks, or (vi) Periodically. -Within the DoD, the minimum circumstances requiring reauthentication are privilege escalation and role changes. +Within the DOD, the minimum circumstances requiring reauthentication are privilege escalation and role changes. IA_Controls @@ -17924,7 +17924,7 @@ Identify the application user roles. Identify the methods and manner in which an application user is allowed to escalate their privileges or change their role. -Create or utilize an account that has 2 roles within the application, both should be non-administrator. +Create or utilize an account that has two roles within the application, both should be nonadministrator. Example: User role and Report Creator role. Authenticate to the application as the user in the User role. @@ -17991,7 +17991,7 @@ If the user is not prompted to reauthenticate before the user is allowed to proc STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -17999,7 +17999,7 @@ If the user is not prompted to reauthenticate before the user is allowed to proc STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18007,7 +18007,7 @@ If the user is not prompted to reauthenticate before the user is allowed to proc CCI_REF - CCI-002038 + CCI-000366 LEGACY_ID @@ -18038,7 +18038,7 @@ If the user is not prompted to reauthenticate before the user is allowed to proc Rule_ID - SV-222521r879763_rule + SV-222521r985974_rule Rule_Ver @@ -18073,7 +18073,7 @@ Gateways and SOA applications are examples of where this requirement would apply Check_Content Review the application guidance and interview the application administrator. -Identify the methods and manner in which application devices such as an XML gateway, SOA application gateway, or application firewall is allowed to access the application. Most devices themselves will not change role or authenticators once they are established but will need to periodically re-authenticate. +Identify the methods and manner in which application devices such as an XML gateway, SOA application gateway, or application firewall is allowed to access the application. Most devices themselves will not change role or authenticators once they are established but will need to periodically reauthenticate. Review the configuration setting in the application where the time period is set to force the device to reauthenticate. @@ -18131,7 +18131,7 @@ If the device is not forced to reauthenticate periodically, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18139,7 +18139,7 @@ If the device is not forced to reauthenticate periodically, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18147,7 +18147,7 @@ If the device is not forced to reauthenticate periodically, this is a finding. CCI_REF - CCI-002039 + CCI-002038 LEGACY_ID @@ -18178,7 +18178,7 @@ If the device is not forced to reauthenticate periodically, this is a finding. Rule_ID - SV-222522r879589_rule + SV-222522r960969_rule Rule_Ver @@ -18265,7 +18265,7 @@ If the application does not uniquely identify and authenticate users, this is a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18273,7 +18273,7 @@ If the application does not uniquely identify and authenticate users, this is a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18312,7 +18312,7 @@ If the application does not uniquely identify and authenticate users, this is a Rule_ID - SV-222523r879590_rule + SV-222523r960972_rule Rule_Ver @@ -18405,7 +18405,7 @@ If the application allows administrative access to the application without requi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18413,7 +18413,7 @@ If the application allows administrative access to the application without requi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18452,7 +18452,7 @@ If the application allows administrative access to the application without requi Rule_ID - SV-222524r879764_rule + SV-222524r961494_rule Rule_Ver @@ -18534,7 +18534,7 @@ If the application allows access without requiring a CAC, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18542,7 +18542,7 @@ If the application allows access without requiring a CAC, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18581,7 +18581,7 @@ If the application allows access without requiring a CAC, this is a finding. Rule_ID - SV-222525r879765_rule + SV-222525r961497_rule Rule_Ver @@ -18667,7 +18667,7 @@ If the application allows access without requiring a CAC, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18675,7 +18675,7 @@ If the application allows access without requiring a CAC, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18714,7 +18714,7 @@ If the application allows access without requiring a CAC, this is a finding. Rule_ID - SV-222526r879591_rule + SV-222526r960975_rule Rule_Ver @@ -18810,7 +18810,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18818,7 +18818,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18857,7 +18857,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is Rule_ID - SV-222527r879592_rule + SV-222527r985926_rule Rule_Ver @@ -18869,16 +18869,16 @@ If the application allows access without requiring a CAC or Alt. Token, this is Vuln_Discuss - Multifactor authentication requires using two or more factors to achieve authentication and access. + Multifactor authentication (MFA) requires using two or more factors to achieve authentication and access. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). -Multifactor authentication decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user's password to obtain access. +MFA decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user's password to obtain access. -A privileged account is defined as an information system account with authorizations of a privileged user. +A privileged account is defined as an information system account with authorizations of a privileged user. An Alt. Token is a separate CAC or token used specifically for administrative account access and serves as a separate identifier much like a separate user account. @@ -18892,13 +18892,13 @@ Local access is defined as access to an organizational information system by a u Check_Content Review the application documentation and interview the application administrator to identify application access methods. -Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administrator to log on to the application using the local application console. +Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administrator to log on to the application using the local application console. -Attempt to use both the CAC and Alt. Tokens to authenticate to the application. +Attempt to use both the CAC and Alt. Tokens to authenticate to the application. Validate the application requests the user to input their CAC PIN and that they cannot perform administrative functions. -Have user logoff and reauthenticate with their Alt. Token and that they can perform administrative functions. +Have user log off and reauthenticate with their Alt. Token and verify they can perform administrative functions. If the application allows administrative access to the application without requiring an Alt. Token, this is a finding. @@ -18952,7 +18952,7 @@ If the application allows administrative access to the application without requi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -18960,7 +18960,7 @@ If the application allows administrative access to the application without requi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -18968,7 +18968,7 @@ If the application allows administrative access to the application without requi CCI_REF - CCI-000767 + CCI-000765 LEGACY_ID @@ -18999,7 +18999,7 @@ If the application allows administrative access to the application without requi Rule_ID - SV-222528r879593_rule + SV-222528r985929_rule Rule_Ver @@ -19007,24 +19007,24 @@ If the application allows administrative access to the application without requi Rule_Title - The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to non-privileged accounts. + The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts. Vuln_Discuss - To assure accountability, prevent unauthenticated access, and prevent misuse of the system, privileged users must utilize multifactor authentication for local access. + To assure accountability, prevent unauthenticated access, and prevent misuse of the system, privileged users must utilize multifactor authentication (MFA) for local access. -Multifactor authentication is defined as: using two or more factors to achieve authentication. +MFA is defined as using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). -A non-privileged account is defined as an information system account with authorizations of a regular or non-privileged user. +A nonprivileged account is defined as an information system account with authorizations of a regular or nonprivileged user. Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. -Applications integrating with the DoD Active Directory and utilize the DoD CAC are examples of compliant multifactor authentication solutions. +Applications integrating with the DOD Active Directory and utilize the DOD CAC are examples of compliant multifactor authentication solutions. IA_Controls @@ -19034,9 +19034,9 @@ Applications integrating with the DoD Active Directory and utilize the DoD CAC a Check_Content Review the application documentation and interview the application administrator to identify application access methods. -If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. +If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. -Ask the application administrator to log on to the application. Have the application admin use their non-privileged credentials. +Ask the application administrator to log on to the application. Have the application admin use their nonprivileged credentials. Validate the application prompts the user to provide a certificate from the CAC. @@ -19046,7 +19046,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is Fix_Text - Configure the application to require CAC or Alt. Token authentication for non-privileged network access. + Configure the application to require CAC or Alt. Token authentication for nonprivileged network access. False_Positives @@ -19094,7 +19094,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19102,7 +19102,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19110,7 +19110,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is CCI_REF - CCI-000768 + CCI-000766 LEGACY_ID @@ -19141,7 +19141,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is Rule_ID - SV-222529r879594_rule + SV-222529r985931_rule Rule_Ver @@ -19153,7 +19153,7 @@ If the application allows access without requiring a CAC or Alt. Token, this is Vuln_Discuss - To assure individual accountability and prevent unauthorized access, application users must be individually identified and authenticated. Individual accountability mandates that each user is uniquely identified. + To ensure individual accountability and prevent unauthorized access, application users must be individually identified and authenticated. Individual accountability mandates that each user is uniquely identified. A group authenticator is a shared account or some other form of authentication that allows multiple unique individuals to access the application using a single account. @@ -19169,9 +19169,9 @@ There may also be instances when specific user actions need to be performed on t Check_Content - Review the application documentation, examine user accounts, group membership and interview the application administrator to identify group or shared accounts. Document the group or shared account information. + Review the application documentation, examine user accounts and group membership, and interview the application administrator to identify group or shared accounts. Document the group or shared account information. -If the application does not use group or shared accounts, this requirement is not applicable. +If the application does not use group or shared accounts, this requirement is Not Applicable. Create a test account or use an existing group member account. @@ -19229,7 +19229,7 @@ If the application allows access without first requiring the group member to aut STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19237,7 +19237,7 @@ If the application allows access without first requiring the group member to aut STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19245,7 +19245,7 @@ If the application allows access without first requiring the group member to aut CCI_REF - CCI-000770 + CCI-000366 LEGACY_ID @@ -19276,7 +19276,7 @@ If the application allows access without first requiring the group member to aut Rule_ID - SV-222530r879597_rule + SV-222530r960993_rule Rule_Ver @@ -19374,7 +19374,7 @@ If the application is not implementing replay-resistant authentication methods a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19382,7 +19382,7 @@ If the application is not implementing replay-resistant authentication methods a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19421,7 +19421,7 @@ If the application is not implementing replay-resistant authentication methods a Rule_ID - SV-222531r879598_rule + SV-222531r985934_rule Rule_Ver @@ -19429,7 +19429,7 @@ If the application is not implementing replay-resistant authentication methods a Rule_Title - The application must implement replay-resistant authentication mechanisms for network access to non-privileged accounts. + The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts. Vuln_Discuss @@ -19439,9 +19439,9 @@ The protection methods selected to protect against a replay attack will vary acc An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. -A non-privileged account is any operating system account with authorizations of a non-privileged user. +A nonprivileged account is any operating system account with authorizations of a nonprivileged user. -Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS, WS_Security) and PKI certificates. Additional techniques include time-synchronous or challenge-response one-time authenticators. +Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use), challenges (e.g., TLS, WS_Security), and PKI certificates. Additional techniques include time-synchronous or challenge-response one-time authenticators. IA_Controls @@ -19451,9 +19451,9 @@ Techniques used to address this include protocols using nonces (e.g., numbers ge Check_Content Review the application documentation and interview the application administrator to identify what authentication mechanisms are used when accessing the application. -If the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DoD CAC as per DoD 8520, this requirement is not applicable. +If the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DOD CAC as per DOD 8520, this requirement is Not Applicable. -Review to ensure the application is utilizing TLSV1.2 or greater to protect communication and non-privileged user authentication traffic. +Review to ensure the application is utilizing TLSV1.2 or greater to protect communication and nonprivileged user authentication traffic. Verify the application utilizes a strong authentication mechanism such as Kerberos, IPSEC, or Secure Shell (SSH). @@ -19473,7 +19473,7 @@ If the application is not implementing replay-resistant authentication methods a Fix_Text - Design and configure the application to utilize replay-resistant mechanisms when authenticating non-privileged accounts. + Design and configure the application to utilize replay-resistant mechanisms when authenticating nonprivileged accounts. False_Positives @@ -19521,7 +19521,7 @@ If the application is not implementing replay-resistant authentication methods a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19529,7 +19529,7 @@ If the application is not implementing replay-resistant authentication methods a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19537,7 +19537,7 @@ If the application is not implementing replay-resistant authentication methods a CCI_REF - CCI-001942 + CCI-001941 LEGACY_ID @@ -19568,7 +19568,7 @@ If the application is not implementing replay-resistant authentication methods a Rule_ID - SV-222532r879599_rule + SV-222532r960999_rule Rule_Ver @@ -19673,7 +19673,7 @@ If SSL mutual authentication is required and is not being utilized, this is a fi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19681,7 +19681,7 @@ If SSL mutual authentication is required and is not being utilized, this is a fi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19720,7 +19720,7 @@ If SSL mutual authentication is required and is not being utilized, this is a fi Rule_ID - SV-222533r879767_rule + SV-222533r961503_rule Rule_Ver @@ -19815,7 +19815,7 @@ If no authentication mechanism is used to authenticate remote service consumers/ STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19823,7 +19823,7 @@ If no authentication mechanism is used to authenticate remote service consumers/ STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -19862,7 +19862,7 @@ If no authentication mechanism is used to authenticate remote service consumers/ Rule_ID - SV-222534r879768_rule + SV-222534r961506_rule Rule_Ver @@ -19964,7 +19964,7 @@ If SSL/TLS mutual authentication is required due to the application processing n STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -19972,7 +19972,7 @@ If SSL/TLS mutual authentication is required due to the application processing n STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20011,7 +20011,7 @@ If SSL/TLS mutual authentication is required due to the application processing n Rule_ID - SV-222535r879600_rule + SV-222535r985937_rule Rule_Ver @@ -20023,17 +20023,17 @@ If SSL/TLS mutual authentication is required due to the application processing n Vuln_Discuss - Device identifiers are used to identify hardware devices that interact with the application much like a user account is used to identify an application user. Examples of hardware devices include but are not limited to mobile phones, application gateways or other types of smart hardware. + Device identifiers are used to identify hardware devices that interact with the application much like a user account is used to identify an application user. Examples of hardware devices include but are not limited to mobile phones, application gateways, or other types of smart hardware. -This requirement does not apply to individual application user accounts. +This requirement does not apply to individual application user accounts. -This requirement is not applicable to shared information system accounts, application groups, roles (e.g., guest and anonymous accounts) that are used by the application itself in order to function. Care must be taken to not disable identifiers that are used by the application in order to function. +This requirement is not applicable to shared information system accounts, application groups, or roles (e.g., guest and anonymous accounts) that are used by the application itself in order to function. Care must be taken to not disable identifiers that are used by the application in order to function. -Inactive device identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application. +Inactive device identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application. -Applications need to track periods of device inactivity and disable the device identifier after 35 days of inactivity. This is usually accomplished by disabling the account used by the device to access the application. +Applications need to track periods of device inactivity and disable the device identifier after 35 days of inactivity. This is usually accomplished by disabling the account used by the device to access the application. -Applications that utilize cryptographic certificates for device authentication may use the expiration date assigned to the certificate to meet this requirement with the understanding that the certificate is created and managed in accordance with DoD PKI policy and can be revoked by a trusted CA. +Applications that use cryptographic certificates for device authentication may use the expiration date assigned to the certificate to meet this requirement with the understanding that the certificate is created and managed in accordance with DOD PKI policy and can be revoked by a trusted certificate authority (CA). To avoid having to build complex device management capabilities directly into their application, developers should leverage the underlying OS or other account management infrastructure (AD, LDAP) that is already in place within the organization and meets organizational user account management requirements. @@ -20047,7 +20047,7 @@ Applications are encouraged to utilize a centralized data store such as Active D Check_Content Review the application documentation and interview the application administrator. -If the application is not designed to authenticate devices (such as mobile phones, gateways or other smart devices), or uses DoD PKI certificates to authenticate these devices, this requirement is NA. +If the application is not designed to authenticate devices (such as mobile phones, gateways or other smart devices), or uses DOD PKI certificates to authenticate these devices, this requirement is Not Applicable. Access the user management interface for the application. @@ -20065,7 +20065,7 @@ If the application does not disable accounts used to authenticate devices after Fix_Text - Configure the application to disable device accounts after 35 days of inactivity or to utilize DoD PKI certificates that provide an expiration date. + Configure the application to disable device accounts after 35 days of inactivity or to utilize DOD PKI certificates that provide an expiration date. False_Positives @@ -20113,7 +20113,7 @@ If the application does not disable accounts used to authenticate devices after STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20121,7 +20121,7 @@ If the application does not disable accounts used to authenticate devices after STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20129,7 +20129,7 @@ If the application does not disable accounts used to authenticate devices after CCI_REF - CCI-000795 + CCI-000366 LEGACY_ID @@ -20160,7 +20160,7 @@ If the application does not disable accounts used to authenticate devices after Rule_ID - SV-222536r879601_rule + SV-222536r985939_rule Rule_Ver @@ -20178,12 +20178,8 @@ Use of passwords for application authentication is intended only for limited sit Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. @@ -20198,9 +20194,9 @@ Use of more characters in a password helps to exponentially increase the time an Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. -Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. +Access the application management interface and create a test user account or log on to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to create a password shorter than 15 characters in length. @@ -20256,7 +20252,7 @@ If a password shorter than 15 characters can be created, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20264,7 +20260,7 @@ If a password shorter than 15 characters can be created, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20272,7 +20268,7 @@ If a password shorter than 15 characters can be created, this is a finding. CCI_REF - CCI-000205 + CCI-000366 LEGACY_ID @@ -20303,7 +20299,7 @@ If a password shorter than 15 characters can be created, this is a finding. Rule_ID - SV-222537r879603_rule + SV-222537r985942_rule Rule_Ver @@ -20311,7 +20307,7 @@ If a password shorter than 15 characters can be created, this is a finding. Rule_Title - The application must enforce password complexity by requiring that at least one upper-case character be used. + The application must enforce password complexity by requiring that at least one uppercase character be used. Vuln_Discuss @@ -20319,12 +20315,8 @@ If a password shorter than 15 characters can be created, this is a finding.Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. -When prompted to provide the password, attempt to create a password that does not have one upper-case character. +When prompted to provide the password, attempt to create a password that does not have one uppercase character. If a password without at least one upper-case character can be created, this is a finding. Fix_Text - Configure the application to require at least one upper-case character in the password. + Configure the application to require at least one uppercase character in the password. False_Positives @@ -20397,7 +20389,7 @@ If a password without at least one upper-case character can be created, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20405,7 +20397,7 @@ If a password without at least one upper-case character can be created, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20413,7 +20405,7 @@ If a password without at least one upper-case character can be created, this is CCI_REF - CCI-000192 + CCI-000366 LEGACY_ID @@ -20444,7 +20436,7 @@ If a password without at least one upper-case character can be created, this is Rule_ID - SV-222538r879604_rule + SV-222538r985945_rule Rule_Ver @@ -20452,7 +20444,7 @@ If a password without at least one upper-case character can be created, this is Rule_Title - The application must enforce password complexity by requiring that at least one lower-case character be used. + The application must enforce password complexity by requiring that at least one lowercase character be used. Vuln_Discuss @@ -20460,12 +20452,8 @@ If a password without at least one upper-case character can be created, this is Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. @@ -20480,17 +20468,17 @@ Password complexity is one factor of several that determine how long it takes to Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. -When prompted to provide the password, attempt to create a password that does not have one lower-case character. +When prompted to provide the password, attempt to create a password that does not have one lowercase character. If a password without at least one lower-case character can be created, this is a finding. Fix_Text - Configure the application to require at least one lower-case character in the password. + Configure the application to require at least one lowercase character in the password. False_Positives @@ -20538,7 +20526,7 @@ If a password without at least one lower-case character can be created, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20546,7 +20534,7 @@ If a password without at least one lower-case character can be created, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20554,7 +20542,7 @@ If a password without at least one lower-case character can be created, this is CCI_REF - CCI-000193 + CCI-000366 LEGACY_ID @@ -20585,7 +20573,7 @@ If a password without at least one lower-case character can be created, this is Rule_ID - SV-222539r879605_rule + SV-222539r985947_rule Rule_Ver @@ -20601,12 +20589,8 @@ If a password without at least one lower-case character can be created, this is Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. @@ -20621,7 +20605,7 @@ Password complexity is one factor of several that determine how long it takes to Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. @@ -20679,7 +20663,7 @@ If a password without at least one numeric character can be created, this is a f STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20687,7 +20671,7 @@ If a password without at least one numeric character can be created, this is a f STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20695,7 +20679,7 @@ If a password without at least one numeric character can be created, this is a f CCI_REF - CCI-000194 + CCI-000366 LEGACY_ID @@ -20726,7 +20710,7 @@ If a password without at least one numeric character can be created, this is a f Rule_ID - SV-222540r879606_rule + SV-222540r985949_rule Rule_Ver @@ -20742,12 +20726,8 @@ If a password without at least one numeric character can be created, this is a f Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. @@ -20762,7 +20742,7 @@ Password complexity is one factor of several that determine how long it takes to Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. @@ -20820,7 +20800,7 @@ If a password without at least one special character can be created, this is a f STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20828,7 +20808,7 @@ If a password without at least one special character can be created, this is a f STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20836,7 +20816,7 @@ If a password without at least one special character can be created, this is a f CCI_REF - CCI-001619 + CCI-000366 LEGACY_ID @@ -20867,7 +20847,7 @@ If a password without at least one special character can be created, this is a f Rule_ID - SV-222541r879607_rule + SV-222541r985952_rule Rule_Ver @@ -20875,7 +20855,7 @@ If a password without at least one special character can be created, this is a f Rule_Title - The application must require the change of at least 8 of the total number of characters when passwords are changed. + The application must require the change of at least eight of the total number of characters when passwords are changed. Vuln_Discuss @@ -20883,12 +20863,8 @@ If a password without at least one special character can be created, this is a f Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. @@ -20903,7 +20879,7 @@ Password complexity is one factor of several that determine how long it takes to Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. @@ -20913,7 +20889,7 @@ If less than 8 characters of the password are changed, this is a finding. Fix_Text - Configure the application to require the change of at least 8 characters in the password when passwords are changed. + Configure the application to require the change of at least eight characters in the password when passwords are changed. False_Positives @@ -20961,7 +20937,7 @@ If less than 8 characters of the password are changed, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -20969,7 +20945,7 @@ If less than 8 characters of the password are changed, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -20977,7 +20953,7 @@ If less than 8 characters of the password are changed, this is a finding. CCI_REF - CCI-000195 + CCI-000366 LEGACY_ID @@ -21008,7 +20984,7 @@ If less than 8 characters of the password are changed, this is a finding. Rule_ID - SV-222542r879608_rule + SV-222542r985954_rule Rule_Ver @@ -21024,19 +21000,15 @@ If less than 8 characters of the password are changed, this is a finding. @@ -21059,11 +21031,11 @@ Applications must only store passwords that have been cryptographically protecte Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. -Have the application administrator identify the application's password storage locations. Potential locations include the local file system where the application is stored or in an application-related database table that should not be accessible to application users. +Have the application administrator identify the application's password storage locations. Potential locations include the local file system where the application is stored or in an application-related database table that should not be accessible to application users. -Review application files and folders using a text editor or by using a database tool that allows you to view data stored in database tables. Look for indications of stored user information and review that information. Determine if password strings are readable/discernable. +Review application files and folders using a text editor or by using a database tool that allows you to view data stored in database tables. Look for indications of stored user information and review that information. Determine if password strings are readable/discernable. Determine if the application uses the MD5 hashing algorithm to create password hashes. @@ -21123,7 +21095,7 @@ Ensure strong access control permissions on data files containing authentication STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21131,7 +21103,7 @@ Ensure strong access control permissions on data files containing authentication STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21139,7 +21111,7 @@ Ensure strong access control permissions on data files containing authentication CCI_REF - CCI-000196 + CCI-000366 LEGACY_ID @@ -21170,7 +21142,7 @@ Ensure strong access control permissions on data files containing authentication Rule_ID - SV-222543r879609_rule + SV-222543r961029_rule Rule_Ver @@ -21268,7 +21240,7 @@ If the passwords are not encrypted when being transmitted, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21276,7 +21248,7 @@ If the passwords are not encrypted when being transmitted, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21315,7 +21287,7 @@ If the passwords are not encrypted when being transmitted, this is a finding. Rule_ID - SV-222544r879610_rule + SV-222544r985956_rule Rule_Ver @@ -21331,12 +21303,8 @@ If the passwords are not encrypted when being transmitted, this is a finding.Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. @@ -21409,7 +21377,7 @@ If a password can be changed more than once within 24 hours, the minimum lifetim STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21417,7 +21385,7 @@ If a password can be changed more than once within 24 hours, the minimum lifetim STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21425,7 +21393,7 @@ If a password can be changed more than once within 24 hours, the minimum lifetim CCI_REF - CCI-000198 + CCI-000366 LEGACY_ID @@ -21456,7 +21424,7 @@ If a password can be changed more than once within 24 hours, the minimum lifetim Rule_ID - SV-222545r879611_rule + SV-222545r985958_rule Rule_Ver @@ -21472,12 +21440,8 @@ If a password can be changed more than once within 24 hours, the minimum lifetim Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. @@ -21494,7 +21458,7 @@ This requirement does not include emergency administration accounts which are me Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. @@ -21552,7 +21516,7 @@ If user passwords are not configured to expire after 60 days, or if the applicat STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21560,7 +21524,7 @@ If user passwords are not configured to expire after 60 days, or if the applicat STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21568,7 +21532,7 @@ If user passwords are not configured to expire after 60 days, or if the applicat CCI_REF - CCI-000199 + CCI-000366 LEGACY_ID @@ -21599,7 +21563,7 @@ If user passwords are not configured to expire after 60 days, or if the applicat Rule_ID - SV-222546r879602_rule + SV-222546r985961_rule Rule_Ver @@ -21615,12 +21579,8 @@ If user passwords are not configured to expire after 60 days, or if the applicat Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. @@ -21637,17 +21597,17 @@ If the information system or application allows the user to consecutively reuse Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. -Review user password settings and validate the application is configured to prohibit password reuse for a minimum of 5 password generations. +Review user password settings and validate the application is configured to prohibit password reuse for a minimum of five password generations. -If the application does not prevent users from reusing their previous 5 passwords, or if the application does not have the ability to control this setting, this is a finding. +If the application does not prevent users from reusing their previous five passwords, or if the application does not have the ability to control this setting, this is a finding. Fix_Text - Configure the application to prohibit password reuse for up to 5 passwords. + Configure the application to prohibit password reuse for up to five passwords. False_Positives @@ -21695,7 +21655,7 @@ If the application does not prevent users from reusing their previous 5 password STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21703,7 +21663,7 @@ If the application does not prevent users from reusing their previous 5 password STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21711,7 +21671,7 @@ If the application does not prevent users from reusing their previous 5 password CCI_REF - CCI-000200 + CCI-000366 LEGACY_ID @@ -21742,7 +21702,7 @@ If the application does not prevent users from reusing their previous 5 password Rule_ID - SV-222547r879770_rule + SV-222547r985976_rule Rule_Ver @@ -21758,15 +21718,11 @@ If the application does not prevent users from reusing their previous 5 password Examples of situations where a user ID and password might be used include but are not limited to: -- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor. - +- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor. - When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - -and - - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. -Without providing this capability, an account may be created without a password. Non-repudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon. +Without providing this capability, an account may be created without a password. Nonrepudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon. Temporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts which allow the users to log on, yet force them to change the password once they have successfully authenticated. @@ -21778,7 +21734,7 @@ Temporary passwords are typically used to allow access to applications when new Check_Content Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. -If the application does not use passwords, the requirement is not applicable. +If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. @@ -21836,7 +21792,7 @@ If the application can not specify a password as temporary and force the user to STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21844,7 +21800,7 @@ If the application can not specify a password as temporary and force the user to STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -21852,7 +21808,7 @@ If the application can not specify a password as temporary and force the user to CCI_REF - CCI-002041 + CCI-000366 LEGACY_ID @@ -21883,7 +21839,7 @@ If the application can not specify a password as temporary and force the user to Rule_ID - SV-222548r879887_rule + SV-222548r961863_rule Rule_Ver @@ -21981,7 +21937,7 @@ Ensure users are only allowed to change their own passwords. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -21989,7 +21945,7 @@ Ensure users are only allowed to change their own passwords. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22028,7 +21984,7 @@ Ensure users are only allowed to change their own passwords. Rule_ID - SV-222549r879773_rule + SV-222549r961521_rule Rule_Ver @@ -22114,7 +22070,7 @@ If the test user retains access after the test account has been deleted, this is STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22122,7 +22078,7 @@ If the test user retains access after the test account has been deleted, this is STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22161,7 +22117,7 @@ If the test user retains access after the test account has been deleted, this is Rule_ID - SV-222550r879612_rule + SV-222550r961038_rule Rule_Ver @@ -22247,7 +22203,7 @@ If the application does not construct a certificate path to an accepted trust an STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22255,7 +22211,7 @@ If the application does not construct a certificate path to an accepted trust an STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22294,7 +22250,7 @@ If the application does not construct a certificate path to an accepted trust an Rule_ID - SV-222551r879613_rule + SV-222551r961041_rule Rule_Ver @@ -22386,7 +22342,7 @@ If unauthorized access is granted to the private key(s), this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22394,7 +22350,7 @@ If unauthorized access is granted to the private key(s), this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22433,7 +22389,7 @@ If unauthorized access is granted to the private key(s), this is a finding. Rule_ID - SV-222552r879614_rule + SV-222552r961044_rule Rule_Ver @@ -22513,7 +22469,7 @@ If the application does not map the certificate data to an individual user or gr STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22521,7 +22477,7 @@ If the application does not map the certificate data to an individual user or gr STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22560,7 +22516,7 @@ If the application does not map the certificate data to an individual user or gr Rule_ID - SV-222553r879774_rule + SV-222553r985964_rule Rule_Ver @@ -22572,7 +22528,7 @@ If the application does not map the certificate data to an individual user or gr Vuln_Discuss - A local cache of revocation data is also known as a CRL list. This list contains a list of revoked certificates and can be periodically downloaded to ensure certificates can still be checked for revocation when network access is not available or access to the Online Certificate Status Protocol OCSP server is not available. + A local cache of revocation data is also known as a CRL list. This list contains a list of revoked certificates and can be periodically downloaded to ensure certificates can still be checked for revocation when network access is not available or access to the Online Certificate Status Protocol (OCSP) server is not available. Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates). @@ -22584,7 +22540,7 @@ Without configuring a local cache of revocation data, there is the potential to Check_Content Review the application documentation and interview the system administrator to identify how the application checks certificate revocation. -If the application resides on the SIPRNET and does not have access to the root CAs this requirement is not applicable. +If the application resides on the SIPRnet and does not have access to the root CAs, this requirement is Not Applicable. Different application frameworks may handle this requirement for the developer or the developer may have chosen to implement their own implementation for managing and implementing the CRL. @@ -22598,7 +22554,7 @@ If the application is not configured to implement a CRL, this is a finding. Fix_Text - Implement a Certificate Revocation List (CRL) import process and configure the application to check the CRL if OCSP is not available. + Implement a CRL import process and configure the application to check the CRL if OCSP is not available. False_Positives @@ -22646,7 +22602,7 @@ If the application is not configured to implement a CRL, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22654,7 +22610,7 @@ If the application is not configured to implement a CRL, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22662,7 +22618,7 @@ If the application is not configured to implement a CRL, this is a finding. CCI_REF - CCI-001991 + CCI-000366 LEGACY_ID @@ -22693,7 +22649,7 @@ If the application is not configured to implement a CRL, this is a finding. Rule_ID - SV-222554r879615_rule + SV-222554r961047_rule Rule_Ver @@ -22783,7 +22739,7 @@ Design the application so obfuscated passwords cannot be copied and then pasted STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22791,7 +22747,7 @@ Design the application so obfuscated passwords cannot be copied and then pasted STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22830,7 +22786,7 @@ Design the application so obfuscated passwords cannot be copied and then pasted Rule_ID - SV-222555r879616_rule + SV-222555r961050_rule Rule_Ver @@ -22916,7 +22872,7 @@ If the cryptographic module that requires authentication is not on the FIPS-appr STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -22924,7 +22880,7 @@ If the cryptographic module that requires authentication is not on the FIPS-appr STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -22963,7 +22919,7 @@ If the cryptographic module that requires authentication is not on the FIPS-appr Rule_ID - SV-222556r879617_rule + SV-222556r961053_rule Rule_Ver @@ -23049,7 +23005,7 @@ If the application does not identify and authenticate non-organizational users a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23057,7 +23013,7 @@ If the application does not identify and authenticate non-organizational users a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23096,7 +23052,7 @@ If the application does not identify and authenticate non-organizational users a Rule_ID - SV-222557r879775_rule + SV-222557r961527_rule Rule_Ver @@ -23180,7 +23136,7 @@ If the application is required to provide authenticated access to Federal agenci STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23188,7 +23144,7 @@ If the application is required to provide authenticated access to Federal agenci STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23227,7 +23183,7 @@ If the application is required to provide authenticated access to Federal agenci Rule_ID - SV-222558r879776_rule + SV-222558r961530_rule Rule_Ver @@ -23311,7 +23267,7 @@ If the application is required to provide authenticated access to Federal agenci STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23319,7 +23275,7 @@ If the application is required to provide authenticated access to Federal agenci STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23358,7 +23314,7 @@ If the application is required to provide authenticated access to Federal agenci Rule_ID - SV-222559r879777_rule + SV-222559r985967_rule Rule_Ver @@ -23366,18 +23322,18 @@ If the application is required to provide authenticated access to Federal agenci Rule_Title - The application must accept FICAM-approved third-party credentials. + The application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials. Vuln_Discuss - FICAM establishes a federated identity framework for the Federal Government. FICAM provides Government-wide services for common Identity, Credential and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government. - The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the Government. + FICAM establishes a federated identity framework for the federal government. FICAM provides government-wide services for common Identity, Credential and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government. + The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the government. -A Trust Framework that is comparable to federal standards is adopted through this process, which allows Federal Government Relying Parties (Federal Government web sites or RP's) to trust Credential Service Providers a.k.a. Identity Providers that have been assessed under that particular trust framework. This allows federal government relying parties to trust such credentials at their approved assurance levels. +A Trust Framework that is comparable to federal standards is adopted through this process, which allows federal government Relying Parties (Federal Government websites or RP's) to trust Credential Service Providers (a.k.a. Identity Providers) that have been assessed under that particular trust framework. This allows federal government relying parties to trust such credentials at their approved assurance levels. -This requirement only applies to applications that are intended to be accessible to non-federal government agencies and other partners through FICAM. +This requirement only applies to applications that are intended to be accessible to nonfederal government agencies and other partners through FICAM. -Third-party credentials are those credentials issued by non-federal government entities approved by the Federal Identity, Credential, and Access Management (FICAM) Trust Framework Solutions initiative. +Third-party credentials are those credentials issued by nonfederal government entities approved by the FICAM TFS initiative. IA_Controls @@ -23387,19 +23343,19 @@ Third-party credentials are those credentials issued by non-federal government e Check_Content Review the application documentation and interview the application administrator to identify application access methods. -If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. +If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. -If the application is only deployed to SIPRNet, this requirement is not applicable. +If the application is only deployed to SIPRNet, this requirement is Not Applicable. -If the application is not intended to be available to Federal government partners this requirement is not applicable. +If the application is not intended to be available to federal government partners this requirement is Not Applicable. Ask the application administrator to demonstrate how the application is configured to allow the use of third-party credentials, verify the third-party credentials are FICAM approved. -If the application does not accept FICAM approved credentials when accepting third-party credentials, this is a finding. +If the application does not accept FICAM-approved credentials when accepting third-party credentials, this is a finding. Fix_Text - Configure applications intended to be accessible to non-federal government agencies to use FICAM-approved third-party credentials. + Configure applications intended to be accessible to nonfederal government agencies to use FICAM-approved third-party credentials. False_Positives @@ -23447,7 +23403,7 @@ If the application does not accept FICAM approved credentials when accepting thi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23455,7 +23411,7 @@ If the application does not accept FICAM approved credentials when accepting thi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23463,7 +23419,7 @@ If the application does not accept FICAM approved credentials when accepting thi CCI_REF - CCI-002011 + CCI-000366 LEGACY_ID @@ -23494,7 +23450,7 @@ If the application does not accept FICAM approved credentials when accepting thi Rule_ID - SV-222560r879778_rule + SV-222560r985970_rule Rule_Ver @@ -23502,18 +23458,18 @@ If the application does not accept FICAM approved credentials when accepting thi Rule_Title - The application must conform to FICAM-issued profiles. + The application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles. Vuln_Discuss - FICAM establishes a federated identity framework for the Federal Government. FICAM provides Government-wide services for common Identity, Credential, and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government. - The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the Government. + FICAM establishes a federated identity framework for the federal government. FICAM provides government-wide services for common Identity, Credential, and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government. + The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the government. -This requirement only applies to applications that are intended to be accessible to non-federal government agencies and other partners or non-organizational (non-DoD) users. +This requirement only applies to applications that are intended to be accessible to nonfederal government agencies and other partners or nonorganizational (non-DOD) users. Without conforming to FICAM-issued profiles, the information system may not be interoperable with FICAM-authentication protocols, such as SAML 2.0, OpenID 2.0 or other protocols such as the FICAM backend Attribute Exchange. -This requirement addresses open identity management standards. More information regarding these standards is available by pointing your web browser to: info.idmanagement.gov/2012/10/what-are-ficam-technical-profiles-and.html +This requirement addresses open identity management standards. More information regarding these standards is available here: info.idmanagement.gov/2012/10/what-are-ficam-technical-profiles-and.html IA_Controls @@ -23523,21 +23479,21 @@ This requirement addresses open identity management standards. More information Check_Content Review the application documentation and interview the application administrator to identify application access methods. -If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. +If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. -If the application is only deployed to SIPRNet, this requirement is not applicable. +If the application is only deployed to SIPRnet, this requirement is Not Applicable. -If the application is not intended to be available to Federal government partners this requirement is not applicable. +If the application is not intended to be available to federal government partners this requirement is Not Applicable. -This requirement applies to DoD service providers who are relying parties of external (Federal Government) identity providers. +This requirement applies to DOD service providers who are relying parties of external (federal government) identity providers. -Ask the application administrator to demonstrate how the application conforms to FICAM issued profiles such as SAML or OPENID. +Ask the application administrator to demonstrate how the application conforms to FICAM issued profiles such as SAML or OPENID. If the application is designed to be a service provider utilizing an external identify provider and doesn't conform to FICAM-issued profiles, this is a finding. Fix_Text - Configure the application to conform to FICAM-issued technical profiles when providing services that rely on external (Federal Government) identity providers. + Configure the application to conform to FICAM-issued technical profiles when providing services that rely on external (federal government) identity providers. False_Positives @@ -23585,7 +23541,7 @@ If the application is designed to be a service provider utilizing an external id STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23593,7 +23549,7 @@ If the application is designed to be a service provider utilizing an external id STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23601,7 +23557,7 @@ If the application is designed to be a service provider utilizing an external id CCI_REF - CCI-002014 + CCI-000366 LEGACY_ID @@ -23632,7 +23588,7 @@ If the application is designed to be a service provider utilizing an external id Rule_ID - SV-222561r879782_rule + SV-222561r961548_rule Rule_Ver @@ -23722,7 +23678,7 @@ If the application provides maintenance functions and capabilities and those fun STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23730,7 +23686,7 @@ If the application provides maintenance functions and capabilities and those fun STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23769,7 +23725,7 @@ If the application provides maintenance functions and capabilities and those fun Rule_ID - SV-222562r879784_rule + SV-222562r961554_rule Rule_Ver @@ -23859,7 +23815,7 @@ If the application provides remote access to maintenance functions and capabilit STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -23867,7 +23823,7 @@ If the application provides remote access to maintenance functions and capabilit STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -23906,7 +23862,7 @@ If the application provides remote access to maintenance functions and capabilit Rule_ID - SV-222563r879785_rule + SV-222563r961557_rule Rule_Ver @@ -23994,7 +23950,7 @@ If the application provides remote access to maintenance functions and capabilit STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24002,7 +23958,7 @@ If the application provides remote access to maintenance functions and capabilit STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24041,7 +23997,7 @@ If the application provides remote access to maintenance functions and capabilit Rule_ID - SV-222564r879786_rule + SV-222564r961560_rule Rule_Ver @@ -24147,7 +24103,7 @@ If the application provides remote access to maintenance functions and capabilit STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24155,7 +24111,7 @@ If the application provides remote access to maintenance functions and capabilit STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24194,7 +24150,7 @@ If the application provides remote access to maintenance functions and capabilit Rule_ID - SV-222565r879620_rule + SV-222565r961062_rule Rule_Ver @@ -24288,7 +24244,7 @@ If a CAC is not used when remotely accessing the application for maintenance or STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24296,7 +24252,7 @@ If a CAC is not used when remotely accessing the application for maintenance or STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24335,7 +24291,7 @@ If a CAC is not used when remotely accessing the application for maintenance or Rule_ID - SV-222566r879621_rule + SV-222566r985978_rule Rule_Ver @@ -24343,13 +24299,13 @@ If a CAC is not used when remotely accessing the application for maintenance or Rule_Title - The application must terminate all sessions and network connections when non-local maintenance is completed. + The application must terminate all sessions and network connections when nonlocal maintenance is completed. Vuln_Discuss If a maintenance session or connection remains open after maintenance is completed, it may be hijacked by an attacker and used to compromise or damage the system. -Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. +Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. This requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system (e.g., the software implementing "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch). @@ -24361,11 +24317,11 @@ This requirement applies to hardware/software diagnostic test equipment or tools Check_Content Review the application documentation and interview the system administrator to determine how the application is configured to terminate network sessions after sessions have been idle for a period of time. Identify any documented exceptions. -If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. +If the application does not provide nonlocal maintenance and diagnostic capability, this requirement is Not Applicable. For privileged management sessions the period of time is 10 minutes of inactivity. -For regular user or non-privileged sessions, the period of time is 15 minutes of inactivity. +For regular user or nonprivileged sessions, the period of time is 15 minutes of inactivity. Authenticate to the application using normal in-band access methods and as an application admin. @@ -24427,7 +24383,7 @@ If the application does not deny access after each user session has exceeded the STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24435,7 +24391,7 @@ If the application does not deny access after each user session has exceeded the STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24443,7 +24399,7 @@ If the application does not deny access after each user session has exceeded the CCI_REF - CCI-000879 + CCI-000366 LEGACY_ID @@ -24474,7 +24430,7 @@ If the application does not deny access after each user session has exceeded the Rule_ID - SV-222567r879887_rule + SV-222567r961863_rule Rule_Ver @@ -24568,7 +24524,7 @@ Validate that variable values do not change while a switch event is occurring. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24576,7 +24532,7 @@ Validate that variable values do not change while a switch event is occurring. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24619,7 +24575,7 @@ Validate that variable values do not change while a switch event is occurring. Rule_ID - SV-222568r879622_rule + SV-222568r961068_rule Rule_Ver @@ -24715,7 +24671,7 @@ If exceptions are documented with no mitigation this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24723,7 +24679,7 @@ If exceptions are documented with no mitigation this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24762,7 +24718,7 @@ If exceptions are documented with no mitigation this is a finding. Rule_ID - SV-222570r879885_rule + SV-222570r961857_rule Rule_Ver @@ -24850,7 +24806,7 @@ If the application signing process does not use FIPS validated cryptographic mod STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24858,7 +24814,7 @@ If the application signing process does not use FIPS validated cryptographic mod STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -24897,7 +24853,7 @@ If the application signing process does not use FIPS validated cryptographic mod Rule_ID - SV-222571r879885_rule + SV-222571r961857_rule Rule_Ver @@ -24983,7 +24939,7 @@ If FIPS-validated cryptographic modules are not used when generating hashes or i STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -24991,7 +24947,7 @@ If FIPS-validated cryptographic modules are not used when generating hashes or i STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25030,7 +24986,7 @@ If FIPS-validated cryptographic modules are not used when generating hashes or i Rule_ID - SV-222572r879885_rule + SV-222572r961857_rule Rule_Ver @@ -25110,7 +25066,7 @@ If the application is using cryptographic modules that are not FIPS-validated to STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25118,7 +25074,7 @@ If the application is using cryptographic modules that are not FIPS-validated to STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25157,7 +25113,7 @@ If the application is using cryptographic modules that are not FIPS-validated to Rule_ID - SV-222573r879885_rule + SV-222573r961857_rule Rule_Ver @@ -25241,7 +25197,7 @@ If the application is using cryptographic modules that are not FIPS-validated wh STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25249,7 +25205,7 @@ If the application is using cryptographic modules that are not FIPS-validated wh STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25288,7 +25244,7 @@ If the application is using cryptographic modules that are not FIPS-validated wh Rule_ID - SV-222574r879631_rule + SV-222574r961095_rule Rule_Ver @@ -25370,7 +25326,7 @@ If the application user interface and the application management interface are s STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25378,7 +25334,7 @@ If the application user interface and the application management interface are s STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25417,7 +25373,7 @@ If the application user interface and the application management interface are s Rule_ID - SV-222575r879636_rule + SV-222575r961110_rule Rule_Ver @@ -25519,7 +25475,7 @@ If the application does not set the HTTPOnly flag on session cookies or if the a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25527,7 +25483,7 @@ If the application does not set the HTTPOnly flag on session cookies or if the a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25566,7 +25522,7 @@ If the application does not set the HTTPOnly flag on session cookies or if the a Rule_ID - SV-222576r879636_rule + SV-222576r961110_rule Rule_Ver @@ -25659,7 +25615,7 @@ If the "secure" flag is not set on the session cookie, or if the vulnerability s STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25667,7 +25623,7 @@ If the "secure" flag is not set on the session cookie, or if the vulnerability s STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25706,7 +25662,7 @@ If the "secure" flag is not set on the session cookie, or if the vulnerability s Rule_ID - SV-222577r879636_rule + SV-222577r961110_rule Rule_Ver @@ -25796,7 +25752,7 @@ If the session IDs are unencrypted across network segments, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25804,7 +25760,7 @@ If the session IDs are unencrypted across network segments, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25843,7 +25799,7 @@ If the session IDs are unencrypted across network segments, this is a finding. Rule_ID - SV-222578r879637_rule + SV-222578r961113_rule Rule_Ver @@ -25927,7 +25883,7 @@ If the session IDs and associated cookies are not destroyed on logoff or browser STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -25935,7 +25891,7 @@ If the session IDs and associated cookies are not destroyed on logoff or browser STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -25974,7 +25930,7 @@ If the session IDs and associated cookies are not destroyed on logoff or browser Rule_ID - SV-222579r879638_rule + SV-222579r961116_rule Rule_Ver @@ -26062,7 +26018,7 @@ If the session testing results indicate application session IDs are re-used afte STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26070,7 +26026,7 @@ If the session testing results indicate application session IDs are re-used afte STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26109,7 +26065,7 @@ If the session testing results indicate application session IDs are re-used afte Rule_ID - SV-222580r879638_rule + SV-222580r961116_rule Rule_Ver @@ -26187,7 +26143,7 @@ If the application is not configured to validate user session identifiers, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26195,7 +26151,7 @@ If the application is not configured to validate user session identifiers, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26234,7 +26190,7 @@ If the application is not configured to validate user session identifiers, this Rule_ID - SV-222581r879638_rule + SV-222581r961116_rule Rule_Ver @@ -26320,7 +26276,7 @@ If the framework or the application is configured to transmit cookies within the STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26328,7 +26284,7 @@ If the framework or the application is configured to transmit cookies within the STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26367,7 +26323,7 @@ If the framework or the application is configured to transmit cookies within the Rule_ID - SV-222582r879638_rule + SV-222582r961116_rule Rule_Ver @@ -26457,7 +26413,7 @@ If the session testing results indicate application session IDs are re-used afte STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26465,7 +26421,7 @@ If the session testing results indicate application session IDs are re-used afte STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26504,7 +26460,7 @@ If the session testing results indicate application session IDs are re-used afte Rule_ID - SV-222583r879639_rule + SV-222583r961119_rule Rule_Ver @@ -26592,7 +26548,7 @@ If the application does not use FIPS 140-2-approved encryption algorithms, this STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26600,7 +26556,7 @@ If the application does not use FIPS 140-2-approved encryption algorithms, this STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26639,7 +26595,7 @@ If the application does not use FIPS 140-2-approved encryption algorithms, this Rule_ID - SV-222584r879798_rule + SV-222584r961596_rule Rule_Ver @@ -26731,7 +26687,7 @@ If the application utilizes PKI certificates other than DoD-approved PKI and ECA STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26739,7 +26695,7 @@ If the application utilizes PKI certificates other than DoD-approved PKI and ECA STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26778,7 +26734,7 @@ If the application utilizes PKI certificates other than DoD-approved PKI and ECA Rule_ID - SV-222585r879640_rule + SV-222585r961122_rule Rule_Ver @@ -26880,7 +26836,7 @@ If the application fails in such a way that the application security controls ar STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -26888,7 +26844,7 @@ If the application fails in such a way that the application security controls ar STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -26927,7 +26883,7 @@ If the application fails in such a way that the application security controls ar Rule_ID - SV-222586r879641_rule + SV-222586r961125_rule Rule_Ver @@ -27007,7 +26963,7 @@ If the application does not log the data required to determine root cause of app STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27015,7 +26971,7 @@ If the application does not log the data required to determine root cause of app STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27054,7 +27010,7 @@ If the application does not log the data required to determine root cause of app Rule_ID - SV-222587r879642_rule + SV-222587r961128_rule Rule_Ver @@ -27146,7 +27102,7 @@ If the application processes classified data or if the data owner has specified STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27154,7 +27110,7 @@ If the application processes classified data or if the data owner has specified STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27193,7 +27149,7 @@ If the application processes classified data or if the data owner has specified Rule_ID - SV-222588r879799_rule + SV-222588r961599_rule Rule_Ver @@ -27285,7 +27241,7 @@ Encrypt data according to DoD policy or data owner requirements. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27293,7 +27249,7 @@ Encrypt data according to DoD policy or data owner requirements. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27332,7 +27288,7 @@ Encrypt data according to DoD policy or data owner requirements. Rule_ID - SV-222589r879800_rule + SV-222589r961602_rule Rule_Ver @@ -27426,7 +27382,7 @@ Encrypt classified data using Type 1, Suite B, or other NSA-approved encryption STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27434,7 +27390,7 @@ Encrypt classified data using Type 1, Suite B, or other NSA-approved encryption STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27473,7 +27429,7 @@ Encrypt classified data using Type 1, Suite B, or other NSA-approved encryption Rule_ID - SV-222590r879643_rule + SV-222590r961131_rule Rule_Ver @@ -27557,7 +27513,7 @@ If the application does not protect security functions that enforce security pol STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27565,7 +27521,7 @@ If the application does not protect security functions that enforce security pol STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27604,7 +27560,7 @@ If the application does not protect security functions that enforce security pol Rule_ID - SV-222591r879802_rule + SV-222591r961608_rule Rule_Ver @@ -27684,7 +27640,7 @@ If the application does not maintain a separate execution domain for each execut STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27692,7 +27648,7 @@ If the application does not maintain a separate execution domain for each execut STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27731,7 +27687,7 @@ If the application does not maintain a separate execution domain for each execut Rule_ID - SV-222592r879649_rule + SV-222592r961149_rule Rule_Ver @@ -27813,7 +27769,7 @@ If the application does not prevent unauthorized and unintended information tran STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27821,7 +27777,7 @@ If the application does not prevent unauthorized and unintended information tran STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -27860,7 +27816,7 @@ If the application does not prevent unauthorized and unintended information tran Rule_ID - SV-222593r879806_rule + SV-222593r961620_rule Rule_Ver @@ -27960,7 +27916,7 @@ If the application administrator cannot demonstrate how these protections are im STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -27968,7 +27924,7 @@ If the application administrator cannot demonstrate how these protections are im STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28007,7 +27963,7 @@ If the application administrator cannot demonstrate how these protections are im Rule_ID - SV-222594r879650_rule + SV-222594r961152_rule Rule_Ver @@ -28099,7 +28055,7 @@ If the test results indicate the application is susceptible to DoS attacks or ca STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28107,7 +28063,7 @@ If the test results indicate the application is susceptible to DoS attacks or ca STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28146,7 +28102,7 @@ If the test results indicate the application is susceptible to DoS attacks or ca Rule_ID - SV-222595r879651_rule + SV-222595r961155_rule Rule_Ver @@ -28238,7 +28194,7 @@ If the application has been designated as high availability but the architecture STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28246,7 +28202,7 @@ If the application has been designated as high availability but the architecture STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28285,7 +28241,7 @@ If the application has been designated as high availability but the architecture Rule_ID - SV-222596r879810_rule + SV-222596r961632_rule Rule_Ver @@ -28377,7 +28333,7 @@ If the application does not utilize TLS, IPsec or other approved encryption mech STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28385,7 +28341,7 @@ If the application does not utilize TLS, IPsec or other approved encryption mech STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28424,7 +28380,7 @@ If the application does not utilize TLS, IPsec or other approved encryption mech Rule_ID - SV-222597r879811_rule + SV-222597r961635_rule Rule_Ver @@ -28514,7 +28470,7 @@ If the application is not configured to provide cryptographic protections to app STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28522,7 +28478,7 @@ If the application is not configured to provide cryptographic protections to app STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28561,7 +28517,7 @@ If the application is not configured to provide cryptographic protections to app Rule_ID - SV-222598r879812_rule + SV-222598r961638_rule Rule_Ver @@ -28643,7 +28599,7 @@ If the application does not utilize TLS to protect the confidentiality and integ STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28651,7 +28607,7 @@ If the application does not utilize TLS to protect the confidentiality and integ STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28690,7 +28646,7 @@ If the application does not utilize TLS to protect the confidentiality and integ Rule_ID - SV-222599r879813_rule + SV-222599r961641_rule Rule_Ver @@ -28772,7 +28728,7 @@ If the application does not utilize TLS to protect the confidentiality and integ STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28780,7 +28736,7 @@ If the application does not utilize TLS to protect the confidentiality and integ STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28819,7 +28775,7 @@ If the application does not utilize TLS to protect the confidentiality and integ Rule_ID - SV-222600r879812_rule + SV-222600r961638_rule Rule_Ver @@ -28905,7 +28861,7 @@ If the application displays any application technical data such as database vers STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -28913,7 +28869,7 @@ If the application displays any application technical data such as database vers STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -28952,7 +28908,7 @@ If the application displays any application technical data such as database vers Rule_ID - SV-222601r879812_rule + SV-222601r961638_rule Rule_Ver @@ -29036,7 +28992,7 @@ Encrypt sensitive information stored in hidden fields using DoD-approved encrypt STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29044,7 +29000,7 @@ Encrypt sensitive information stored in hidden fields using DoD-approved encrypt STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29083,7 +29039,7 @@ Encrypt sensitive information stored in hidden fields using DoD-approved encrypt Rule_ID - SV-222602r879652_rule + SV-222602r961158_rule Rule_Ver @@ -29190,7 +29146,7 @@ Develop your application using a web template system or a web application develo STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29198,7 +29154,7 @@ Develop your application using a web template system or a web application develo STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29237,7 +29193,7 @@ Develop your application using a web template system or a web application develo Rule_ID - SV-222603r879652_rule + SV-222603r961158_rule Rule_Ver @@ -29327,7 +29283,7 @@ If application scan results show an unremediated CSRF vulnerability, or if no sc STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29335,7 +29291,7 @@ If application scan results show an unremediated CSRF vulnerability, or if no sc STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29374,7 +29330,7 @@ If application scan results show an unremediated CSRF vulnerability, or if no sc Rule_ID - SV-222604r879652_rule + SV-222604r961158_rule Rule_Ver @@ -29480,7 +29436,7 @@ If testing results are not provided demonstrating the vulnerability does not exi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29488,7 +29444,7 @@ If testing results are not provided demonstrating the vulnerability does not exi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29527,7 +29483,7 @@ If testing results are not provided demonstrating the vulnerability does not exi Rule_ID - SV-222605r879652_rule + SV-222605r961158_rule Rule_Ver @@ -29635,7 +29591,7 @@ Security checks should be carried out after decoding is completed. Moreover, it STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29643,7 +29599,7 @@ Security checks should be carried out after decoding is completed. Moreover, it STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29682,7 +29638,7 @@ Security checks should be carried out after decoding is completed. Moreover, it Rule_ID - SV-222606r879652_rule + SV-222606r961158_rule Rule_Ver @@ -29782,7 +29738,7 @@ If test results include input validation errors, or if no test results exist, th STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29790,7 +29746,7 @@ If test results include input validation errors, or if no test results exist, th STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29829,7 +29785,7 @@ If test results include input validation errors, or if no test results exist, th Rule_ID - SV-222607r879652_rule + SV-222607r961158_rule Rule_Ver @@ -29931,7 +29887,7 @@ If the application is vulnerable to SQL injection attack, contains SQL injection STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -29939,7 +29895,7 @@ If the application is vulnerable to SQL injection attack, contains SQL injection STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -29978,7 +29934,7 @@ If the application is vulnerable to SQL injection attack, contains SQL injection Rule_ID - SV-222608r879652_rule + SV-222608r961158_rule Rule_Ver @@ -30076,7 +30032,7 @@ Patch the application components when vulnerabilities are discovered. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30084,7 +30040,7 @@ Patch the application components when vulnerabilities are discovered. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30123,7 +30079,7 @@ Patch the application components when vulnerabilities are discovered. Rule_ID - SV-222609r879818_rule + SV-222609r961656_rule Rule_Ver @@ -30239,7 +30195,7 @@ Remediate identified vulnerabilities and obtain documented risk acceptance for t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30247,7 +30203,7 @@ Remediate identified vulnerabilities and obtain documented risk acceptance for t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30286,7 +30242,7 @@ Remediate identified vulnerabilities and obtain documented risk acceptance for t Rule_ID - SV-222610r879655_rule + SV-222610r961167_rule Rule_Ver @@ -30372,7 +30328,7 @@ Use generic error messages. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30380,7 +30336,7 @@ Use generic error messages. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30419,7 +30375,7 @@ Use generic error messages. Rule_ID - SV-222611r879656_rule + SV-222611r961170_rule Rule_Ver @@ -30509,7 +30465,7 @@ Use generic error messages for non-privileged users. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30517,7 +30473,7 @@ Use generic error messages for non-privileged users. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30556,7 +30512,7 @@ Use generic error messages for non-privileged users. Rule_ID - SV-222612r879821_rule + SV-222612r961665_rule Rule_Ver @@ -30654,7 +30610,7 @@ Patch applications when overflows are identified in vendor products. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30662,7 +30618,7 @@ Patch applications when overflows are identified in vendor products. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30701,7 +30657,7 @@ Patch applications when overflows are identified in vendor products. Rule_ID - SV-222613r879825_rule + SV-222613r961677_rule Rule_Ver @@ -30779,7 +30735,7 @@ If old versions of the application or components are still installed on the syst STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30787,7 +30743,7 @@ If old versions of the application or components are still installed on the syst STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30826,7 +30782,7 @@ If old versions of the application or components are still installed on the syst Rule_ID - SV-222614r879827_rule + SV-222614r961683_rule Rule_Ver @@ -30910,7 +30866,7 @@ If application updates are not checked on at least on a weekly basis and applied STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -30918,7 +30874,7 @@ If application updates are not checked on at least on a weekly basis and applied STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -30957,7 +30913,7 @@ If application updates are not checked on at least on a weekly basis and applied Rule_ID - SV-222615r879843_rule + SV-222615r961731_rule Rule_Ver @@ -31041,7 +30997,7 @@ If the application is designed to perform security function testing and does not STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31049,7 +31005,7 @@ If the application is designed to perform security function testing and does not STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31088,7 +31044,7 @@ If the application is designed to perform security function testing and does not Rule_ID - SV-222616r879844_rule + SV-222616r961734_rule Rule_Ver @@ -31174,7 +31130,7 @@ If the application is designed to perform security function testing and does not STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31182,7 +31138,7 @@ If the application is designed to perform security function testing and does not STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31221,7 +31177,7 @@ If the application is designed to perform security function testing and does not Rule_ID - SV-222617r879661_rule + SV-222617r961185_rule Rule_Ver @@ -31311,7 +31267,7 @@ If the application is designed to perform security function testing and does not STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31319,7 +31275,7 @@ If the application is designed to perform security function testing and does not STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31358,7 +31314,7 @@ If the application is designed to perform security function testing and does not Rule_ID - SV-222618r879627_rule + SV-222618r961083_rule Rule_Ver @@ -31456,7 +31412,7 @@ If the code has not been signed or the application warns that a control cannot b STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31464,7 +31420,7 @@ If the code has not been signed or the application warns that a control cannot b STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31503,7 +31459,7 @@ If the code has not been signed or the application warns that a control cannot b Rule_ID - SV-222619r879887_rule + SV-222619r961863_rule Rule_Ver @@ -31579,7 +31535,7 @@ If a documented account management process does not exist or unauthorized users STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31587,7 +31543,7 @@ If a documented account management process does not exist or unauthorized users STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31626,7 +31582,7 @@ If a documented account management process does not exist or unauthorized users Rule_ID - SV-222620r879887_rule + SV-222620r961863_rule Rule_Ver @@ -31735,7 +31691,7 @@ If the application is tiered and the network infrastructure hosting the applicat STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31743,7 +31699,7 @@ If the application is tiered and the network infrastructure hosting the applicat STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31782,7 +31738,7 @@ If the application is tiered and the network infrastructure hosting the applicat Rule_ID - SV-222621r879887_rule + SV-222621r961863_rule Rule_Ver @@ -31856,7 +31812,7 @@ If audit logs have not been retained for one year or five years for SAMI data, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31864,7 +31820,7 @@ If audit logs have not been retained for one year or five years for SAMI data, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -31903,7 +31859,7 @@ If audit logs have not been retained for one year or five years for SAMI data, t Rule_ID - SV-222622r879887_rule + SV-222622r961863_rule Rule_Ver @@ -31979,7 +31935,7 @@ Maintain a log or records of dates and times audit logs are reviewed. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -31987,7 +31943,7 @@ Maintain a log or records of dates and times audit logs are reviewed. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32026,7 +31982,7 @@ Maintain a log or records of dates and times audit logs are reviewed. Rule_ID - SV-222623r879887_rule + SV-222623r961863_rule Rule_Ver @@ -32100,7 +32056,7 @@ If there is no policy for reporting IA violations, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32108,7 +32064,7 @@ If there is no policy for reporting IA violations, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32147,7 +32103,7 @@ If there is no policy for reporting IA violations, this is a finding. Rule_ID - SV-222624r879887_rule + SV-222624r961863_rule Rule_Ver @@ -32249,7 +32205,7 @@ Address discovered vulnerabilities. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32257,7 +32213,7 @@ Address discovered vulnerabilities. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32296,7 +32252,7 @@ Address discovered vulnerabilities. Rule_ID - SV-222625r879887_rule + SV-222625r961863_rule Rule_Ver @@ -32386,7 +32342,7 @@ If deadlock issues are not being addressed via documented web service configurat STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32394,7 +32350,7 @@ If deadlock issues are not being addressed via documented web service configurat STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32437,7 +32393,7 @@ If deadlock issues are not being addressed via documented web service configurat Rule_ID - SV-222626r879887_rule + SV-222626r961863_rule Rule_Ver @@ -32519,7 +32475,7 @@ If the application user data is located in the same directory as the application STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32527,7 +32483,7 @@ If the application user data is located in the same directory as the application STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32566,7 +32522,7 @@ If the application user data is located in the same directory as the application Rule_ID - SV-222627r879887_rule + SV-222627r961863_rule Rule_Ver @@ -32655,7 +32611,7 @@ or vendor literature and lock down guides, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32663,7 +32619,7 @@ or vendor literature and lock down guides, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32702,7 +32658,7 @@ or vendor literature and lock down guides, this is a finding. Rule_ID - SV-222628r879887_rule + SV-222628r961863_rule Rule_Ver @@ -32796,7 +32752,7 @@ Verify that all ports, protocols, and services are used in accordance with the D STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32804,7 +32760,7 @@ Verify that all ports, protocols, and services are used in accordance with the D STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32843,7 +32799,7 @@ Verify that all ports, protocols, and services are used in accordance with the D Rule_ID - SV-222629r879887_rule + SV-222629r961863_rule Rule_Ver @@ -32917,7 +32873,7 @@ If the application requires registration, and is not registered or all ports use STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -32925,7 +32881,7 @@ If the application requires registration, and is not registered or all ports use STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -32964,7 +32920,7 @@ If the application requires registration, and is not registered or all ports use Rule_ID - SV-222630r879887_rule + SV-222630r961863_rule Rule_Ver @@ -33050,7 +33006,7 @@ If CM repository is not at the latest security patch level and is not operating STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33058,7 +33014,7 @@ If CM repository is not at the latest security patch level and is not operating STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33097,7 +33053,7 @@ If CM repository is not at the latest security patch level and is not operating Rule_ID - SV-222631r879887_rule + SV-222631r961863_rule Rule_Ver @@ -33187,7 +33143,7 @@ If CM access privileges have not been reviewed within the last three months, thi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33195,7 +33151,7 @@ If CM access privileges have not been reviewed within the last three months, thi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33234,7 +33190,7 @@ If CM access privileges have not been reviewed within the last three months, thi Rule_ID - SV-222632r879887_rule + SV-222632r961863_rule Rule_Ver @@ -33453,7 +33409,7 @@ If the CMR does not audit for modifications, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33461,7 +33417,7 @@ If the CMR does not audit for modifications, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33500,7 +33456,7 @@ If the CMR does not audit for modifications, this is a finding. Rule_ID - SV-222633r879887_rule + SV-222633r961863_rule Rule_Ver @@ -33588,7 +33544,7 @@ If there is no evidence of CCB activity or meetings prior to the last release cy STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33596,7 +33552,7 @@ If there is no evidence of CCB activity or meetings prior to the last release cy STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33635,7 +33591,7 @@ If there is no evidence of CCB activity or meetings prior to the last release cy Rule_ID - SV-222634r879760_rule + SV-222634r987685_rule Rule_Ver @@ -33711,7 +33667,7 @@ If the application environment is not compliant with all DoD IPv6 Standards Prof STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33719,7 +33675,7 @@ If the application environment is not compliant with all DoD IPv6 Standards Prof STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33758,7 +33714,7 @@ If the application environment is not compliant with all DoD IPv6 Standards Prof Rule_ID - SV-222635r879887_rule + SV-222635r961863_rule Rule_Ver @@ -33836,7 +33792,7 @@ If a mission critical application is deployed onto the same server as non-missio STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33844,7 +33800,7 @@ If a mission critical application is deployed onto the same server as non-missio STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -33883,7 +33839,7 @@ If a mission critical application is deployed onto the same server as non-missio Rule_ID - SV-222636r879887_rule + SV-222636r961863_rule Rule_Ver @@ -33963,7 +33919,7 @@ If the disaster recovery/continuity plan does not exist or does not meet the sev STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -33971,7 +33927,7 @@ If the disaster recovery/continuity plan does not exist or does not meet the sev STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34010,7 +33966,7 @@ If the disaster recovery/continuity plan does not exist or does not meet the sev Rule_ID - SV-222637r879887_rule + SV-222637r961863_rule Rule_Ver @@ -34090,7 +34046,7 @@ If the application is not part of the site’s disaster recovery plan, or if any STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34098,7 +34054,7 @@ If the application is not part of the site’s disaster recovery plan, or if any STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34137,7 +34093,7 @@ If the application is not part of the site’s disaster recovery plan, or if any Rule_ID - SV-222638r879887_rule + SV-222638r961863_rule Rule_Ver @@ -34239,7 +34195,7 @@ If any of the requirements above for the associated risk level of the applicatio STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34247,7 +34203,7 @@ If any of the requirements above for the associated risk level of the applicatio STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34286,7 +34242,7 @@ If any of the requirements above for the associated risk level of the applicatio Rule_ID - SV-222639r879887_rule + SV-222639r961863_rule Rule_Ver @@ -34370,7 +34326,7 @@ If back-up copies of the application software or source code are not stored in a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34378,7 +34334,7 @@ If back-up copies of the application software or source code are not stored in a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34417,7 +34373,7 @@ If back-up copies of the application software or source code are not stored in a Rule_ID - SV-222640r879887_rule + SV-222640r961863_rule Rule_Ver @@ -34493,7 +34449,7 @@ If backup and restoration devices are not included in the recovery procedures, t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34501,7 +34457,7 @@ If backup and restoration devices are not included in the recovery procedures, t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34540,7 +34496,7 @@ If backup and restoration devices are not included in the recovery procedures, t Rule_ID - SV-222641r879887_rule + SV-222641r961863_rule Rule_Ver @@ -34618,7 +34574,7 @@ If the application does not implement encryption for key exchange, this is a fin STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34626,7 +34582,7 @@ If the application does not implement encryption for key exchange, this is a fin STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34665,7 +34621,7 @@ If the application does not implement encryption for key exchange, this is a fin Rule_ID - SV-222642r879887_rule + SV-222642r961863_rule Rule_Ver @@ -34745,7 +34701,7 @@ The finding details should note specifically where the offending credentials or STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34753,7 +34709,7 @@ The finding details should note specifically where the offending credentials or STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34792,7 +34748,7 @@ The finding details should note specifically where the offending credentials or Rule_ID - SV-222643r879887_rule + SV-222643r961863_rule Rule_Ver @@ -34884,7 +34840,7 @@ After completing the test, destroy all printed output using the site’s preferr STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -34892,7 +34848,7 @@ After completing the test, destroy all printed output using the site’s preferr STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -34931,7 +34887,7 @@ After completing the test, destroy all printed output using the site’s preferr Rule_ID - SV-222644r879887_rule + SV-222644r961863_rule Rule_Ver @@ -35009,7 +34965,7 @@ If test plans, procedures, and results do not exist, or are not updated for each STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35017,7 +34973,7 @@ If test plans, procedures, and results do not exist, or are not updated for each STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35056,7 +35012,7 @@ If test plans, procedures, and results do not exist, or are not updated for each Rule_ID - SV-222645r879887_rule + SV-222645r961863_rule Rule_Ver @@ -35154,7 +35110,7 @@ Application Admins validate cryptographic hashes prior to deploying the applicat STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35162,7 +35118,7 @@ Application Admins validate cryptographic hashes prior to deploying the applicat STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35201,7 +35157,7 @@ Application Admins validate cryptographic hashes prior to deploying the applicat Rule_ID - SV-222646r879887_rule + SV-222646r961863_rule Rule_Ver @@ -35281,7 +35237,7 @@ If the organization has not designated personnel to conduct security testing, th STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35289,7 +35245,7 @@ If the organization has not designated personnel to conduct security testing, th STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35328,7 +35284,7 @@ If the organization has not designated personnel to conduct security testing, th Rule_ID - SV-222647r879887_rule + SV-222647r961863_rule Rule_Ver @@ -35408,7 +35364,7 @@ If annual testing procedures do not exist, or if administrators are unable to pr STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35416,7 +35372,7 @@ If annual testing procedures do not exist, or if administrators are unable to pr STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35455,7 +35411,7 @@ If annual testing procedures do not exist, or if administrators are unable to pr Rule_ID - SV-222648r879887_rule + SV-222648r961863_rule Rule_Ver @@ -35569,7 +35525,7 @@ If the organization does not conduct code reviews on the application that attemp STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35577,7 +35533,7 @@ If the organization does not conduct code reviews on the application that attemp STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35616,7 +35572,7 @@ If the organization does not conduct code reviews on the application that attemp Rule_ID - SV-222649r879887_rule + SV-222649r961863_rule Rule_Ver @@ -35704,7 +35660,7 @@ If these code coverage statistics do not exist, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35712,7 +35668,7 @@ If these code coverage statistics do not exist, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35751,7 +35707,7 @@ If these code coverage statistics do not exist, this is a finding. Rule_ID - SV-222650r918120_rule + SV-222650r961863_rule Rule_Ver @@ -35831,7 +35787,7 @@ If there is no configuration management repository or the code review flaws are STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35839,7 +35795,7 @@ If there is no configuration management repository or the code review flaws are STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -35878,7 +35834,7 @@ If there is no configuration management repository or the code review flaws are Rule_ID - SV-222651r879887_rule + SV-222651r961863_rule Rule_Ver @@ -35956,7 +35912,7 @@ If IA impact analysis is not performed, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -35964,7 +35920,7 @@ If IA impact analysis is not performed, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36003,7 +35959,7 @@ If IA impact analysis is not performed, this is a finding. Rule_ID - SV-222652r879887_rule + SV-222652r961863_rule Rule_Ver @@ -36085,7 +36041,7 @@ If security flaws are not addressed in the project plan or there is no process t STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36093,7 +36049,7 @@ If security flaws are not addressed in the project plan or there is no process t STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36132,7 +36088,7 @@ If security flaws are not addressed in the project plan or there is no process t Rule_ID - SV-222653r879887_rule + SV-222653r961863_rule Rule_Ver @@ -36227,7 +36183,7 @@ Include programming best practices based on the languages being used for applica STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36235,7 +36191,7 @@ Include programming best practices based on the languages being used for applica STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36274,7 +36230,7 @@ Include programming best practices based on the languages being used for applica Rule_ID - SV-222654r879887_rule + SV-222654r961863_rule Rule_Ver @@ -36378,7 +36334,7 @@ If the design document is incomplete, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36386,7 +36342,7 @@ If the design document is incomplete, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36425,7 +36381,7 @@ If the design document is incomplete, this is a finding. Rule_ID - SV-222655r879887_rule + SV-222655r961863_rule Rule_Ver @@ -36533,7 +36489,7 @@ If the described threat model documentation does not exist, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36541,7 +36497,7 @@ If the described threat model documentation does not exist, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36580,7 +36536,7 @@ If the described threat model documentation does not exist, this is a finding. Rule_ID - SV-222656r879887_rule + SV-222656r961863_rule Rule_Ver @@ -36664,7 +36620,7 @@ If no test results are available for review, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36672,7 +36628,7 @@ If no test results are available for review, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36711,7 +36667,7 @@ If no test results are available for review, this is a finding. Rule_ID - SV-222657r879887_rule + SV-222657r961863_rule Rule_Ver @@ -36807,7 +36763,7 @@ If the application incident response plan does not exist and at a minimum does n STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36815,7 +36771,7 @@ If the application incident response plan does not exist and at a minimum does n STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36854,7 +36810,7 @@ If the application incident response plan does not exist and at a minimum does n Rule_ID - SV-222658r879887_rule + SV-222658r961863_rule Rule_Ver @@ -36940,7 +36896,7 @@ If any of the software components are not supported by a COTS vendor or a GOTS o STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -36948,7 +36904,7 @@ If any of the software components are not supported by a COTS vendor or a GOTS o STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -36987,7 +36943,7 @@ If any of the software components are not supported by a COTS vendor or a GOTS o Rule_ID - SV-222659r879887_rule + SV-222659r961863_rule Rule_Ver @@ -37063,7 +37019,7 @@ If the application or any of the application components are not being maintained STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37071,7 +37027,7 @@ If the application or any of the application components are not being maintained STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37110,7 +37066,7 @@ If the application or any of the application components are not being maintained Rule_ID - SV-222660r879887_rule + SV-222660r961863_rule Rule_Ver @@ -37186,7 +37142,7 @@ If provisions are not in place to notify users when an application is decommissi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37194,7 +37150,7 @@ If provisions are not in place to notify users when an application is decommissi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37233,7 +37189,7 @@ If provisions are not in place to notify users when an application is decommissi Rule_ID - SV-222661r879887_rule + SV-222661r961863_rule Rule_Ver @@ -37317,7 +37273,7 @@ If these accounts are not necessary to run the application, or if the accounts a STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37325,7 +37281,7 @@ If these accounts are not necessary to run the application, or if the accounts a STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37364,7 +37320,7 @@ If these accounts are not necessary to run the application, or if the accounts a Rule_ID - SV-222662r879887_rule + SV-222662r961863_rule Rule_Ver @@ -37440,7 +37396,7 @@ If authentication is successful, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37448,7 +37404,7 @@ If authentication is successful, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37487,7 +37443,7 @@ If authentication is successful, this is a finding. Rule_ID - SV-222663r879887_rule + SV-222663r961863_rule Rule_Ver @@ -37615,7 +37571,7 @@ Verify the application configuration guide is distributed along with the applic STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37623,7 +37579,7 @@ Verify the application configuration guide is distributed along with the applic STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37662,7 +37618,7 @@ Verify the application configuration guide is distributed along with the applic Rule_ID - SV-222664r879887_rule + SV-222664r961863_rule Rule_Ver @@ -37760,7 +37716,7 @@ If the security classification guide does not exist, or does not contain applica STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37768,7 +37724,7 @@ If the security classification guide does not exist, or does not contain applica STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37807,7 +37763,7 @@ If the security classification guide does not exist, or does not contain applica Rule_ID - SV-222665r879887_rule + SV-222665r961863_rule Rule_Ver @@ -37917,7 +37873,7 @@ If uncategorized mobile code types are found, ask the application administrator STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -37925,7 +37881,7 @@ If uncategorized mobile code types are found, ask the application administrator STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -37964,7 +37920,7 @@ If uncategorized mobile code types are found, ask the application administrator Rule_ID - SV-222666r879887_rule + SV-222666r961863_rule Rule_Ver @@ -38044,7 +38000,7 @@ If any database exports include sensitive data and that data is not sanitized or STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38052,7 +38008,7 @@ If any database exports include sensitive data and that data is not sanitized or STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38091,7 +38047,7 @@ If any database exports include sensitive data and that data is not sanitized or Rule_ID - SV-222667r879887_rule + SV-222667r961863_rule Rule_Ver @@ -38171,7 +38127,7 @@ If mitigations for DoS attacks are identified in the threat model but are not im STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38179,7 +38135,7 @@ If mitigations for DoS attacks are identified in the threat model but are not im STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38218,7 +38174,7 @@ If mitigations for DoS attacks are identified in the threat model but are not im Rule_ID - SV-222668r879887_rule + SV-222668r961863_rule Rule_Ver @@ -38294,7 +38250,7 @@ If this monitoring capability does not exist, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38302,7 +38258,7 @@ If this monitoring capability does not exist, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38341,7 +38297,7 @@ If this monitoring capability does not exist, this is a finding. Rule_ID - SV-222669r879887_rule + SV-222669r961863_rule Rule_Ver @@ -38419,7 +38375,7 @@ If no deployment personnel are registered to receive the alerts, this is a findi STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38427,7 +38383,7 @@ If no deployment personnel are registered to receive the alerts, this is a findi STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38466,7 +38422,7 @@ If no deployment personnel are registered to receive the alerts, this is a findi Rule_ID - SV-222670r879887_rule + SV-222670r961863_rule Rule_Ver @@ -38554,7 +38510,7 @@ Include a description of the issue, a summary of risk as well as potential mitig STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38562,7 +38518,7 @@ Include a description of the issue, a summary of risk as well as potential mitig STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38601,7 +38557,7 @@ Include a description of the issue, a summary of risk as well as potential mitig Rule_ID - SV-222671r879887_rule + SV-222671r961863_rule Rule_Ver @@ -38675,7 +38631,7 @@ If the application is publicly accessible and traffic is not being routed throug STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38683,7 +38639,7 @@ If the application is publicly accessible and traffic is not being routed throug STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38722,7 +38678,7 @@ If the application is publicly accessible and traffic is not being routed throug Rule_ID - SV-222672r879877_rule + SV-222672r961833_rule Rule_Ver @@ -38804,7 +38760,7 @@ If the application does not create an audit record when concurrent logons occur STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38812,7 +38768,7 @@ If the application does not create an audit record when concurrent logons occur STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38851,7 +38807,7 @@ If the application does not create an audit record when concurrent logons occur Rule_ID - SV-222673r879887_rule + SV-222673r961863_rule Rule_Ver @@ -38946,7 +38902,7 @@ If there is no evidence of security training, this is a finding. STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -38954,7 +38910,7 @@ If there is no evidence of security training, this is a finding. STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -38981,7 +38937,7 @@ If there is no evidence of security training, this is a finding. Vuln_Num - V-254803 + V-265634 Severity @@ -38989,11 +38945,11 @@ If there is no evidence of security training, this is a finding. Group_Title - APSC-DV-002010 + SRG-APP-000625 Rule_ID - SV-254803r865217_rule + SV-265634r997303_rule Rule_Ver @@ -39117,7 +39073,7 @@ Implement NSA-validated type-1 encryption of all SAMI data stored in the enclave STIG_UUID - f22a9e9a-edf2-4519-9a89-da88f03885b6 + f3ea130f-0b51-497e-96b7-a608c2e9b9d5 Class @@ -39125,7 +39081,7 @@ Implement NSA-validated type-1 encryption of all SAMI data stored in the enclave STIGRef - Application Security and Development Security Technical Implementation Guide :: Version 5, Release: 3 Benchmark Date: 26 Jul 2023 + Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 1 Benchmark Date: 24 Jul 2024 TargetKey @@ -39145,7 +39101,7 @@ Implement NSA-validated type-1 encryption of all SAMI data stored in the enclave Not_Applicable - Application does not process classified data. + The application is public release and is not used for classified data.