STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 9 Release: 10 Benchmark Date: 24 Jan 2020:

Command and Control (C2) and non-C2 exceptions of SIPRNet must be documented in the enclaves accreditation package and an Authority to Connect (ATC) or Interim ATC amending the connection approval received prior to implementation.

DISA Rule

SV-15498r2_rule

Vulnerability Number

V-14742

Group Title

SIPRNet exceptions must be documented

Rule Version

NET1827

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Document all SIPRNet connections.

Check Contents

Review SIPRNet accreditation package and an Interim Authority to Connect/Authority to Connect (IATC/ATC) amending the connection approval received.

If C2 and non-C2 exceptions are not documented, this is a finding.

Vulnerability Number

V-14742

Documentable

False

Rule Version

NET1827

Severity Override Guidance

Review SIPRNet accreditation package and an Interim Authority to Connect/Authority to Connect (IATC/ATC) amending the connection approval received.

If C2 and non-C2 exceptions are not documented, this is a finding.

Check Content Reference

M

Target Key

838

Comments