STIGQter: STIG Summary: Application Server Security Requirements Guide Version: 3 Release: 1 Benchmark Date: 23 Oct 2020:

The application server must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies to access the management interface.

DISA Rule

SV-204807r508029_rule

Vulnerability Number

V-204807

Group Title

SRG-APP-000403

Rule Version

SRG-APP-000403-AS-000248

Severity

CAT II

CCI(s)

• CCI-002010 - The information system electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.

Weight

10

Fix Recommendation

Configure the unclassified application server to electronically verify PIV credentials from other federal agencies before granting access to the management interface.

Check Contents

The CAC is the standard DoD authentication token;the PIV is the standard authentication token used by federal/civilian agencies.

If access to the application server is limited to DoD personnel accessing the system via CAC; and PIV access is not warranted or allowed as per the system security plan, the PIV requirement is NA.

Review the application server documentation and configuration to determine if the application server electronically verifies PIV credentials from other federal agencies to access the management interface.

If the application server does not electronically verify other federal agency PIV credentials to access the management interface, this is a finding.

Vulnerability Number

V-204807

Documentable

False

Rule Version

SRG-APP-000403-AS-000248

Severity Override Guidance

The CAC is the standard DoD authentication token;the PIV is the standard authentication token used by federal/civilian agencies.

If access to the application server is limited to DoD personnel accessing the system via CAC; and PIV access is not warranted or allowed as per the system security plan, the PIV requirement is NA.

Review the application server documentation and configuration to determine if the application server electronically verifies PIV credentials from other federal agencies to access the management interface.

If the application server does not electronically verify other federal agency PIV credentials to access the management interface, this is a finding.

Check Content Reference

M

Target Key

2900

Comments