STIGQter: STIG Summary: Virtual Machine Manager Security Requirements Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The VMM must disable local account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

DISA Rule

SV-207395r984214_rule

Vulnerability Number

V-207395

Group Title

SRG-OS-000118

Rule Version

SRG-OS-000118-VMM-000590

Severity

CAT II

CCI(s)

CCI-003627 - Disable accounts when the accounts have expired.

Weight

Fix Recommendation

Configure the VMM to disable local account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Check Contents

Verify the VMM disables local account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

If it does not, this is a finding.

Vulnerability Number

V-207395

Documentable

False

Rule Version

SRG-OS-000118-VMM-000590

Severity Override Guidance

Verify the VMM disables local account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

If it does not, this is a finding.

Check Content Reference

Target Key

2924