STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 6 Release: 4 Benchmark Date: 01 Oct 2025:

The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.

DISA Rule

SV-222422r1015688_rule

Vulnerability Number

V-222422

Group Title

SRG-APP-000320

Rule Version

APSC-DV-000430

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the application to notify the SA and the ISSO when application accounts are enabled.

Check Contents

Review the application and system documentation.

Interview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.

If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.

Ensure the application is configured to notify SAs when accounts are enabled by identifying the SAs who will be notified when accounts are enabled.

Disable and then enable a test account and check with the SA to verify the notification was received to indicate the account was enabled.

If SAs and ISSOs are not notified when accounts are enabled, this is a finding.

Vulnerability Number

V-222422

Documentable

False

Rule Version

APSC-DV-000430

Severity Override Guidance

Review the application and system documentation.

Interview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.

If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.

Ensure the application is configured to notify SAs when accounts are enabled by identifying the SAs who will be notified when accounts are enabled.

Disable and then enable a test account and check with the SA to verify the notification was received to indicate the account was enabled.

If SAs and ISSOs are not notified when accounts are enabled, this is a finding.

Check Content Reference

M

Target Key

4093