STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

Forescout must authenticate all endpoint devices before establishing a connection and proceeding with posture assessment. This is required for compliance with C2C Step 4.

DISA Rule

SV-233326r856512_rule

Vulnerability Number

V-233326

Group Title

SRG-NET-000343-NAC-001460

Rule Version

FORE-NC-000180

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Use the Forescout Administrator UI to configure the Appliance IP Assignments list with all IP addresses identified within the SSP.

1. Log on to the Forescout UI.
2. Select Tools >> Option >> Appliance >> IP Assignment.
3. Configure IP addresses associated with the SSP and label within the IP Assignments list, and then select "Apply".

Check Contents

If DoD is not at C2C Step 4 or higher, this is not a finding.

Use the Forescout Administrator UI to verify all IP addresses identified in the SSP are configured within the Appliance IP Assignments list.

1. Log on to the Forescout UI.
2. Select Tools >> Option >> Appliance >> IP Assignment.
3. Verify all IP addresses associated with the SSP are labeled within the IP Assignments list.

If Forescout does not authenticate all endpoints prior to establishing a connection and proceeding with posture assessment, this is a finding.

Vulnerability Number

V-233326

Documentable

False

Rule Version

FORE-NC-000180

Severity Override Guidance

If DoD is not at C2C Step 4 or higher, this is not a finding.

Use the Forescout Administrator UI to verify all IP addresses identified in the SSP are configured within the Appliance IP Assignments list.

1. Log on to the Forescout UI.
2. Select Tools >> Option >> Appliance >> IP Assignment.
3. Verify all IP addresses associated with the SSP are labeled within the IP Assignments list.

If Forescout does not authenticate all endpoints prior to establishing a connection and proceeding with posture assessment, this is a finding.

Check Content Reference

M

Target Key

5250