STIGQter STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must enforce a minimum 15-character password length.

DISA Rule

SV-234203r984092_rule

Vulnerability Number

V-234203

Group Title

SRG-APP-000164-NDM-000252

Rule Version

FGFW-ND-000220

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Navigate to Password Policy.
4. On the Password scope option, click Admin.
5. Enter the Minimum length value of 15.

or

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config system password-policy
# set status enable
# set minimum-length 15
# end--+

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Navigate to Password Policy.
4. Verify Password scope is enabled for Admin.
5. Verify the Minimum length is set to 15.

If the Password scope is OFF and the Minimum length is not set to 15, this is a finding.

or

Log in to the FortiGate GUI with Super-Admin privilege:

1. Open a CLI console, via SSH or available from the GUI
2. Run the following command:
# show full-configuration system password-policy | grep -i minimum
set minimum-length 15

If the minimum-length parameter is not set to 15, this is a finding.

Vulnerability Number

V-234203

Documentable

False

Rule Version

FGFW-ND-000220

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Navigate to Password Policy.
4. Verify Password scope is enabled for Admin.
5. Verify the Minimum length is set to 15.

If the Password scope is OFF and the Minimum length is not set to 15, this is a finding.

or

Log in to the FortiGate GUI with Super-Admin privilege:

1. Open a CLI console, via SSH or available from the GUI
2. Run the following command:
# show full-configuration system password-policy | grep -i minimum
set minimum-length 15

If the minimum-length parameter is not set to 15, this is a finding.

Check Content Reference

M

Target Key

5260