STIGQter: STIG Summary: Application Server Security Requirements Guide Version: 4 Release: 5 Benchmark Date: 01 Jul 2026:

The application server must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

DISA Rule

SV-240925r1117186_rule

Vulnerability Number

V-240925

Group Title

SRG-APP-000416

Rule Version

SRG-APP-000416-AS-000140

Severity

CAT II

CCI(s)

• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Configure the application server to utilize NSA-approved cryptography to protect classified information.

Check Contents

Review application server documentation to verify that the application server is using NSA-approved cryptography to protect classified data and applications resident on the device.

If the application server is not using NSA-approved cryptography for classified data and applications, this is a finding.

Vulnerability Number

V-240925

Documentable

False

Rule Version

SRG-APP-000416-AS-000140

Severity Override Guidance

Review application server documentation to verify that the application server is using NSA-approved cryptography to protect classified data and applications resident on the device.

If the application server is not using NSA-approved cryptography for classified data and applications, this is a finding.

Check Content Reference

M

Target Key

2900