STIGQter: STIG Summary: Traditional Security Checklist Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Controlled Unclassified Information - Posting Only on Web-Sites with Appropriate Encryption; not on Publicly Accessible Web-Sites.

DISA Rule

SV-245848r1226298_rule

Vulnerability Number

V-245848

Group Title

IS-16.02.06

Rule Version

IS-16.02.06

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Ensure the following standards/guidance are adhered to:

1. PII and other CUI may NOT be posted to publicly accessible internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented.

2. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using https or similar technology.

Check Contents

Check to ensure the following standards/guidance are adhered to:

1. PII and other CUI may NOT be posted to publicly accessible internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented.

2. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using https or similar technology.

TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. The check is not applicable to a field/mobile environment.

Vulnerability Number

V-245848

Documentable

False

Rule Version

IS-16.02.06

Severity Override Guidance

Check to ensure the following standards/guidance are adhered to:

1. PII and other CUI may NOT be posted to publicly accessible internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented.

2. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using https or similar technology.

TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. The check is not applicable to a field/mobile environment.

Check Content Reference

M

Target Key

5410