STIGQter: STIG Summary: NetApp ONTAP DSC 9.x Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

ONTAP must be configured to enforce the limit of three consecutive failed logon attempts.

DISA Rule

SV-246931r960840_rule

Vulnerability Number

V-246931

Group Title

SRG-APP-000065-NDM-000214

Rule Version

NAOT-AC-000010

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Use the command "security login role config show" to get a list of roles.

For each role, use the command "security login role config show -vserver <vserver_name> -role <role_name>" to view the password requirements for each role.

For any role that does not have "Maximum Number of Failed Attempts" set to "3", use the command "security login role config modify -role <role_name> -vserver <vserver_name> -max-failed-login-attempts 3".

Check Contents

Use the command "security login role config show" to get a list of roles.

For each role, use the command "security login role config show -vserver <vserver_name> -role <role_name>" to view the password requirements for each role.

If any role has "Maximum Number of Failed Attempts" not set to "3", this is a finding.

Use "security login role config show -role admin -instance" to see the settings for "Maximum Number of Failed Attempts" and “Lockout Duration".

Note: Lockout duration is set by default to lockout for one day or until unlocked by an administrator. It cannot be set to less than one day.

If ONTAP is not configured to enforce a limit of three consecutive invalid logon attempts, this is a finding.

Vulnerability Number

V-246931

Documentable

False

Rule Version

NAOT-AC-000010

Severity Override Guidance

Use the command "security login role config show" to get a list of roles.

For each role, use the command "security login role config show -vserver <vserver_name> -role <role_name>" to view the password requirements for each role.

If any role has "Maximum Number of Failed Attempts" not set to "3", this is a finding.

Use "security login role config show -role admin -instance" to see the settings for "Maximum Number of Failed Attempts" and “Lockout Duration".

Note: Lockout duration is set by default to lockout for one day or until unlocked by an administrator. It cannot be set to less than one day.

If ONTAP is not configured to enforce a limit of three consecutive invalid logon attempts, this is a finding.

Check Content Reference

M

Target Key

5415