STIGQter: STIG Summary: NetApp ONTAP DSC 9.x Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

ONTAP must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

DISA Rule

SV-246959r961068_rule

Vulnerability Number

V-246959

Group Title

SRG-APP-000190-NDM-000267

Rule Version

NAOT-SC-000001

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure ONTAP to timeout idle sessions after 10 minutes with "system timeout modify -timeout 10".

Check Contents

Use "system timeout show" to see the session timeout in minutes.

If ONTAP does not terminate the connection associated with a device management session at the end of the session or after 10 minutes of inactivity, this is a finding.

Vulnerability Number

V-246959

Documentable

False

Rule Version

NAOT-SC-000001

Severity Override Guidance

Use "system timeout show" to see the session timeout in minutes.

If ONTAP does not terminate the connection associated with a device management session at the end of the session or after 10 minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

5415