STIGQter: STIG Summary: Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

Prisma Cloud Compute must be configured to require local user accounts to use x.509 multifactor authentication.

DISA Rule

SV-253539r1188294_rule

Vulnerability Number

V-253539

Group Title

SRG-APP-000177-CTR-000465

Rule Version

CNTR-PC-000750

Severity

CAT II

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-001857 - Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

Navigate to Prisma Cloud Compute Console's >> Manage >> Authentication >> System Certificate tab.

Revocation block: Set "Enable certificate revocation checking" to "On" and click "Save".

In the "Certificate-based authentication to Console" block, import the smart card's issuing CA's chain of trust to the Console CA certificate(s) field. Click "Save".

Click the "Users" tab. (Accounts cannot be edited. They must be removed and recreated correctly.)

Delete account:
- Click the three-dot menu.
- Click "Delete" and confirm "Delete User".

Create a local user account where the local user account name matches the user's x.509 certificate's subjectName or subject alternative name's PrincipalName value:
- Click "+Add user".
Authentication Source = Local
Username = subject alternative name's PrincipalName value
Password = random password that is not given to the user
- Assign Role.
- Click "Save".

Check Contents

Navigate to Prisma Cloud Compute Console's >> Manage >> Authentication >> System Certificate tab.

If not performing direct smart card authentication to the console, this is not a finding.

If performing direct smart card authentication to the console:

Revocation block: If "Enable certificate revocation checking" is set to "Off", this is a finding.

Show Advanced certificate configuration:
- In the "Certificate-based authentication to Console" block, verify the issuing CA(s) of the end users' certificates are within the Console CA certificate(s) field.
- If there is no users' certificates, this is a finding.

Click the "Users" tab.

Review accounts with Authentication method "Local".

If the local user account's name does not match the user's x.509 certificate's subjectName or the subject alternative name's PrincipalName value, this is a finding.

Vulnerability Number

V-253539

Documentable

False

Rule Version

CNTR-PC-000750

Severity Override Guidance

Navigate to Prisma Cloud Compute Console's >> Manage >> Authentication >> System Certificate tab.

If not performing direct smart card authentication to the console, this is not a finding.

If performing direct smart card authentication to the console:

Revocation block: If "Enable certificate revocation checking" is set to "Off", this is a finding.

Show Advanced certificate configuration:
- In the "Certificate-based authentication to Console" block, verify the issuing CA(s) of the end users' certificates are within the Console CA certificate(s) field.
- If there is no users' certificates, this is a finding.

Click the "Users" tab.

Review accounts with Authentication method "Local".

If the local user account's name does not match the user's x.509 certificate's subjectName or the subject alternative name's PrincipalName value, this is a finding.

Check Content Reference

M

Target Key

5473