STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to implement cryptographic mechanisms using a FIPS 140-2/140-3 approved algorithm.

DISA Rule

SV-258598r1028331_rule

Vulnerability Number

V-258598

Group Title

SRG-APP-000412-NDM-000331

Rule Version

IVCS-NM-000010

Severity

CAT I

CCI(s)

• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Enable compliance modes to ensure only FIPS 140-2/140-3 algorithms are used. Once "Turn on JITC mode" is checked, "Turn on NDcPP mode" and "Turn on FIPS mode" are also checked automatically; however, the focus of this requirement is on enabling FIPS mode. The following procedure is the preferred DOD process.

In the ICS Web UI, navigate to System >> Configuration >> Security >> Inbound SSL Options.
1. Under "DOD Certification Option", check (enabled) "Turn on JITC mode" to enable the JITC mode security features.
2. Click "Save changes" and confirm after the web UI asks for SSL cipher configuration changes.

Check Contents

In the ICS Web UI, navigate to System >> Configuration >> Security >> Inbound SSL Options. Verify "Turn on FIPS mode" checkbox is enabled (checked).

If the use of FIPS 140-2/140-3 approved algorithms is not enabled, this is a finding.

Vulnerability Number

V-258598

Documentable

False

Rule Version

IVCS-NM-000010

Severity Override Guidance

In the ICS Web UI, navigate to System >> Configuration >> Security >> Inbound SSL Options. Verify "Turn on FIPS mode" checkbox is enabled (checked).

If the use of FIPS 140-2/140-3 approved algorithms is not enabled, this is a finding.

Check Content Reference

M

Target Key

5558