STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to enforce password complexity by requiring that at least one lowercase character be used.

DISA Rule

SV-258618r997513_rule

Vulnerability Number

V-258618

Group Title

SRG-APP-000167-NDM-000255

Rule Version

IVCS-NM-000480

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. If the setting for "Password must have at least __ letters".
2. In the box, enter "2".
3. Check the box for "Password must have mix of UPPERCASE and lowercase letters".
4. Click "Save Changes".

Check Contents

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "Password must have at least __ letters" is checked.
2. Verify the setting for "Password must have mix of UPPERCASE and lowercase letters" is checked.
3. Verify the value for the setting for "Password must have at least __ letters" is set to "2".

If the ICS is not configured to enforce password complexity by requiring that at least one lowercase character be used, this is a finding.

Vulnerability Number

V-258618

Documentable

False

Rule Version

IVCS-NM-000480

Severity Override Guidance

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "Password must have at least __ letters" is checked.
2. Verify the setting for "Password must have mix of UPPERCASE and lowercase letters" is checked.
3. Verify the value for the setting for "Password must have at least __ letters" is set to "2".

If the ICS is not configured to enforce password complexity by requiring that at least one lowercase character be used, this is a finding.

Check Content Reference

M

Target Key

5558