STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to enforce password complexity by requiring that at least one uppercase character be used.

DISA Rule

SV-258619r997514_rule

Vulnerability Number

V-258619

Group Title

SRG-APP-000166-NDM-000254

Rule Version

IVCS-NM-000490

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. If the setting for "Password must have at least __ letters".
2. In the box, enter "2".
3. Check the box for "Password must have mix of UPPERCASE and lowercase letters".
4. Click "Save Changes".

Check Contents

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "Password must have at least __ letters" is checked.
2. Verify the setting for "Password must have mix of UPPERCASE and lowercase letters" is checked.
3. Verify value for the setting for "Password must have at least __ letters" is set to "2".

If the ICS is not configured to enforce password complexity by requiring that at least one upper-case character be used, this is a finding.

Vulnerability Number

V-258619

Documentable

False

Rule Version

IVCS-NM-000490

Severity Override Guidance

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Verify the setting for "Password must have at least __ letters" is checked.
2. Verify the setting for "Password must have mix of UPPERCASE and lowercase letters" is checked.
3. Verify value for the setting for "Password must have at least __ letters" is set to "2".

If the ICS is not configured to enforce password complexity by requiring that at least one upper-case character be used, this is a finding.

Check Content Reference

M

Target Key

5558