STIGQter: STIG Summary: Cloud Computing Mission Owner Operating System Security Requirements Guide Version: 1 Release: 3 Benchmark Date: 13 Aug 2025:

The cloud service offering (CSO) must be configured to use DOD public key infrastructure (PKI) to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-259875r958482_rule

Vulnerability Number

V-259875

Group Title

SRG-OS-000104

Rule Version

SRG-OS-000104-CLD-000065

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.

Weight

10

Fix Recommendation

This applies to Impact Level 4/5/6.
FedRAMP Moderate, High.

Mission Owners may choose to use the CSP's CAC services (based on level), use a DOD federated offering, or install a virtual Directory Service.

Check Contents

This is not applicable for Impact Level 2 public clouds with nonprivileged user access to publicly releasable information unless the information owner requires authenticated access.

Verify the CSO is configured to use DOD PKI to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

If the CSO does not use DOD PKI to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Vulnerability Number

V-259875

Documentable

False

Rule Version

SRG-OS-000104-CLD-000065

Severity Override Guidance

This is not applicable for Impact Level 2 public clouds with nonprivileged user access to publicly releasable information unless the information owner requires authenticated access.

Verify the CSO is configured to use DOD PKI to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

If the CSO does not use DOD PKI to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Check Content Reference

M

Target Key

5584