STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-265926r1028802_rule

Vulnerability Number

V-265926

Group Title

SRG-APP-000231-DB-000154

Rule Version

MD7X-00-005200

Severity

CAT I

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Enable the Encrypted Storage Engine with KMIP as the key storage mechanism and AES256-GCM as the encryption mode.

Consult MongoDB documentation for encryption setup instruction here:
https://www.mongodb.com/docs/v7.0/tutorial/configure-encryption/

Check Contents

To provide integrity and confidentiality for data at rest, MongoDB must be configured to use the Encrypted Storage Engine.

Run the following command to verify whether or not the Encrypted Storage Engine is enabled:

> db.serverStatus().encryptionAtRest.encryptionEnabled

Any output other than "true" is a finding.

Validate whether the Encrypted Storage Engine is running with an AEAD block cipher, which provides integrity, by running the following command:

> db.serverStatus().encryptionAtRest.encryptionCipherMode

Any response other than "AES256-GCM" is a finding.

Validate that the system is configured to use KMIP to obtain a master encryption key, rather than storing the master key on the local filesystem.

Run:

> db.serverStatus().encryptionAtRest.encryptionKeyId

If the response is "local" or no response, this is a finding.

Vulnerability Number

V-265926

Documentable

False

Rule Version

MD7X-00-005200

Severity Override Guidance

To provide integrity and confidentiality for data at rest, MongoDB must be configured to use the Encrypted Storage Engine.

Run the following command to verify whether or not the Encrypted Storage Engine is enabled:

> db.serverStatus().encryptionAtRest.encryptionEnabled

Any output other than "true" is a finding.

Validate whether the Encrypted Storage Engine is running with an AEAD block cipher, which provides integrity, by running the following command:

> db.serverStatus().encryptionAtRest.encryptionCipherMode

Any response other than "AES256-GCM" is a finding.

Validate that the system is configured to use KMIP to obtain a master encryption key, rather than storing the master key on the local filesystem.

Run:

> db.serverStatus().encryptionAtRest.encryptionKeyId

If the response is "local" or no response, this is a finding.

Check Content Reference

M

Target Key

5637