STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.

DISA Rule

SV-265978r1003613_rule

Vulnerability Number

V-265978

Group Title

SRG-APP-000014

Rule Version

VCSA-80-000009

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

From the vSphere Client, go to Developer Center >> API Explorer.

Select "appliance" from the "Select API" drop down list then scroll down to the "tls/profiles/global" section.

Expand the PUT call and enter the following in the value box:

{
"profile": "NIST_2024"
}

Click Execute and Continue to configure a new global TLS profile.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Invoke-SetProfilesGlobalAsync -TlsProfilesGlobalSetSpec (Initialize-TlsProfilesGlobalSetSpec -VarProfile NIST_2024)

To monitor the status of the operation the task id from the command output can be used with the "Invoke-GetTask" command. For example:

Invoke-GetTask -Task 66b247c2-fe02-4425-9338-1c88eb856138:com.vmware.appliance.tls.profiles.global

Check Contents

From the vSphere Client, go to Developer Center >> API Explorer.

Select "appliance" from the "Select API" drop down list then scroll down to the "tls/profiles/global" section.

Expand the GET call and click Execute and review the response for the configured global TLS profile.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Invoke-GetTlsProfilesGlobal

If the global TLS profile is not "NIST_2024", this is a finding.

Vulnerability Number

V-265978

Documentable

False

Rule Version

VCSA-80-000009

Severity Override Guidance

From the vSphere Client, go to Developer Center >> API Explorer.

Select "appliance" from the "Select API" drop down list then scroll down to the "tls/profiles/global" section.

Expand the GET call and click Execute and review the response for the configured global TLS profile.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Invoke-GetTlsProfilesGlobal

If the global TLS profile is not "NIST_2024", this is a finding.

Check Content Reference

M

Target Key

5573