Okta must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application.
DISA Rule
SV-273192r1098843_rule
Vulnerability Number
V-273192
Group Title
SRG-APP-000068
Rule Version
OKTA-APP-000200
Severity
CAT II
CCI(s)
- CCI-000048 - Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.
- CCI-000050 - Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
- CCI-001384 - For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.
- CCI-001385 - For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.
- CCI-001386 - For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.
- CCI-001387 - For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.
- CCI-001388 - For publicly accessible systems, includes a description of the authorized uses of the system.
Weight
10
Fix Recommendation
Follow the supplemental instructions in the "Okta DOD Warning Banner Configuration Guide" provided with this STIG package.
Check Contents
Attempt to log in to the Okta tenant and verify the DOD-approved warning banner is in place.
If the required warning banner is not present and complete, this is a finding.
Vulnerability Number
V-273192
Documentable
False
Rule Version
OKTA-APP-000200
Severity Override Guidance
Attempt to log in to the Okta tenant and verify the DOD-approved warning banner is in place.
If the required warning banner is not present and complete, this is a finding.
Check Content Reference
M
Target Key
5694
STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026: