STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Okta Dashboard application must be configured to use multifactor authentication.

DISA Rule

SV-273194r1098849_rule

Vulnerability Number

V-273194

Group Title

SRG-APP-000150

Rule Version

OKTA-APP-000570

Severity

CAT I

CCI(s)

CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Weight

Fix Recommendation

From the Admin Console:
1. Go to Security >> Authentication Policies.
2. Click the "Okta Dashboard" policy.
3. Click the "Actions" button next to the top rule and select "Edit".
4. In the "User must authenticate with" field, select either "Password/IdP + Another factor" or "Any 2 factor types".

Check Contents

From the Admin Console:
1. Go to Security >> Authentication Policies.
2. Click the "Okta Dashboard" policy.
3. Click the "Actions" button next to the top rule and select "Edit".
4. In the "User must authenticate with" field, verify that either "Password/IdP + Another factor" or "Any 2 factor types" is selected.

If either of these settings is incorrect, this is a finding.

Vulnerability Number

V-273194

Documentable

False

Rule Version

OKTA-APP-000570

Severity Override Guidance

From the Admin Console:
1. Go to Security >> Authentication Policies.
2. Click the "Okta Dashboard" policy.
3. Click the "Actions" button next to the top rule and select "Edit".
4. In the "User must authenticate with" field, verify that either "Password/IdP + Another factor" or "Any 2 factor types" is selected.

If either of these settings is incorrect, this is a finding.

Check Content Reference

Target Key

5694