STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must be configured to use approved authorizations for access control.

DISA Rule

SV-274507r1143927_rule

Vulnerability Number

V-274507

Group Title

SRG-APP-000033

Rule Version

SRG-APP-000033-API-000070

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Build or configure the API to enforce access control using DOD-approved authorization mechanisms. Ensure that authorization decisions are dynamic and based on contextual factors (e.g., user role, device compliance, request attributes).

Update system documentation to reflect the authorization strategy and verify integration with access management and logging systems to meet Zero Trust Capability requirements.

Check Contents

Confirm that the API enforces access control using approved authorization methods, such as token-based mechanisms (e.g., OAuth 2.0, JWT), role-based access control (RBAC), attribute-based access control (ABAC), or policy-based decisions provided by a centralized authorization service.

Ensure the configuration aligns with DOD Zero Trust Reference Architecture Capability Authorization Enforcement, which requires that systems validate access requests using dynamic and contextual authorization decisions rather than relying solely on static permissions or network location.

Review system documentation, API gateway configurations, and authorization policies to verify that access control decisions are:
- Based on real-time evaluation of user identity, role, device posture, and other attributes.
- Applied consistently across all API endpoints.
- Logged for auditing and accountability.

If the API does not implement DOD-approved, context-aware authorization mechanisms as required under Zero Trust Capability or if authorization enforcement is not documented or configured, this is a finding.

Vulnerability Number

V-274507

Documentable

False

Rule Version

SRG-APP-000033-API-000070

Severity Override Guidance

Confirm that the API enforces access control using approved authorization methods, such as token-based mechanisms (e.g., OAuth 2.0, JWT), role-based access control (RBAC), attribute-based access control (ABAC), or policy-based decisions provided by a centralized authorization service.

Ensure the configuration aligns with DOD Zero Trust Reference Architecture Capability Authorization Enforcement, which requires that systems validate access requests using dynamic and contextual authorization decisions rather than relying solely on static permissions or network location.

Review system documentation, API gateway configurations, and authorization policies to verify that access control decisions are:
- Based on real-time evaluation of user identity, role, device posture, and other attributes.
- Applied consistently across all API endpoints.
- Logged for auditing and accountability.

If the API does not implement DOD-approved, context-aware authorization mechanisms as required under Zero Trust Capability or if authorization enforcement is not documented or configured, this is a finding.

Check Content Reference

M

Target Key

5703