STIGQter: STIG Summary: Application Server Security Requirements Guide Version: 4 Release: 5 Benchmark Date: 01 Jul 2026:

The application server must enforce a role-based access control (RBAC) policy over defined subjects and objects.

DISA Rule

SV-278966r1137609_rule

Vulnerability Number

V-278966

Group Title

SRG-APP-000329

Rule Version

SRG-APP-000329-AS-000200

Severity

CAT II

CCI(s)

• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the application server to enforce an RBAC policy over defined subjects and objects.

Check Contents

Verify the application server is configured to enforce an RBAC policy over defined subjects and objects.

If the application server does not enforce an RBAC policy over defined subjects and objects, this is a finding.

Vulnerability Number

V-278966

Documentable

False

Rule Version

SRG-APP-000329-AS-000200

Severity Override Guidance

Verify the application server is configured to enforce an RBAC policy over defined subjects and objects.

If the application server does not enforce an RBAC policy over defined subjects and objects, this is a finding.

Check Content Reference

M

Target Key

2900