STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.

DISA Rule

SV-279385r1179518_rule

Vulnerability Number

V-279385

Group Title

SRG-APP-000416-DB-000380

Rule Version

MD8X-00-007900

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Enable FIPS mode for MongoDB Enterprise.

Edit the MongoDB database configuration file (default location /etc/mongod.conf) to contain the following parameter setting:

net:
tls:
FIPSMode: true

Stop/start (restart) the mongod or mongos instance using this configuration and run the following command to verify the output is "true":

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.net.tls.FIPSMode

The output of this command must be "true".

Alternatively, run the following command to search the mongod logfile for "FIPS mode 140-2 activated":

$ grep "FIPS 140-2 mode activated" /var/log/mongodb/mongod.log

There should be a line similar to what is shown below:

{"t":{"$date":"2025-02-26T15:21:09.174+00:00"},"s":"I", "c":"NETWORK", "id":23172, "ctx":"main","msg":"FIPS 140-2 mode activated"}

Check Contents

If MongoDB is deployed in an unclassified environment, this is not a finding.

Run the following command as an administrative user:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.net.tls.FIPSMode

If the output is not "true", this is a finding.

Vulnerability Number

V-279385

Documentable

False

Rule Version

MD8X-00-007900

Severity Override Guidance

If MongoDB is deployed in an unclassified environment, this is not a finding.

Run the following command as an administrative user:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.net.tls.FIPSMode

If the output is not "true", this is a finding.

Check Content Reference

M

Target Key

5728