STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must disable the ability to use USB mass storage devices.

DISA Rule

SV-279602r1192485_rule

Vulnerability Number

V-279602

Group Title

SRG-OS-000114-GPOS-00059

Rule Version

NXAC-OS-000158

Severity

CAT II

CCI(s)

• CCI-000778 - Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

1. For AOS, disable USB mass storage and blacklist from executing using the following command.

$ sudo salt-call state.sls security/CVM/modprobeCVM

2. For Prism Central, disable USB mass storage and blacklist from executing using the following command.

$ sudo salt-call state.sls security/PCVM/modprobePCVM

3. For Files, disable USB mass storage and blacklist from executing using the following command.

$ sudo salt-call state.sls security/AFS/modprobeAFS

4. Configure AHV to disable USB mass storage and blacklist from executing using the following command.

$ sudo salt-call state.sls security/KVM/modprobeKVM

Check Contents

Verify Nutanix OS is set to disable the ability to use USB mass storage devices using the following command.

$ sudo grep -i usb-storage /etc/modprobe.d/stig-reqs.conf
install usb-storage /bin/false

$ sudo grep -i usb-storage /etc/modprobe.d/blacklist.conf
blacklist usb-storage

If the command does not return any output or the output is not "blacklist usb-storage", and use of USB storage devices is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Vulnerability Number

V-279602

Documentable

False

Rule Version

NXAC-OS-000158

Severity Override Guidance

Verify Nutanix OS is set to disable the ability to use USB mass storage devices using the following command.

$ sudo grep -i usb-storage /etc/modprobe.d/stig-reqs.conf
install usb-storage /bin/false

$ sudo grep -i usb-storage /etc/modprobe.d/blacklist.conf
blacklist usb-storage

If the command does not return any output or the output is not "blacklist usb-storage", and use of USB storage devices is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Check Content Reference

M

Target Key

5730