STIGQter: STIG Summary: Soaring Software Solutions TCMax 9.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Feb 2026:

TCMax must enforce a role-based access control (RBAC) policy over defined subjects and objects.

DISA Rule

SV-281380r1186164_rule

Vulnerability Number

V-281380

Group Title

SRG-APP-000329

Rule Version

TCMA-09-000340

Severity

CAT II

CCI(s)

• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Role-Based Access Control hierarchy is to be defined by the AO. Separation of duties must be configured.

1. Using an account of appropriate privileges to access TCMax, go to Settings >> User Options.

2. Assign minimal permissions to each user required to perform their job.

3. Assign two or more roles (as defined by the AO) to at least two different user types.

Check Contents

Role-Based Access Control hierarchy is to be defined by the authorizing authority (AO). Separation of duties must be configured.

1. Using an account of appropriate privileges to access TCMax, go to Settings >> User Options.

2. Evaluate the users using the combo box in the top right to change users.

3. Ensure users have the minimal permissions required to perform their duties.

4. Verify least two users have different role types such as "admin" and "user".

If only one assigned role exists, this is a finding.

If users have excessive permissions, this is a finding.

Vulnerability Number

V-281380

Documentable

False

Rule Version

TCMA-09-000340

Severity Override Guidance

Role-Based Access Control hierarchy is to be defined by the authorizing authority (AO). Separation of duties must be configured.

1. Using an account of appropriate privileges to access TCMax, go to Settings >> User Options.

2. Evaluate the users using the combo box in the top right to change users.

3. Ensure users have the minimal permissions required to perform their duties.

4. Verify least two users have different role types such as "admin" and "user".

If only one assigned role exists, this is a finding.

If users have excessive permissions, this is a finding.

Check Content Reference

M

Target Key

5734