STIGQter: STIG Summary: HPE Alletra Storage ArcusOS Web Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Feb 2026:

The HPE Alletra Storage ArcusOS device must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information at rest on all system components.

DISA Rule

SV-283027r1193771_rule

Vulnerability Number

V-283027

Group Title

SRG-APP-000231-WSR-000144

Rule Version

ASMP-WS-000630

Severity

CAT II

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Enable data at rest encryption.

If "cli% showlicense" does not show "SED Encryption" under "License features currently enabled:", then import a SED Encryption license with the "cli% setlicense" command.

Create a CSR for the EKM:
cli% createcert ekm-client -f -csr -CN ekm_username

Sign the CSR with a CA and import the entire certificate chain with:
Cli% importcert ekm-client -f stdin
Paste the ekm-client certificate chain.

Import the EKM Server Certificates:
Cli% createcert ekm-server -f stdin
Paste the ekm-server certificate chain.

Set the connection to the EKM with the following command:
cli% controlencryption setekm -setserver <EKM_IP> -port 5696 -ekmuser ekm_username -kmipprotocols (supported protocols by the ekm) -passwordnoprompt <ekm_user_password>

Enable encryption with the following command:
cli% controlencryption enable -ekm /common/encryptionBackup

Enter passwords and save the encryption backup file off of the array for disaster recovery.

Check Contents

Verify HPE Alletra Storage MP is configured to provide backend drive encryption with the following command:

Cli%controlencryption status -d
Licensed Enabled BackupSaved State SeqNum Keystore FIPS non-SEDs FailedDisks nodeNonSED
yes yes yes normal 0 --- yes 12 0 0

If the output does not show licensed, enabled, BackupSaved, and FIPS as "yes" this is a finding.

If the state is not "normal", this is a finding.

If Keystore is not "EKM", this is a finding.

Vulnerability Number

V-283027

Documentable

False

Rule Version

ASMP-WS-000630

Severity Override Guidance

Verify HPE Alletra Storage MP is configured to provide backend drive encryption with the following command:

Cli%controlencryption status -d
Licensed Enabled BackupSaved State SeqNum Keystore FIPS non-SEDs FailedDisks nodeNonSED
yes yes yes normal 0 --- yes 12 0 0

If the output does not show licensed, enabled, BackupSaved, and FIPS as "yes" this is a finding.

If the state is not "normal", this is a finding.

If Keystore is not "EKM", this is a finding.

Check Content Reference

M

Target Key

5741