STIGhub
STIGs
RMF Controls
Compare
← IA-5 (2) — Authenticator Management
CCI-000186
Definition
For public key-based authentication, enforce authorized access to the corresponding private key.
Parent Control
IA-5 (2)
Authenticator Management
Identification and Authentication
Linked STIG Checks (122)
V-204677
CAT II
AAA Services must be configured to enforce authorized access to the corresponding private key for PKI-based authentication.
AAA Services Security Requirements Guide
V-279063
CAT II
ColdFusion must be configured to use only DOD-approved keystores and truststores containing certificates issued by a DOD Public Key Infrastructure (PKI) Certificate Authority (CA), and all keystore and truststore files must be protected by file system permissions that prevent unauthorized access or modification.
Adobe ColdFusion Security Technical Implementation Guide
V-274064
CAT II
Amazon Linux 2023, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Amazon Linux 2023 Security Technical Implementation Guide
V-268125
CAT II
NixOS must enforce authorized access to the corresponding private key for PKI-based authentication.
Anduril NixOS Security Technical Implementation Guide
V-214246
CAT II
The Apache web server must be configured to use a specified IP address and port.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214287
CAT II
Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
Apache Server 2.4 UNIX Site Security Technical Implementation Guide
V-214371
CAT II
Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-222931
CAT I
Default password for keystore must be changed.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222967
CAT II
Keystore file must be protected.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252477
CAT II
The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257183
CAT II
The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DOD PKI-established certificate authorities for verification of the establishment of protected sessions.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-259477
CAT I
The macOS system must disable password authentication for SSH.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259545
CAT II
The macOS system must enforce smart card authentication.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-268477
CAT I
The macOS system must disable password authentication for SSH.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268542
CAT II
The macOS system must enforce smart card authentication.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277084
CAT I
The macOS system must disable password authentication for SSH.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277150
CAT II
The macOS system must enforce smart card authentication.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-222551
CAT I
The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Application Security and Development Security Technical Implementation Guide
V-204755
CAT II
Only authenticated system administrators or the designated PKI Sponsor for the application server must have access to the web servers private key.
Application Server Security Requirements Guide
V-237322
CAT I
The ArcGIS Server must use Windows authentication to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276012
CAT I
Ax-OS must have no local accounts for the user interface.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-272372
CAT II
The BIND 9.x server private key corresponding to the zone-signing key (ZSK) pair must be the only DNSSEC key kept on a name server that supports dynamic updates.
BIND 9.x Security Technical Implementation Guide
V-272373
CAT II
The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.
BIND 9.x Security Technical Implementation Guide
V-272375
CAT II
The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.
BIND 9.x Security Technical Implementation Guide
V-272376
CAT II
A unique TSIG key used by a BIND 9.x server must be generated for each pair of communicating hosts.
BIND 9.x Security Technical Implementation Guide
V-272377
CAT II
The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.
BIND 9.x Security Technical Implementation Guide
V-272378
CAT II
The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.
BIND 9.x Security Technical Implementation Guide
V-206479
CAT I
The Central Log Server, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Central Log Server Security Requirements Guide
V-269410
CAT II
For PKI-based authentication, AlmaLinux OS 9 must enforce authorized access to the corresponding private key.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233602
CAT I
PostgreSQL must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261894
CAT I
PostgreSQL must enforce authorized access to all PKI private keys stored/used by PostgreSQL.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206559
CAT I
The DBMS must enforce authorized access to all PKI private keys stored/utilized by the DBMS.
Database Security Requirements Guide
V-235822
CAT II
The certificate chain used by Universal Control Plane (UCP) client bundles must match what is defined in the System Security Plan (SSP) in Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235823
CAT II
Docker Enterprise Swarm manager must be run in auto-lock mode.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235824
CAT II
Docker Enterprise secret management commands must be used for managing secrets in a Swarm cluster.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205170
CAT II
The DNS server implementation, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Domain Name System (DNS) Security Requirements Guide
V-205171
CAT II
The key file must be owned by the account under which the name server software is run.
Domain Name System (DNS) Security Requirements Guide
V-205172
CAT II
Read/Write access to the key file must be restricted to the account that runs the name server software only.
Domain Name System (DNS) Security Requirements Guide
V-205173
CAT II
Only the private key corresponding to the ZSK alone must be kept on the name server that does support dynamic updates.
Domain Name System (DNS) Security Requirements Guide
V-205174
CAT II
Signature generation using the KSK must be done off-line, using the KSK-private stored off-line.
Domain Name System (DNS) Security Requirements Guide
V-271034
CAT II
Dragos Platform must accept the DOD CAC or other PKI credential for identity management and personal authentication.
Dragos Platform 2.x Security Technical Implementation Guide
V-224170
CAT I
The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213600
CAT I
The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259250
CAT I
The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/used by the EDB Postgres Advanced Server.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-278392
CAT II
NGINX, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
F5 NGINX Security Technical Implementation Guide
V-203623
CAT II
The operating system, for PKI-based authentication, must enforce authorized access to the corresponding private key.
General Purpose Operating System Security Requirements Guide
V-255264
CAT II
SSMC web server application, libraries, and configuration files must only be accessible to privileged users.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-215321
CAT II
AIX SSH private host key files must have mode 0600 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-255873
CAT I
The WebSphere Application Server default keystore passwords must be changed.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223568
CAT II
IBM z/OS must use ICSF or SAF Key Rings for key management.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223883
CAT II
IBM z/OS for PKI-based authentication must use ICSF or the ESM to store keys.
IBM z/OS TSS Security Technical Implementation Guide
V-237910
CAT II
The IBM z/VM TCP/IP Key database for LDAP or SSL server must be created with the proper permissions.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-214165
CAT II
Only the private key corresponding to the ZSK alone must be kept on the name server that does support dynamic updates.
Infoblox 7.x DNS Security Technical Implementation Guide
V-214166
CAT II
Signature generation using the KSK must be done off-line, using the KSK-private stored off-line.
Infoblox 7.x DNS Security Technical Implementation Guide
V-233902
CAT II
Infoblox systems that communicate with non-Grid DNS service members must use a unique Transaction Signature (TSIG).
Infoblox 8.x DNS Security Technical Implementation Guide
V-233903
CAT I
The Infoblox Grid Master must be configured as a stealth (hidden) domain DNS service member to protect the Key Signing Key (KSK) residing on it.
Infoblox 8.x DNS Security Technical Implementation Guide
V-233904
CAT I
The Infoblox Grid Master must be configured as a stealth (hidden) domain DNS service member in order to protect the Zone Signing Key (ZSK) residing on it.
Infoblox 8.x DNS Security Technical Implementation Guide
V-213534
CAT II
The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-213968
CAT I
SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205506
CAT II
The Mainframe Product, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Mainframe Product Security Requirements Guide
V-253700
CAT I
MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220367
CAT I
MarkLogic Server must enforce authorized access to all PKI private keys stored/utilized by the DBMS.
MarkLogic Server v9 Security Technical Implementation Guide
V-225226
CAT II
Encryption keys used for the .NET Strong Name Membership Condition must be protected.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-271314
CAT I
SQL Server must use NIST FIPS 140-2 or 140-3 validated cryptographic operations for encryption, hashing, and signing.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-215604
CAT II
The Windows 2012 DNS Server must be configured to enforce authorized access to the corresponding private key.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-215605
CAT II
The Windows 2012 DNS Server key file must be owned by the account under which the Windows 2012 DNS Server service is run.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-215606
CAT II
The Windows 2012 DNS Server permissions must be set so that the key file can only be read or modified by the account that runs the name server software.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-215607
CAT II
The private key corresponding to the ZSK must only be stored on the name server that does support dynamic updates.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-225058
CAT II
Users must be required to enter a password to access private keys stored on the computer.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205651
CAT II
Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254479
CAT II
Windows Server 2022 users must be required to enter a password to access private keys stored on the computer.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278229
CAT II
Windows Server 2025 users must be required to enter a password to access private keys stored on the computer.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-259367
CAT II
The Windows DNS Server must be configured to enforce authorized access to the corresponding private key.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-259368
CAT II
The Windows DNS Server key file must be owned by the account under which the Windows DNS Server service is run.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-259370
CAT II
The private key corresponding to the zone signing key (ZSK) must only be stored on the name server that does support dynamic updates.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-259410
CAT II
A unique Transaction Signature (TSIG) key must be generated for each pair of communicating hosts.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-221172
CAT I
MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252160
CAT I
MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265919
CAT I
MongoDB must enforce authorized access to all PKI private keys stored/used by MongoDB.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279351
CAT I
MongoDB must enforce authorized access to all PKI private keys stored/used by the DBMS.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-219747
CAT I
The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Oracle Database 11.2g Security Technical Implementation Guide
V-220263
CAT I
The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Oracle Database 12c Security Technical Implementation Guide
V-270566
CAT I
Oracle Database, when using public key infrastructure (PKI)-based authentication, must enforce authorized access to the corresponding private key.
Oracle Database 19c Security Technical Implementation Guide
V-248532
CAT II
OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
Oracle Linux 8 Security Technical Implementation Guide
V-271605
CAT II
OL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Oracle Linux 9 Security Technical Implementation Guide
V-235135
CAT I
The MySQL Database Server 8.0 must enforce authorized access to all PKI private keys stored/utilized by the MySQL Database Server 8.0.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-214136
CAT I
PostgreSQL must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
PostgreSQL 9.x Security Technical Implementation Guide
V-281326
CAT II
RHEL 10 must, for PKI-based authentication, enforce authorized access to the corresponding private key.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-230230
CAT II
RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-258127
CAT II
RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-251226
CAT I
Redis Enterprise DBMS must enforce authorized access to all PKI private keys stored/used by Redis Enterprise DBMS.
Redis Enterprise 6.x Security Technical Implementation Guide
V-73077
CAT II
Access to the SDN management and orchestration systems must be authenticated using a FIPS-approved message authentication code algorithm.
SDN Using NV Security Technical Implementation Guide
V-73083
CAT II
Southbound API management plane traffic for provisioning and configuring virtual network elements within the SDN infrastructure must be authenticated using a FIPS-approved message authentication code algorithm.
SDN Using NV Security Technical Implementation Guide
V-73087
CAT II
Southbound API management plane traffic for configuring SDN parameters on physical network elements must be authenticated using DOD PKI certificate-based authentication.
SDN Using NV Security Technical Implementation Guide
V-254093
CAT I
Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-261342
CAT II
SLEM 5, for PKI-based authentication, must enforce authorized access to the corresponding private key.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-241032
CAT I
The Tanium Server certificate and private/public keys directory must be protected with appropriate permissions.
Tanium 7.0 Security Technical Implementation Guide
V-234093
CAT I
The Tanium Server certificate and private/public keys directory must be protected with appropriate permissions.
Tanium 7.3 Security Technical Implementation Guide
V-252913
CAT II
TOSS, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282443
CAT II
TOSS 5, for public key infrastructure (PKI)-based authentication, must enforce authorized access to the corresponding private key.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-234240
CAT II
The UEM Agent must use managed endpoint device key storage for all persistent secret and private keys.
Unified Endpoint Management Agent Security Requirements Guide
V-234380
CAT II
The UEM server, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Unified Endpoint Management Server Security Requirements Guide
V-240064
CAT II
HAProxys private key must have access restricted.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240249
CAT II
Lighttpd must have private key access restricted.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240805
CAT II
tc Server ALL must only allow authenticated system administrators to have access to the keystore.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240941
CAT I
The vAMI private key must only be accessible to authenticated system administrators or the designated PKI Sponsor.
VMware vRealize Automation 7.x vAMI Security Technical Implementation Guide
V-241658
CAT II
tc Server ALL must only allow authenticated system administrators to have access to the keystore.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241659
CAT II
tc Server ALL must only allow authenticated system administrators to have access to the truststore.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256661
CAT II
VAMI must protect the keystore from unauthorized access.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256602
CAT I
VMware Postgres must enforce authorized access to all public key infrastructure (PKI) private keys.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256741
CAT II
The Envoy private key file must be protected from unauthorized access.
VMware vSphere 7.0 vCenter Appliance RhttpProxy Security Technical Implementation Guide
V-259162
CAT II
The vCenter Envoy service private key file must be protected from unauthorized access.
VMware vSphere 8.0 vCenter Appliance Envoy Security Technical Implementation Guide
V-259147
CAT II
The vCenter VAMI service must restrict access to the web server's private key.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-259177
CAT I
The vCenter PostgreSQL service must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-207370
CAT II
The VMM, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Virtual Machine Manager Security Requirements Guide
V-207215
CAT II
The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.
Virtual Private Network (VPN) Security Requirements Guide
V-206389
CAT II
Only authenticated system administrators or the designated PKI Sponsor for the web server must have access to the web servers private key.
Web Server Security Requirements Guide
V-73699
CAT II
Users must be required to enter a password to access private keys stored on the computer.
Windows Server 2016 Security Technical Implementation Guide
V-73699
CAT II
Users must be required to enter a password to access private keys stored on the computer.
Windows Server 2016 Security Technical Implementation Guide
V-93493
CAT II
Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.
Windows Server 2019 Security Technical Implementation Guide
V-269574
CAT I
Xylok Security Suite must use a centralized user management solution.
Xylok Security Suite 20.x Security Technical Implementation Guide