STIGhub
STIGs
RMF Controls
Compare
← AC-17 (2) — Remote Access
CCI-001453
Definition
Implement cryptographic mechanisms to protect the integrity of remote access sessions.
Parent Control
AC-17 (2)
Remote Access
Access Control
Linked STIG Checks (200)
V-279031
CAT II
The ColdFusion built-in Tomcat Web Server must use FIPS-validated ciphers on secured connectors.
Adobe ColdFusion Security Technical Implementation Guide
V-274042
CAT I
Amazon Linux 2023 server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-2/140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Amazon Linux 2023 Security Technical Implementation Guide
V-274043
CAT I
Amazon Linux 2023 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2/140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Amazon Linux 2023 Security Technical Implementation Guide
V-283442
CAT I
The Amazon Linux 2023 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Amazon Linux 2023 Security Technical Implementation Guide
V-283443
CAT I
The Amazon Linux 2023 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Amazon Linux 2023 Security Technical Implementation Guide
V-268089
CAT I
NixOS must implement DOD-approved encryption to protect the confidentiality of remote access sessions.
Anduril NixOS Security Technical Implementation Guide
V-214230
CAT II
The Apache web server must use cryptography to protect the integrity of remote sessions.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214278
CAT II
The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
Apache Server 2.4 UNIX Site Security Technical Implementation Guide
V-214308
CAT II
The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222928
CAT III
HTTP Strict Transport Security (HSTS) must be enabled.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-257773
CAT I
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257774
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257775
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257165
CAT I
The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257166
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH server configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257167
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH server configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257293
CAT I
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257294
CAT I
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257295
CAT I
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268438
CAT I
The macOS system must limit SSHD to FIPS-compliant connections.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268439
CAT I
The macOS system must limit SSH to FIPS-compliant connections.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277046
CAT I
The macOS system must limit SSHD to FIPS-compliant connections.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277047
CAT I
The macOS system must limit SSH to FIPS-compliant connections.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204927
CAT II
The ALG providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Application Layer Gateway Security Requirements Guide
V-222397
CAT II
The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.
Application Security and Development Security Technical Implementation Guide
V-222398
CAT II
Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.
Application Security and Development Security Technical Implementation Guide
V-204710
CAT II
The application server must implement cryptography mechanisms to protect the integrity of the remote access session.
Application Server Security Requirements Guide
V-237320
CAT I
The ArcGIS Server must protect the integrity of remote access sessions by enabling HTTPS with DoD-approved certificates.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272629
CAT I
CylanceON-PREM must be configured to use TLS 1.2 or higher.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-256841
CAT I
Compliance Guardian must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
AvePoint Compliance Guardian Security Technical Implementation Guide
V-79039
CAT II
If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DoD approved certificates.
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-79045
CAT I
If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use SSL for LDAP lookup to connect to the Office Web App Server (e.g., SharePoint).
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-254724
CAT II
If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DOD approved certificates.
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-254727
CAT I
If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use SSL for LDAP lookup to connect to the Office Web App Server (e.g., SharePoint).
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-237352
CAT II
The CA API Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
CA API Gateway ALG Security Technical Implementation Guide
V-219312
CAT II
The Ubuntu operating system must configure the SSH daemon to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms to protect the integrity of nonlocal maintenance and diagnostic communications.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238216
CAT II
The Ubuntu operating system must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260532
CAT II
Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270668
CAT II
Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270670
CAT II
Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270671
CAT II
Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-239976
CAT II
The Cisco ASA remote access VPN server must be configured to use a FIPS-validated algorithm and hash function to protect the integrity of TLS remote access sessions.
Cisco ASA VPN Security Technical Implementation Guide
V-239978
CAT II
The Cisco ASA remote access VPN server must be configured to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions.
Cisco ASA VPN Security Technical Implementation Guide
V-234565
CAT I
Citrix Delivery Controller must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Delivery Controller Security Technical Implementation Guide
V-234257
CAT I
Citrix Linux Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Linux Virtual Delivery Agent Security Technical Implementation Guide
V-234253
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Windows Virtual Delivery Agent Security Technical Implementation Guide
V-213208
CAT I
Citrix Receiver must implement DoD-approved encryption.
Citrix XenDesktop 7.x Receiver Security Technical Implementation Guide
V-213213
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix XenDesktop 7.x Windows VDA Security Technical Implementation Guide
V-269113
CAT I
AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269115
CAT I
AlmaLinux OS 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269116
CAT I
The AlmaLinux 9 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269118
CAT II
AlmaLinux OS 9 must implement DOD-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269119
CAT I
The AlmaLinux OS 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-283675
CAT I
AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH connections.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-283676
CAT I
AlmaLinux OS 9 must implement DOD-approved encryption in the OpenSSL package.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233276
CAT II
The container platform must prohibit communication using TLS versions 1.0 and 1.1, and SSL 2.0 and 3.0.
Container Platform Security Requirements Guide
V-235777
CAT I
FIPS mode must be enabled on all Docker Engine - Enterprise nodes.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235874
CAT II
Docker Enterprise Universal Control Plane (UCP) must be configured to use TLS 1.2.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-279958
CAT II
The DNS implementation must be conformant to the IETF DNS specification.
Domain Name System (DNS) Security Requirements Guide
V-259986
CAT I
The Enterprise Voice, Video, and Messaging Endpoint must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-260046
CAT I
The Enterprise Voice, Video, and Messaging Session Manager must be configured to use only TLS 1.2 or greater for all TLS and SSL communications.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-215748
CAT II
The BIG-IP Core implementation must be configured to use NIST SP 800-52 Revision 1 compliant cryptography to protect the integrity of remote access sessions to virtual servers.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-266139
CAT I
The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-278381
CAT I
NGINX must use TLS 1.2, at a minimum, to protect data confidentiality using remote access.
F5 NGINX Security Technical Implementation Guide
V-203669
CAT I
The operating system must implement cryptography to protect the integrity of remote access sessions.
General Purpose Operating System Security Requirements Guide
V-255239
CAT II
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
HPE 3PAR SSMC Operating System Security Technical Implementation Guide
V-255251
CAT I
The SSMC web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-255254
CAT I
SSMC web server must use cryptography to protect the integrity of remote sessions.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-237818
CAT I
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-255272
CAT I
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide
V-266983
CAT II
AOS, when used as a VPN Gateway, must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.
HPE Aruba Networking AOS VPN Security Technical Implementation Guide
V-266557
CAT II
AOS must use Transport Layer Security (TLS) 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
HPE Aruba Networking AOS Wireless Security Technical Implementation Guide
V-215214
CAT II
If LDAP authentication is required on AIX, SSL must be used between LDAP clients and the LDAP servers to protect the integrity of remote access sessions.
IBM AIX 7.x Security Technical Implementation Guide
V-252570
CAT I
The IBM Aspera Console must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252590
CAT I
IBM Aspera Faspex must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252607
CAT I
IBM Aspera Shares feature must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252616
CAT I
The IBM Aspera High-Speed Transfer Endpoint must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252619
CAT II
The IBM Aspera High-Speed Transfer Endpoint must have a master-key set to encrypt the dynamic token encryption key.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252630
CAT I
The IBM Aspera High-Speed Transfer Server must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252635
CAT II
The IBM Aspera High-Speed Transfer Server must have a master-key set to encrypt the dynamic token encryption key.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-65207
CAT II
The DataPower Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
IBM DataPower ALG Security Technical Implementation Guide
V-24373
CAT II
Hardware Management Console management must be accomplished by using the out-of-band or direct connection method.
IBM Hardware Management Console (HMC) STIG
V-256888
CAT II
Hardware Management Console management must be accomplished by using the out-of-band or direct connection method.
IBM Hardware Management Console (HMC) Security Technical Implementation Guide
V-255776
CAT II
The MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-250324
CAT II
Security cookies must be set to HTTPOnly.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255832
CAT II
The WebSphere Application Server security cookies must be set to HTTPOnly.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223589
CAT I
IBM z/OS SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223610
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223807
CAT I
The IBM RACF SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm to protect confidential information and remote access sessions.
IBM z/OS RACF Security Technical Implementation Guide
V-223831
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS RACF Security Technical Implementation Guide
V-224044
CAT I
The SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm.
IBM z/OS TSS Security Technical Implementation Guide
V-224067
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS TSS Security Technical Implementation Guide
V-237906
CAT II
The IBM z/VM TCP/IP configuration must include an SSLSERVERID statement.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-224776
CAT II
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
ISEC7 Sphere Security Technical Implementation Guide
V-258586
CAT I
The ICS must be configured to use TLS 1.2, at a minimum.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-251014
CAT II
The Sentry providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide
V-251014
CAT II
The Sentry providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Ivanti Sentry 9.x ALG Security Technical Implementation Guide
V-213495
CAT II
HTTPS must be enabled for JBoss web interfaces.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-66649
CAT II
The Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA1 or greater to negotiate hashing to protect the integrity of remote access sessions.
Juniper SRX SG VPN Security Technical Implementation Guide
V-214675
CAT II
The Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA256 or greater to negotiate hashing to protect the integrity of remote access sessions.
Juniper SRX Services Gateway VPN Security Technical Implementation Guide
V-220851
CAT II
The Remote Desktop Session Host must require secure RPC communications.
Microsoft Windows 10 Security Technical Implementation Guide
V-253405
CAT II
The Remote Desktop Session Host must require secure RPC communications.
Microsoft Windows 11 Security Technical Implementation Guide
V-224947
CAT II
The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224948
CAT II
Remote Desktop Services must be configured with the client connection encryption set to High Level.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205636
CAT II
Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205637
CAT II
Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254368
CAT II
Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254369
CAT II
Windows Server 2022 Remote Desktop Services must be configured with the client connection encryption set to High Level.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278115
CAT II
Windows Server 2025 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278116
CAT II
Windows Server 2025 Remote Desktop Services must be configured with the client connection encryption set to High Level.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-251546
CAT I
Firefox must be configured to allow only TLS 1.2 or above.
Mozilla Firefox Security Technical Implementation Guide
V-243209
CAT II
WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.
Network WLAN AP-IG Platform Security Technical Implementation Guide
V-243212
CAT II
The WLAN access point must be configured for Wi-Fi Alliance WPA2 or WPA3 security.
Network WLAN AP-IG Platform Security Technical Implementation Guide
V-243219
CAT II
WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.
Network WLAN AP-NIPR Platform Security Technical Implementation Guide
V-243228
CAT II
WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.
Network WLAN Bridge Platform Security Technical Implementation Guide
V-254099
CAT I
Nutanix AOS must implement cryptography mechanisms to protect the confidentiality and integrity of the remote access session.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-254125
CAT I
Nutanix AOS must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279418
CAT II
Nutanix AOS must have TLS enabled.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279534
CAT I
Nutanix OS must implement cryptography to protect the integrity of remote access sessions by using only HMACs employing FIPS 140-3-approved algorithms.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279535
CAT I
Nutanix OS must implement cryptography to protect the integrity of remote access session by setting the systemwide policy to use FIPS mode.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279536
CAT I
Nutanix OS must implement TLS to protect the integrity and confidentiality of remote access and nonlocal maintenance and diagnostic sessions.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279537
CAT I
Nutanix OS must implement cryptography to protect the integrity of remote access sessions.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279538
CAT I
Nutanix OS must implement cryptography to protect the integrity and confidentiality of remote access and nonlocal maintenance and diagnostic sessions.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-221281
CAT I
OHS must have the LoadModule ossl_module directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221282
CAT I
OHS must have the SSLFIPS directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221283
CAT I
OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221284
CAT I
OHS must have the SSLCipherSuite directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221285
CAT II
OHS must have the SecureProxy directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221286
CAT II
OHS must have the WLSSLWallet directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221287
CAT II
OHS must have the WebLogicSSLVersion directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221288
CAT II
OHS must have the WLProxySSL directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221843
CAT II
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.
Oracle Linux 7 Security Technical Implementation Guide
V-221844
CAT II
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
Oracle Linux 7 Security Technical Implementation Guide
V-221845
CAT II
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
Oracle Linux 7 Security Technical Implementation Guide
V-221857
CAT II
The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
Oracle Linux 7 Security Technical Implementation Guide
V-255899
CAT II
The Oracle Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
Oracle Linux 7 Security Technical Implementation Guide
V-248524
CAT I
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 8 Security Technical Implementation Guide
V-283448
CAT I
The OL 8 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Oracle Linux 8 Security Technical Implementation Guide
V-283449
CAT I
The OL 8 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Oracle Linux 8 Security Technical Implementation Guide
V-283457
CAT I
The OL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 8 Security Technical Implementation Guide
V-283458
CAT I
The OL 8 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 8 Security Technical Implementation Guide
V-271485
CAT I
OL 9 SSH server must be configured to use only ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 9 Security Technical Implementation Guide
V-271486
CAT I
OL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Oracle Linux 9 Security Technical Implementation Guide
V-271489
CAT I
OL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Oracle Linux 9 Security Technical Implementation Guide
V-271490
CAT I
OL 9 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Oracle Linux 9 Security Technical Implementation Guide
V-235929
CAT II
Oracle WebLogic must use cryptography to protect the integrity of the remote access session.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-228835
CAT II
The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Palo Alto Networks ALG Security Technical Implementation Guide
V-254553
CAT I
Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-281009
CAT I
RHEL 10 must enable FIPS mode.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281010
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281011
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281012
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) clients use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281013
CAT I
RHEL 10 must be configured so that Secure Shell (SSH) servers use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204581
CAT II
The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204582
CAT II
The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204583
CAT II
The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204595
CAT II
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-255925
CAT II
The Red Hat Enterprise Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-230251
CAT I
The RHEL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-230252
CAT I
The RHEL 8 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-272482
CAT I
The RHEL 8 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-272483
CAT I
The RHEL 8 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-257989
CAT I
The RHEL 9 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257991
CAT I
The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-270177
CAT I
The RHEL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-270178
CAT I
The RHEL 9 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257506
CAT II
OpenShift must use TLS 1.2 or greater for secure communication.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275625
CAT I
Ubuntu OS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2/140-3 -approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Riverbed NetIM OS Security Technical Implementation Guide
V-238503
CAT II
The Riverbed Optimization System (RiOS) providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Riverbed SteelHead CX v8 ALG Security Technical Implementation Guide
V-255914
CAT II
The SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
SLES 12 Security Technical Implementation Guide
V-254087
CAT I
Innoslate must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-261334
CAT I
SLEM 5 must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-261336
CAT I
SLEM 5 SSH server must be configured to use only FIPS 140-2/140-3 validated key exchange algorithms.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217271
CAT II
The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-255914
CAT II
The SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-22448
CAT II
The SNMP service must require the use of a FIPS 140-2 approved cryptographic hash algorithm as part of its authentication and integrity methods.
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide
V-22460
CAT II
The SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide
V-22463
CAT II
The SSH client must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide
V-22555
CAT II
If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide
V-216387
CAT II
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
Solaris 11 SPARC Security Technical Implementation Guide
V-216150
CAT II
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
Solaris 11 X86 Security Technical Implementation Guide
V-240976
CAT II
The Tanium endpoint must have the Tanium Servers public key in its installation, which will allow it to authenticate and uniquely identify all network-connected endpoint devices before establishing any connection.
Tanium 7.0 Security Technical Implementation Guide
V-241018
CAT II
Tanium Trusted Content providers must be documented.
Tanium 7.0 Security Technical Implementation Guide
V-241019
CAT II
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
Tanium 7.0 Security Technical Implementation Guide
V-241020
CAT II
Tanium public keys of content providers must be validated against documented trusted content providers.
Tanium 7.0 Security Technical Implementation Guide
V-234035
CAT II
The Tanium endpoint must have the Tanium Servers public key in its installation.
Tanium 7.3 Security Technical Implementation Guide
V-234079
CAT II
Tanium Trusted Content providers must be documented.
Tanium 7.3 Security Technical Implementation Guide
V-234080
CAT II
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
Tanium 7.3 Security Technical Implementation Guide
V-234081
CAT II
Tanium public keys of content providers must be validated against documented trusted content providers.
Tanium 7.3 Security Technical Implementation Guide
V-254877
CAT II
The Tanium Server must be set to only allow connections from endpoints when TLS is used.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254878
CAT II
Tanium Trusted Content providers must be documented.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254879
CAT II
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-254880
CAT II
Tanium public keys of content providers must be validated against documented trusted content providers.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-253805
CAT II
The Tanium endpoint must have the Tanium Server's pki.db in its installation.
Tanium 7.x Security Technical Implementation Guide
V-253838
CAT II
Tanium Trusted Content providers must be documented.
Tanium 7.x Security Technical Implementation Guide
V-253839
CAT II
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
Tanium 7.x Security Technical Implementation Guide
V-253840
CAT II
Tanium public keys of content providers must be validated against documented trusted content providers.
Tanium 7.x Security Technical Implementation Guide
V-252919
CAT I
The TOSS operating system must implement DOD-approved encryption in the OpenSSL package.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-252924
CAT I
The TOSS operating system must implement DOD-approved encryption to protect the confidentiality of SSH connections.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-252925
CAT I
The TOSS operating system must implement DOD-approved TLS encryption in the GnuTLS package.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide