STIGhub
STIGs
RMF Controls
Compare
← CM-5 (1) — Access Restrictions for Change
CCI-001813
Definition
Enforce access restrictions using organization-defined mechanisms.
Parent Control
CM-5 (1)
Access Restrictions for Change
Configuration Management
Linked STIG Checks (170)
V-213124
CAT II
Adobe Acrobat Pro DC Continuous privileged file and folder locations must be disabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213139
CAT III
Adobe Acrobat Pro DC Continuous privileged host locations must be disabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213188
CAT II
Adobe Reader DC must disable the ability to add Trusted Files and Folders.
Adobe Acrobat Reader DC Continuous Track Security Technical Implementation Guide
V-213189
CAT II
Adobe Reader DC must disable the ability to elevate IE Trusts to Privileged Locations.
Adobe Acrobat Reader DC Continuous Track Security Technical Implementation Guide
V-279050
CAT II
ColdFusion must be configured with secure and approved server settings to enforce application hardening, input validation, error handling, and protection against common web vulnerabilities.
Adobe ColdFusion Security Technical Implementation Guide
V-274044
CAT II
Amazon Linux 2023 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
Amazon Linux 2023 Security Technical Implementation Guide
V-274045
CAT II
Amazon Linux 2023 SSH daemon must not allow Kerberos authentication.
Amazon Linux 2023 Security Technical Implementation Guide
V-214248
CAT I
Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214299
CAT II
The Apache web server application, libraries, and configuration files must only be accessible to privileged users.
Apache Server 2.4 UNIX Site Security Technical Implementation Guide
V-214322
CAT I
Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214373
CAT I
Anonymous user access to the Apache web server application directories must be prohibited.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-222945
CAT II
Files in the $CATALINA_BASE/conf/ folder must have their permissions set to 640.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222946
CAT II
$CATALINA_BASE/conf folder permissions must be set to 750.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222986
CAT II
$CATALINA_HOME folder must be owned by the root user, group tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222987
CAT II
$CATALINA_BASE/conf/ folder must be owned by root, group tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222988
CAT II
$CATALINA_BASE/logs/ folder must be owned by tomcat user, group tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222989
CAT III
$CATALINA_BASE/temp/ folder must be owned by tomcat user, group tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222990
CAT III
$CATALINA_BASE/temp folder permissions must be set to 750.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222991
CAT II
$CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252513
CAT I
The macOS system must enforce access restrictions.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257219
CAT I
The macOS system must disable the guest account.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-259511
CAT II
The macOS system must disable the guest account.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-268443
CAT II
The macOS system must disable root login.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268472
CAT II
The macOS system must disable root login for SSH.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268510
CAT II
The macOS system must disable the guest account.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277051
CAT II
The macOS system must disable root login.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277079
CAT II
The macOS system must disable root login for SSH.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277119
CAT II
The macOS system must disable the guest account.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-222511
CAT II
The application must enforce access restrictions associated with changes to application configuration.
Application Security and Development Security Technical Implementation Guide
V-204796
CAT II
The application server must enforce access restrictions associated with changes to application server configuration.
Application Server Security Requirements Guide
V-237334
CAT II
The ArcGIS Server must enforce access restrictions associated with changes to application configuration.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-255957
CAT II
If the Arista network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.
Arista MLS EOS 4.2x NDM Security Technical Implementation Guide
V-255957
CAT II
If the Arista network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-276005
CAT II
Ax-OS must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-251603
CAT II
The commands that allow dynamic definitions of PROGRAM/TASK and the dynamic varying of memory must be secured.
CA IDMS Security Technical Implementation Guide
V-251604
CAT II
Databases must be secured to protect from structural changes.
CA IDMS Security Technical Implementation Guide
V-251605
CAT II
Database utilities must be secured in CA IDMS and permissions given to appropriate role(s)/groups(s) in the external security manager (ESM).
CA IDMS Security Technical Implementation Guide
V-251606
CAT II
The online debugger which can change programs and storage in the CA IDMS address space must be secured.
CA IDMS Security Technical Implementation Guide
V-251640
CAT II
CA IDMS programs that can be run through a CA IDMS CV must be defined to the CV.
CA IDMS Security Technical Implementation Guide
V-269161
CAT II
AlmaLinux OS 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269162
CAT II
AlmaLinux OS 9 SSH daemon must not allow Kerberos authentication.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233188
CAT II
The container platform must enforce access restrictions for container platform configuration changes.
Container Platform Security Requirements Guide
V-270876
CAT II
The container root filesystem must be mounted as read-only.
Container Platform Security Requirements Guide
V-233597
CAT II
PostgreSQL must enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261924
CAT II
PostgreSQL must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206597
CAT II
The DBMS must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
Database Security Requirements Guide
V-235781
CAT II
A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235782
CAT II
A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-224201
CAT II
The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213626
CAT II
The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259284
CAT II
The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-217415
CAT II
The BIG-IP appliance must be configured to enforce access restrictions associated with changes to device configuration.
F5 BIG-IP Device Management Security Technical Implementation Guide
V-278397
CAT II
NGINX must restrict access to configuration files.
F5 NGINX Security Technical Implementation Guide
V-230947
CAT II
Forescout must enforce access restrictions associated with changes to device configuration.
Forescout Network Device Management Security Technical Implementation Guide
V-234189
CAT II
The FortiGate device must enforce access restrictions associated with changes to device configuration.
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V-203718
CAT II
The operating system must enforce access restrictions.
General Purpose Operating System Security Requirements Guide
V-255264
CAT II
SSMC web server application, libraries, and configuration files must only be accessible to privileged users.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-215246
CAT II
AIX must provide audit record generation functionality for DoD-defined auditable events.
IBM AIX 7.x Security Technical Implementation Guide
V-213724
CAT II
DB2 and the operating system must enforce access restrictions associated with changes to the configuration of DB2 or database(s).
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-65159
CAT II
The DataPower Gateway must enforce access restrictions associated with changes to device configuration.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-250344
CAT II
The server.xml file must be protected from unauthorized modification.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255828
CAT II
The WebSphere Application Server users in a local user registry group must be authorized for that group.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-255835
CAT II
The WebSphere Application Server users in the admin role must be authorized.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223464
CAT I
CA-ACF2 must be installed, functional, and properly configured.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223702
CAT II
IBM RACF SETROPTS RVARYPW values must be properly set.
IBM z/OS RACF Security Technical Implementation Guide
V-224020
CAT I
CA-TSS must be installed and properly configured.
IBM z/OS TSS Security Technical Implementation Guide
V-224789
CAT II
The Apache Tomcat shutdown port must be disabled.
ISEC7 Sphere Security Technical Implementation Guide
V-224790
CAT II
The ISEC7 SPHERE must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.
ISEC7 Sphere Security Technical Implementation Guide
V-258600
CAT I
The ICS must be configured to prevent nonprivileged users from executing privileged functions.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-213542
CAT II
Production JBoss servers must not allow automatic application deployment.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-241803
CAT II
The MySQL DatabasePassword key must be removed or set to a blank value in the database configuration file in Jamf Pro EMM.
Jamf Pro v10.x EMM Security Technical Implementation Guide
V-253923
CAT II
The Juniper EX switch must be configured to enforce access restrictions associated with changes to device configuration.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-213873
CAT II
SQL Server and Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance or database(s).
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213924
CAT II
SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).
MS SQL Server 2016 Database Security Technical Implementation Guide
V-213987
CAT II
SQL Server must enforce access restrictions associated with changes to the configuration of the instance.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-213988
CAT II
Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205566
CAT II
The Mainframe Product must enforce access restrictions associated with changes to application configuration.
Mainframe Product Security Requirements Guide
V-253732
CAT II
MariaDB must enforce access restrictions associated with changes to the configuration of MariaDB or database(s).
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-255319
CAT II
Azure SQL Database must enforce access restrictions associated with changes to the configuration of the Azure SQL Database server or database(s).
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276235
CAT II
Azure SQL Managed Instance must enforce access restrictions associated with changes to the configuration of the database(s).
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-276308
CAT II
Azure SQL Managed Instance must enforce access restrictions associated with changes to the configuration of the instance.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-276309
CAT II
Azure Resource Manager must enforce access restrictions associated with changes to the configuration of Azure SQL Managed Instance.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-221255
CAT II
The Exchange software baseline copy must exist.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-228401
CAT II
An Exchange software baseline copy must exist.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259633
CAT II
The Exchange software baseline copy must exist.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259700
CAT II
An Exchange software baseline copy must exist.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-218816
CAT II
Access to web administration tools must be restricted to the web manager and the web managers designees.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-271195
CAT II
SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).
Microsoft SQL Server 2022 Database Security Technical Implementation Guide
V-271349
CAT II
Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-271350
CAT II
SQL Server must enforce access restrictions associated with changes to the configuration of the instance.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-260906
CAT I
Least privilege access and need to know must be required to access MKE runtime and instantiate container images.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-221192
CAT II
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252175
CAT II
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265942
CAT II
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279381
CAT II
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-246939
CAT II
ONTAP must enforce access restrictions associated with changes to the device configuration.
NetApp ONTAP DSC 9.x Security Technical Implementation Guide
V-202106
CAT II
The network device must enforce access restrictions associated with changes to device configuration.
Network Device Management Security Requirements Guide
V-254108
CAT II
Nutanix AOS must enforce access restrictions associated with changes to application server configuration.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-254189
CAT II
Nutanix AOS must not be configured to allow GSSAPIAuthentication.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-254190
CAT II
Nutanix AOS must not be configured to allow KerberosAuthentication.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279431
CAT II
Nutanix AOS must enforce access restrictions associated with changes to configuration and software libraries.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279578
CAT II
Nutanix OS must prevent SSH from permitting Generic Security Service Application Program Interface (GSSAPI) authentication.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279579
CAT II
Nutanix AHV must not be configured to allow Kerberos authentication.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-238454
CAT II
The DBMS must support enforcement of logical access restrictions associated with changes to the DBMS configuration and to the database itself.
Oracle Database 11.2g Security Technical Implementation Guide
V-237719
CAT II
The DBMS must support enforcement of logical access restrictions associated with changes to the DBMS configuration and to the database itself.
Oracle Database 12c Security Technical Implementation Guide
V-270512
CAT II
Oracle Database must support enforcement of logical access restrictions associated with changes to the database management system (DBMS) configuration and to the database itself.
Oracle Database 19c Security Technical Implementation Guide
V-221762
CAT II
The Oracle Linux operating system must not allow removable media to be used as the boot loader unless approved.
Oracle Linux 7 Security Technical Implementation Guide
V-221860
CAT II
The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.
Oracle Linux 7 Security Technical Implementation Guide
V-221861
CAT II
The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.
Oracle Linux 7 Security Technical Implementation Guide
V-271704
CAT II
OL 9 SSH daemon must not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
Oracle Linux 9 Security Technical Implementation Guide
V-271718
CAT II
OL 9 SSH daemon must not allow Kerberos authentication.
Oracle Linux 9 Security Technical Implementation Guide
V-235169
CAT II
The MySQL Database Server 8.0 must enforce access restrictions associated with changes to the configuration of the MySQL Database Server 8.0 or database(s).
Oracle MySQL 8.0 Security Technical Implementation Guide
V-253524
CAT II
Users requiring access to Prisma Cloud Compute's Credential Store must be assigned and accessed by the appropriate role holders.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-214131
CAT II
PostgreSQL must enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).
PostgreSQL 9.x Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-281254
CAT II
RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281255
CAT II
RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Kerberos authentication.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204479
CAT II
The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204488
CAT II
The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204501
CAT II
The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204575
CAT II
The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204598
CAT II
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204599
CAT II
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-204621
CAT I
The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-258003
CAT II
RHEL 9 SSH daemon must not allow GSSAPI authentication.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258004
CAT II
RHEL 9 SSH daemon must not allow Kerberos authentication.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257513
CAT I
OpenShift role-based access controls (RBAC) must be enforced.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251209
CAT II
Redis Enterprise DBMS must enforce access restrictions associated with changes to the configuration of Redis Enterprise DBMS or database(s).
Redis Enterprise 6.x Security Technical Implementation Guide
V-206743
CAT II
The SDN controller must be configured to enforce access restrictions associated with changes to the configuration.
SDN Controller Security Requirements Guide
V-279250
CAT I
The Edge SWG must be configured to assign appropriate user roles or access levels to authenticated users.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-241008
CAT II
Tanium must prohibit user installation of software without explicit privileged status and enforce access restrictions associated with changes to application configuration.
Tanium 7.0 Security Technical Implementation Guide
V-234069
CAT II
The Tanium application must prohibit user installation of software without explicit privileged status.
Tanium 7.3 Security Technical Implementation Guide
V-254939
CAT II
The application must enforce access restrictions associated with changes to application configuration.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-253796
CAT II
The application must enforce access restrictions associated with changes to application configuration.
Tanium 7.x Security Technical Implementation Guide
V-241164
CAT II
Trend Deep Security must enforce access restrictions associated with changes to application configuration.
Trend Micro Deep Security 9.x Security Technical Implementation Guide
V-242248
CAT II
The TippingPoint SMS must enforce access restrictions associated with changes to device configuration.
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-242254
CAT I
The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-282581
CAT II
TOSS 5 SSH daemon must not allow Kerberos authentication.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-234523
CAT II
The UEM server must enforce access restrictions associated with changes to the server configuration.
Unified Endpoint Management Server Security Requirements Guide
V-240080
CAT II
HAProxy libraries, and configuration files must only be accessible to privileged users.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240309
CAT II
The DBMS must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239809
CAT II
The vROps PostgreSQL DB must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-265292
CAT I
The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
VMware NSX 4.x Manager NDM Security Technical Implementation Guide
V-240265
CAT II
Lighttpd must prohibit non-privileged accounts from accessing the application, libraries, and configuration files.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240854
CAT II
tc Server HORIZON application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240855
CAT II
tc Server VCO application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240856
CAT II
tc Server VCAC application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240951
CAT II
The vAMI configuration file must be protected from unauthorized access.
VMware vRealize Automation 7.x vAMI Security Technical Implementation Guide
V-241710
CAT II
tc Server UI application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241711
CAT II
tc Server CaSa application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241712
CAT II
tc Server API application, libraries, and configuration files must only be accessible to privileged users.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256653
CAT II
VAMI server binaries and libraries must be verified for their integrity.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256689
CAT II
ESX Agent Manager directory tree must have permissions in an out-of-the-box state.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256702
CAT II
ESX Agent Manager must set the secure flag for cookies.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256722
CAT II
Lookup Service directory tree must have permissions in an out-of-the-box state.
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-256627
CAT II
Performance Charts directory tree must have permissions in an out-of-the-box state.
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-256593
CAT II
VMware Postgres configuration files must not be accessible by unauthorized users.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256761
CAT II
The Security Token Service directory tree must have permissions in an out-of-the-box state.
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide
V-256794
CAT II
The vSphere UI directory tree must have permissions in an out-of-the-box state.
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide
V-256335
CAT II
The vCenter Server users must have the correct roles assigned.
VMware vSphere 7.0 vCenter Security Technical Implementation Guide
V-259032
CAT II
The vCenter ESX Agent Manager service files must have permissions in an out-of-the-box state.
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide
V-259066
CAT II
The vCenter Lookup service files must have permissions in an out-of-the-box state.
VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-259099
CAT II
The vCenter Perfcharts service files must have permissions in an out-of-the-box state.
VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-259168
CAT II
The vCenter PostgreSQL service configuration files must not be accessible by unauthorized users.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258998
CAT II
The vCenter STS service files must have permissions in an out-of-the-box state.
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide
V-258921
CAT II
The vCenter Server user roles must be verified.
VMware vSphere 8.0 vCenter Security Technical Implementation Guide
V-207470
CAT II
The VMM must enforce access restrictions associated with changes to the system.
Virtual Machine Manager Security Requirements Guide
V-206427
CAT II
The web server application, libraries, and configuration files must only be accessible to privileged users.
Web Server Security Requirements Guide
V-269569
CAT II
Xylok Security Suite must protect application-specific data.
Xylok Security Suite 20.x Security Technical Implementation Guide
V-269582
CAT II
The Xylok Security Suite configuration file must be protected.
Xylok Security Suite 20.x Security Technical Implementation Guide