STIGhub
STIGs
RMF Controls
Compare
← IA-5 (13) — Authenticator Management
CCI-002007
Definition
Prohibit the use of cached authenticators after an organization-defined time period.
Parent Control
IA-5 (13)
Authenticator Management
Identification and Authentication
Linked STIG Checks (83)
V-274062
CAT II
Amazon Linux 2023 must prohibit the use of cached authenticators after one day.
Amazon Linux 2023 Security Technical Implementation Guide
V-268178
CAT II
NixOS must prohibit the use of cached authenticators after one day.
Anduril NixOS Security Technical Implementation Guide
V-268037
CAT II
Apple iOS/iPadOS 18 must implement the management setting: treat AirDrop as an unmanaged destination.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-268038
CAT III
Apple iOS/iPadOS 18 must implement the management setting: not have any Family Members in Family Sharing.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-278796
CAT II
Apple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-278797
CAT III
Apple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-276399
CAT II
Apple visionOS 2 must implement the management setting: treat AirDrop as an unmanaged destination.
Apple visionOS 2 Security Technical Implementation Guide
V-282808
CAT II
Apple visionOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.
Apple visionOS 26 Security Technical Implementation Guide
V-205000
CAT II
The ALG must prohibit the use of cached authenticators after an organization-defined time period.
Application Layer Gateway Security Requirements Guide
V-274677
CAT II
The API must have a mechanism for cache invalidation when using cache policy data.
Application Programming Interface (API) Security Requirements Guide
V-274678
CAT II
When stateless authentication tokens are used, the API must configure them with appropriate security settings.
Application Programming Interface (API) Security Requirements Guide
V-274679
CAT II
The API's internal authorization tokens must not be provided back to the user.
Application Programming Interface (API) Security Requirements Guide
V-274680
CAT II
API access tokens must be configured to expire.
Application Programming Interface (API) Security Requirements Guide
V-274681
CAT II
API refresh tokens must be configured to expire.
Application Programming Interface (API) Security Requirements Guide
V-222549
CAT II
The application must terminate existing user sessions upon account deletion.
Application Security and Development Security Technical Implementation Guide
V-204804
CAT II
The application server must prohibit the use of cached authenticators after an organization-defined time period.
Application Server Security Requirements Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276012
CAT I
Ax-OS must have no local accounts for the user interface.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-237395
CAT II
The CA API Gateway must prohibit the use of cached authenticators after an organization-defined time period.
CA API Gateway ALG Security Technical Implementation Guide
V-219163
CAT III
The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238362
CAT III
The Ubuntu operating system must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-274856
CAT III
Ubuntu 20.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260581
CAT III
Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270734
CAT III
Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-242652
CAT II
The Cisco ISE must prohibit the use of cached authenticators after an organization-defined time period.
Cisco ISE NDM Security Technical Implementation Guide
V-234225
CAT II
Citrix License Server must prohibit the use of cached authenticators after an organization-defined time period.
Citrix Virtual Apps and Desktop 7.x License Server Security Technical Implementation Guide
V-213203
CAT II
XenDesktop License Server must prohibit the use of cached authenticators after an organization-defined time period.
Citrix XenDesktop 7.x License Server Security Technical Implementation Guide
V-269409
CAT II
AlmaLinux OS 9 must prohibit the use of cached authenticators after one day.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233200
CAT II
The container platform must prohibit the use of cached authenticators after an organization-defined time period.
Container Platform Security Requirements Guide
V-206601
CAT II
The DBMS must prohibit the use of cached authenticators after an organization-defined time period.
Database Security Requirements Guide
V-269795
CAT II
The Dell OS10 Switch must prohibit the use of cached authenticators after an organization-defined time period.
Dell OS10 Switch NDM Security Technical Implementation Guide
V-235825
CAT II
The Lifetime Minutes and Renewal Threshold Minutes Login Session Controls must be set to 10 and 0 respectively in Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-266093
CAT II
The F5 BIG-IP appliance must prohibit the use of cached authenticators after eight hours or less.
F5 BIG-IP TMOS NDM Security Technical Implementation Guide
V-278401
CAT II
NGINX must be configured to expire cached authenticators after an organization-defined time period.
F5 NGINX Security Technical Implementation Guide
V-203733
CAT II
The operating system must prohibit the use of cached authenticators after one day.
General Purpose Operating System Security Requirements Guide
V-266959
CAT II
AOS must prohibit the use of cached authenticators after an organization-defined time period.
HPE Aruba Networking AOS NDM Security Technical Implementation Guide
V-215205
CAT II
If LDAP authentication is required, AIX must setup LDAP client to refresh user and group caches less than a day.
IBM AIX 7.x Security Technical Implementation Guide
V-252626
CAT II
The IBM Aspera High-Speed Transfer Endpoint must prohibit the use of cached authenticators after an organization-defined time period.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252649
CAT II
The IBM Aspera High-Speed Transfer Server must prohibit the use of cached authenticators after an organization-defined time period.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-65263
CAT II
The DataPower Gateway must prohibit the use of cached authenticators after an organization-defined time period.
IBM DataPower ALG Security Technical Implementation Guide
V-65167
CAT II
The DataPower Gateway must prohibit the use of cached authenticators after an organization-defined time period.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-255781
CAT II
The MQ Appliance WebGUI interface to the messaging server must prohibit the use of cached authenticators after one hour.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255790
CAT II
The MQ Appliance SSH interface to the messaging server must prohibit the use of cached authenticators after 600 seconds.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255764
CAT II
The MQ Appliance network device must prohibit the use of cached authenticators after an organization-defined time period.
IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide
V-250345
CAT II
The WebSphere Liberty Server must prohibit the use of cached authenticators after an organization-defined time period.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255872
CAT II
The WebSphere Application Server must prohibit the use of cached authenticators after an organization-defined time period.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-253927
CAT II
The Juniper EX switch must be configured to prohibit the use of cached authenticators after an organization-defined time period.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-205573
CAT II
The Mainframe Product must prohibit the use of cached authenticators after one hour.
Mainframe Product Security Requirements Guide
V-253736
CAT II
MariaDB must prohibit the use of cached authenticators after an organization-defined time period.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220385
CAT II
MarkLogic Server must prohibit the use of cached authenticators after an organization-defined time period.
MarkLogic Server v9 Security Technical Implementation Guide
V-235756
CAT II
The Password Manager must be disabled.
Microsoft Edge Security Technical Implementation Guide
V-228437
CAT II
The remember password for internet e-mail accounts must be disabled.
Microsoft Outlook 2016 Security Technical Implementation Guide
V-260903
CAT II
The Lifetime Minutes and Renewal Threshold Minutes Login Session Controls on MKE must be set.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-221194
CAT II
MongoDB must prohibit the use of cached authenticators after an organization-defined time period.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252177
CAT II
MongoDB must prohibit the use of cached authenticators after an organization-defined time period.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-202115
CAT II
The network device must prohibit the use of cached authenticators after an organization-defined time period.
Network Device Management Security Requirements Guide
V-254221
CAT II
Nutanix AOS must prohibit the use of cached authenticators.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279441
CAT II
Nutanix VMM must terminate UI network connections associated with a communications session at the end of the session for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-273206
CAT II
Okta must be configured to disable persistent global session cookies.
Okta Identity as a Service (IDaaS) Security Technical Implementation Guide
V-248710
CAT II
OL 8 must prohibit the use of cached authentications after one day.
Oracle Linux 8 Security Technical Implementation Guide
V-271609
CAT II
OL 9 must prohibit the use of cached authenticators after one day.
Oracle Linux 9 Security Technical Implementation Guide
V-235177
CAT II
The MySQL Database Server 8.0 must prohibit the use of cached authenticators after an organization-defined time period.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-253538
CAT II
Prisma Cloud Compute local accounts must enforce strong password requirements.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-281331
CAT II
RHEL 10 must prohibit the use of cached authenticators after one day.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-230376
CAT II
RHEL 8 must prohibit the use of cached authentications after one day.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-258133
CAT II
RHEL 9 must prohibit the use of cached authenticators after one day.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257562
CAT II
OpenShift must set server token max age no greater than eight hours.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257562
CAT II
OpenShift must set server token max age no greater than eight hours.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251224
CAT II
Redis Enterprise DBMS must prohibit the use of cached authenticators after an organization-defined time period.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275668
CAT II
Ubuntu OS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
Riverbed NetIM OS Security Technical Implementation Guide
V-261399
CAT II
If Network Security Services (NSS) is being used by SLEM 5 it must prohibit the use of cached authentications after one day.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-261400
CAT II
SLEM 5 must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217166
CAT II
If Network Security Services (NSS) is being used by the SUSE operating system it must prohibit the use of cached authentications after one day.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-217167
CAT II
The SUSE operating system must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-279216
CAT II
The Edge SWG providing user authentication intermediary services must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-279270
CAT II
The Edge SWG must prohibit the use of cached authenticators after an organization-defined time period.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94293
CAT II
Symantec ProxySG must prohibit the use of cached authenticators after 300 seconds at a minimum.
Symantec ProxySG ALG Security Technical Implementation Guide
V-252933
CAT II
TOSS must prohibit the use of cached authentications after one day.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282597
CAT II
TOSS 5 must prohibit the use of cached authenticators after one day.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-234543
CAT II
The UEM server must prohibit the use of cached authenticators after an organization-defined time period.
Unified Endpoint Management Server Security Requirements Guide
V-265327
CAT I
The NSX Manager must terminate all network connections associated with a session after five minutes of inactivity.
VMware NSX 4.x Manager NDM Security Technical Implementation Guide
V-251784
CAT II
The NSX-T Manager must prohibit the use of cached authenticators after an organization-defined time period.
VMware NSX-T Manager NDM Security Technical Implementation Guide
V-207486
CAT II
The VMM must prohibit the use of cached authenticators after one day.
Virtual Machine Manager Security Requirements Guide