STIGhub
STIGs
RMF Controls
Compare
← SC-8 — Transmission Confidentiality and Integrity
CCI-002418
Definition
Protect the confidentiality and/or integrity of transmitted information.
Parent Control
SC-8
Transmission Confidentiality and Integrity
System and Communications Protection
Linked STIG Checks (200)
V-243495
CAT II
A VPN must be used to protect directory network traffic for directory service implementation spanning enclave boundaries.
Active Directory Domain Security Technical Implementation Guide
V-279092
CAT I
JVM Arguments must be configured for Transport Layer Security (TLS) 1.2 or higher.
Adobe ColdFusion Security Technical Implementation Guide
V-279093
CAT I
ColdFusion must configure Lightweight Directory Access Protocol (LDAP) for Transport Layer Security (TLS).
Adobe ColdFusion Security Technical Implementation Guide
V-279094
CAT I
ColdFusion must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
Adobe ColdFusion Security Technical Implementation Guide
V-279106
CAT II
ColdFusion must be configured to set the cookie settings.
Adobe ColdFusion Security Technical Implementation Guide
V-274038
CAT I
Amazon Linux 2023 must have SSH installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274039
CAT I
Amazon Linux 2023 must implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Amazon Linux 2023 Security Technical Implementation Guide
V-274046
CAT I
Amazon Linux 2023 must force a frequent session key renegotiation for SSH connections to the server.
Amazon Linux 2023 Security Technical Implementation Guide
V-274057
CAT I
Amazon Linux 2023 must enable FIPS mode.
Amazon Linux 2023 Security Technical Implementation Guide
V-283440
CAT I
Amazon Linux 2023 must implement DOD-approved encryption in the bind package.
Amazon Linux 2023 Security Technical Implementation Guide
V-268146
CAT I
NixOS must protect wireless access to and from the system using encryption.
Anduril NixOS Security Technical Implementation Guide
V-268159
CAT I
NixOS must protect the confidentiality and integrity of transmitted information.
Anduril NixOS Security Technical Implementation Guide
V-214230
CAT II
The Apache web server must use cryptography to protect the integrity of remote sessions.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214268
CAT II
Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214269
CAT II
The Apache web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214308
CAT II
The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214355
CAT II
The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214394
CAT II
Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-214395
CAT II
Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies.
Apache Server 2.4 Windows Site Security Technical Implementation Guide
V-222968
CAT I
Tomcat must use FIPS-validated ciphers on secured connectors.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252699
CAT III
The macOS system must be configured with Bluetooth turned off unless approved by the organization.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257218
CAT III
The macOS system must be configured with Bluetooth turned off unless approved by the organization.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-259510
CAT I
The macOS system must disable Bluetooth when no approved device is connected.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-268509
CAT I
The macOS system must disable Bluetooth when no approved device is connected.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277118
CAT I
The macOS system must disable Bluetooth when no approved device is connected.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-274709
CAT I
The amount of data returned by the API must be restricted.
Application Programming Interface (API) Security Requirements Guide
V-274710
CAT I
The API must use TLS version 1.2 at a minimum.
Application Programming Interface (API) Security Requirements Guide
V-222596
CAT I
The application must protect the confidentiality and integrity of transmitted information.
Application Security and Development Security Technical Implementation Guide
V-204816
CAT I
The application server must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
Application Server Security Requirements Guide
V-204817
CAT I
The application server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
Application Server Security Requirements Guide
V-237338
CAT I
The ArcGIS Server SSL settings must use NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272629
CAT I
CylanceON-PREM must be configured to use TLS 1.2 or higher.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-272435
CAT I
The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer, and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.
BIND 9.x Security Technical Implementation Guide
V-79015
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-79017
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-254712
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-254713
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-224386
CAT II
The BlackBerry UEM server must connect to [assignment: [SQL Server]] with an authenticated and secure (encrypted) connection to protect the confidentiality and integrity of transmitted information.
BlackBerry UEM Security Technical Implementation Guide
V-219313
CAT I
The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-252703
CAT II
The Ubuntu operating system must disable all wireless network adapters.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238215
CAT I
The Ubuntu operating system must use SSH to protect the confidentiality and integrity of transmitted information.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-252704
CAT II
The Ubuntu operating system must disable all wireless network adapters.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260523
CAT I
Ubuntu 22.04 LTS must have SSH installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260524
CAT I
Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260541
CAT II
Ubuntu 22.04 LTS must disable all wireless network adapters.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270665
CAT I
Ubuntu 24.04 LTS must have SSH installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270666
CAT I
Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270755
CAT II
Ubuntu 24.04 LTS must disable all wireless network adapters.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-206509
CAT I
The Central Log Server must be configured to protect the confidentiality and integrity of transmitted information.
Central Log Server Security Requirements Guide
V-239954
CAT II
The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation.
Cisco ASA VPN Security Technical Implementation Guide
V-234565
CAT I
Citrix Delivery Controller must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Delivery Controller Security Technical Implementation Guide
V-234226
CAT II
Citrix License Server must protect the confidentiality and integrity of transmitted information.
Citrix Virtual Apps and Desktop 7.x License Server Security Technical Implementation Guide
V-234257
CAT I
Citrix Linux Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Linux Virtual Delivery Agent Security Technical Implementation Guide
V-234252
CAT II
Citrix StoreFront server must accept Personal Identity Verification (PIV) credentials.
Citrix Virtual Apps and Desktop 7.x StoreFront Security Technical Implementation Guide
V-234253
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Windows Virtual Delivery Agent Security Technical Implementation Guide
V-213204
CAT II
XenDesktop License Server must protect the confidentiality and integrity of transmitted information.
Citrix XenDesktop 7.x License Server Security Technical Implementation Guide
V-213208
CAT I
Citrix Receiver must implement DoD-approved encryption.
Citrix XenDesktop 7.x Receiver Security Technical Implementation Guide
V-213211
CAT II
XenDesktop StoreFront must accept Personal Identity Verification (PIV) credentials.
Citrix XenDesktop 7.x StoreFront Security Technical Implementation Guide
V-213213
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix XenDesktop 7.x Windows VDA Security Technical Implementation Guide
V-269436
CAT I
All AlmaLinux OS 9 networked systems must have the OpenSSH client installed.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269441
CAT II
AlmaLinux OS 9 wireless network adapters must be disabled.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-283456
CAT I
AlmaLinux OS 9 must implement DOD-approved encryption in the bind package.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233224
CAT I
The application must protect the confidentiality and integrity of transmitted information.
Container Platform Security Requirements Guide
V-235776
CAT II
TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205216
CAT I
The DNS server implementation must protect the integrity of transmitted information.
Domain Name System (DNS) Security Requirements Guide
V-259973
CAT I
The Enterprise Voice, Video, and Messaging Endpoint must be configured to use FIPS-compliant algorithms for network traffic.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-260034
CAT I
The Enterprise Voice, Video, and Messaging Session Manager must be configured to protect the confidentiality and integrity of transmitted configuration files, signaling, and media streams.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-266288
CAT II
The F5 BIG-IP appliance IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.
F5 BIG-IP TMOS VPN Security Technical Implementation Guide
V-278405
CAT II
NGINX must be configured to use FIPS-approved algorithms to protect the confidentiality and integrity of transmitted information.
F5 NGINX Security Technical Implementation Guide
V-203748
CAT I
The operating system must protect the confidentiality and integrity of transmitted information.
General Purpose Operating System Security Requirements Guide
V-252688
CAT I
The operating system must protect the confidentiality and integrity of communications with wireless peripherals.
General Purpose Operating System Security Requirements Guide
V-255239
CAT II
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
HPE 3PAR SSMC Operating System Security Technical Implementation Guide
V-255251
CAT I
The SSMC web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-255253
CAT I
SSMC web server must use encryption strength in accordance with the categorization of data hosted by the web server when remote connections are provided.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-237817
CAT I
The CIM service must use DoD-approved encryption.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-237818
CAT I
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
HPE 3PAR StoreServ 3.2.x Security Technical Implementation Guide
V-255272
CAT I
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide
V-266982
CAT I
AOS, when used as an IPsec VPN Gateway, must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.
HPE Aruba Networking AOS VPN Security Technical Implementation Guide
V-266985
CAT I
AOS, when used as an IPsec VPN Gateway, must use Advanced Encryption Standard (AES) encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.
HPE Aruba Networking AOS VPN Security Technical Implementation Guide
V-215284
CAT II
AIX must protect the confidentiality and integrity of transmitted information during preparation for transmission and maintain the confidentiality and integrity of information during reception and disable all non-encryption network access methods.
IBM AIX 7.x Security Technical Implementation Guide
V-255810
CAT II
The MQ Appliance messaging server must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255811
CAT II
The MQ Appliance messaging server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-250339
CAT I
The WebSphere Liberty Server must use FIPS 140-2 approved encryption modules when authenticating users and processes.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-250347
CAT II
The WebSphere Liberty Server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-283668
CAT I
The WebSphere Liberty Server must use FIPS 140-3-approved encryption modules when authenticating users and processes.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255875
CAT II
The WebSphere Application Server must utilize FIPS 140-2-approved encryption modules when authenticating users and processes.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-255888
CAT II
The WebSphere Application Server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-283677
CAT II
The WebSphere Application Server must use FIPS 140-3-approved encryption modules when authenticating users and processes.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223610
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223831
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS RACF Security Technical Implementation Guide
V-224067
CAT II
IBM z/OS SSL encryption options for the TN3270 Telnet server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
IBM z/OS TSS Security Technical Implementation Guide
V-224772
CAT II
The ISEC7 SPHERE must protect the confidentiality and integrity of transmitted information during preparation for transmission and during reception using cryptographic mechanisms.
ISEC7 Sphere Security Technical Implementation Guide
V-224786
CAT II
The ISEC7 SPHERE must configure Enable HTTPS to use HTTP over SSL in Apache Tomcat.
ISEC7 Sphere Security Technical Implementation Guide
V-224792
CAT II
SSL must be enabled on Apache Tomcat.
ISEC7 Sphere Security Technical Implementation Guide
V-224793
CAT II
Tomcat SSL must be restricted except for ISEC7 SPHERE tasks.
ISEC7 Sphere Security Technical Implementation Guide
V-214195
CAT II
The Infoblox system must be configured to must protect the integrity of transmitted information.
Infoblox 7.x DNS Security Technical Implementation Guide
V-233923
CAT II
The Infoblox DNS service member must protect the integrity of transmitted information.
Infoblox 8.x DNS Security Technical Implementation Guide
V-258586
CAT I
The ICS must be configured to use TLS 1.2, at a minimum.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-213547
CAT II
JBoss must be configured to use an approved TLS version.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-241818
CAT I
The Jamf Pro EMM server must connect to [Authentication Gateway Service (AGS)] with an authenticated and secure (encrypted) connection to protect the confidentiality and integrity of transmitted information.
Jamf Pro v10.x EMM Security Technical Implementation Guide
V-221259
CAT I
Exchange must provide redundancy.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-221261
CAT I
Exchange internal Receive connectors must require encryption.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-221262
CAT I
Exchange internal Send connectors must require encryption.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-259640
CAT I
Exchange must provide redundancy.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259641
CAT I
Exchange internal Receive connectors must require encryption.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259642
CAT I
Exchange internal Send connectors must require encryption.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259710
CAT I
The application must protect the confidentiality and integrity of transmitted information.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-218820
CAT II
IIS 10.0 web server session IDs must be sent to the client using TLS.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-218821
CAT I
An IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-218822
CAT II
The IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-218769
CAT II
IIS 10.0 website session IDs must be sent to the client using TLS.
Microsoft IIS 10.0 Site Security Technical Implementation Guide
V-218770
CAT II
Cookies exchanged between the IIS 10.0 website and the client must have cookie properties set to prohibit client-side scripts from reading the cookie data.
Microsoft IIS 10.0 Site Security Technical Implementation Guide
V-220914
CAT II
Outgoing secure channel traffic must be encrypted or signed.
Microsoft Windows 10 Security Technical Implementation Guide
V-220915
CAT II
Outgoing secure channel traffic must be encrypted when possible.
Microsoft Windows 10 Security Technical Implementation Guide
V-220916
CAT II
Outgoing secure channel traffic must be signed when possible.
Microsoft Windows 10 Security Technical Implementation Guide
V-220919
CAT II
The system must be configured to require a strong session key.
Microsoft Windows 10 Security Technical Implementation Guide
V-220925
CAT II
The Windows SMB client must be configured to always perform SMB packet signing.
Microsoft Windows 10 Security Technical Implementation Guide
V-220927
CAT II
The Windows SMB server must be configured to always perform SMB packet signing.
Microsoft Windows 10 Security Technical Implementation Guide
V-253364
CAT II
Simultaneous connections to the internet or a Windows domain must be limited.
Microsoft Windows 11 Security Technical Implementation Guide
V-253438
CAT II
Outgoing secure channel traffic must be encrypted or signed.
Microsoft Windows 11 Security Technical Implementation Guide
V-253439
CAT II
Outgoing secure channel traffic must be encrypted.
Microsoft Windows 11 Security Technical Implementation Guide
V-253440
CAT II
Outgoing secure channel traffic must be signed.
Microsoft Windows 11 Security Technical Implementation Guide
V-253443
CAT II
The system must be configured to require a strong session key.
Microsoft Windows 11 Security Technical Implementation Guide
V-253449
CAT II
The Windows SMB client must be configured to always perform SMB packet signing.
Microsoft Windows 11 Security Technical Implementation Guide
V-253451
CAT II
The Windows SMB server must be configured to always perform SMB packet signing.
Microsoft Windows 11 Security Technical Implementation Guide
V-215634
CAT II
The Windows 2012 DNS Server must protect the integrity of transmitted information.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-224995
CAT II
Domain controllers must require LDAP access signing.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225029
CAT II
The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225030
CAT II
The setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225031
CAT II
The setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225034
CAT II
Windows Server 2016 must be configured to require a strong session key.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225039
CAT II
The setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225040
CAT II
The setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225042
CAT II
The setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225043
CAT II
The setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205820
CAT II
Windows Server 2019 domain controllers must require LDAP access signing.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205821
CAT II
Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205822
CAT II
Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205823
CAT II
Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205824
CAT II
Windows Server 2019 must be configured to require a strong session key.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205825
CAT II
Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205826
CAT II
Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205827
CAT II
Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205828
CAT II
Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254416
CAT II
Windows Server 2022 domain controllers must require LDAP access signing.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254450
CAT II
Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254451
CAT II
Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254452
CAT II
Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254455
CAT II
Windows Server 2022 must be configured to require a strong session key.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254460
CAT II
Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254461
CAT II
Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254463
CAT II
Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254464
CAT II
Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278163
CAT II
Windows Server 2025 domain controllers must require LDAP access signing.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278200
CAT II
The Windows Server 2025 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278201
CAT II
Windows Server 2025 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278202
CAT II
The Windows Server 2025 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278205
CAT II
Windows Server 2025 must be configured to require a strong session key.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278210
CAT II
The Windows Server 2025 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278211
CAT II
The Windows Server 2025 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278213
CAT II
The Windows Server 2025 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278214
CAT II
The Windows Server 2025 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-259397
CAT I
The Windows DNS Server must protect the integrity of transmitted information.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-260908
CAT I
FIPS mode must be enabled.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-251349
CAT I
Tunneling of classified traffic across an unclassified IP transport network or service provider backbone must be documented in the enclaves security authorization package and an Approval to Connect (ATC), or an Interim ATC must be issued by DISA prior to implementation.
Network Infrastructure Policy Security Technical Implementation Guide
V-251350
CAT I
DSAWG approval must be obtained before tunneling classified traffic outside the components local area network boundaries across a non-DISN or OCONUS DISN unclassified IP wide area network transport infrastructure.
Network Infrastructure Policy Security Technical Implementation Guide
V-251351
CAT I
Tunneling of classified traffic across an unclassified IP transport network must employ cryptographic algorithms in accordance with CNSS Policy No. 15.
Network Infrastructure Policy Security Technical Implementation Guide
V-254229
CAT II
Nutanix AOS must protect the confidentiality and integrity of transmitted information.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279535
CAT I
Nutanix OS must implement cryptography to protect the integrity of remote access session by setting the systemwide policy to use FIPS mode.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-279627
CAT I
Nutanix OS must protect the confidentiality and integrity of communications with wireless peripherals.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-221520
CAT I
OHS must have the LoadModule ossl_module directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221521
CAT I
OHS must have the SSLFIPS directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221522
CAT I
OHS must have the SSLEngine, SSLProtocol, SSLWallet directives enabled and configured to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221523
CAT I
OHS must have the SSLCipherSuite directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221524
CAT II
If using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the SecureProxy directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221525
CAT II
OHS must have the WLSSLWallet directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221526
CAT II
If using the WebLogic Web Server Proxy Plugin and configuring end-to-end SSL, OHS must have the WebLogicSSLVersion directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221527
CAT II
If using the WebLogic Web Server Proxy Plugin and configuring SSL termination at OHS, OHS must have the WLProxySSL directive enabled to prevent unauthorized disclosure of information during transmission.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221528
CAT II
OHS must have the LoadModule ossl_module directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221529
CAT II
OHS must have the SSLFIPS directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221530
CAT II
OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221531
CAT II
OHS must have the SSLCipherSuite directive enabled to maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221847
CAT II
The Oracle Linux operating system must be configured so that all networked systems have SSH installed.
Oracle Linux 7 Security Technical Implementation Guide
V-221848
CAT II
The Oracle Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.
Oracle Linux 7 Security Technical Implementation Guide
V-248524
CAT I
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 8 Security Technical Implementation Guide
V-248842
CAT II
OL 8 wireless network adapters must be disabled.
Oracle Linux 8 Security Technical Implementation Guide
V-248843
CAT II
OL 8 Bluetooth must be disabled.
Oracle Linux 8 Security Technical Implementation Guide
V-248866
CAT II
All OL 8 networked systems must have SSH installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248867
CAT II
All OL 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Oracle Linux 8 Security Technical Implementation Guide
V-283446
CAT I
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 8 Security Technical Implementation Guide
V-283451
CAT I
OL 8 must implement DOD-approved encryption in the bind package.
Oracle Linux 8 Security Technical Implementation Guide
V-271454
CAT I
OL 9 must enable FIPS mode.
Oracle Linux 9 Security Technical Implementation Guide
V-271482
CAT II
OL 9 networked systems must have SSH installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271483
CAT II
OL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
Oracle Linux 9 Security Technical Implementation Guide
V-271705
CAT II
OL 9 must force a frequent session key renegotiation for SSH connections to the server.
Oracle Linux 9 Security Technical Implementation Guide
V-271759
CAT I
OL 9 must implement DOD-approved encryption in the bind package.
Oracle Linux 9 Security Technical Implementation Guide
V-271859
CAT II
OL 9 wireless network adapters must be disabled.
Oracle Linux 9 Security Technical Implementation Guide
V-253548
CAT I
Prisma Cloud Compute must protect the confidentiality and integrity of transmitted information.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-281001
CAT II
RHEL 10 must have a Secure Shell (SSH) server installed for all networked systems.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281002
CAT II
RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide