STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Application Security and Development Security Technical Implementation Guide

Version

V6R4

Benchmark ID

Application_Security_Development_STIG

Total Checks

286

Tags

application
CAT I: 34CAT II: 230CAT III: 22

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (286)

V-222387MEDIUMThe application must provide a capability to limit the number of logon sessions per user.V-222388MEDIUMThe application must clear temporary storage and cookies when the session is terminated.V-222389MEDIUMThe application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.V-222390MEDIUMThe application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.V-222391MEDIUMApplications requiring user access authentication must provide a logoff capability for user initiated communication session.V-222392LOWThe application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.V-222393MEDIUMThe application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.V-222394MEDIUMThe application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process.V-222395MEDIUMThe application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.V-222396MEDIUMThe application must implement DoD-approved encryption to protect the confidentiality of remote access sessions.V-222397MEDIUMThe application must implement cryptographic mechanisms to protect the integrity of remote access sessions.V-222398MEDIUMApplications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.V-222399HIGHMessages protected with WS_Security must use time stamps with creation and expiration times.V-222400HIGHValidity periods must be verified on all application messages using WS-Security or SAML assertions.V-222401MEDIUMThe application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.V-222402MEDIUMThe application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.V-222403HIGHThe application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion.V-222404HIGHThe application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion.V-222405MEDIUMThe application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.V-222406MEDIUMThe application must ensure messages are encrypted when the SessionIndex is tied to privacy data.V-222407MEDIUMThe application must provide automated mechanisms for supporting account management functions.V-222408MEDIUMShared/group account credentials must be terminated when members leave the group.V-222409MEDIUMThe application must automatically remove or disable temporary user accounts 72 hours after account creation.V-222410LOWThe application must have a process, feature or function that prevents removal or disabling of emergency accounts.V-222411LOWThe application must automatically disable accounts after a 35 day period of account inactivity.V-222412MEDIUMUnnecessary application accounts must be disabled, or deleted.V-222413MEDIUMThe application must automatically audit account creation.V-222414MEDIUMThe application must automatically audit account modification.V-222415MEDIUMThe application must automatically audit account disabling actions.V-222416MEDIUMThe application must automatically audit account removal actions.V-222417LOWThe application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.V-222418LOWThe application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.V-222419LOWThe application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.V-222420LOWThe application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.V-222421MEDIUMThe application must automatically audit account enabling actions.V-222422LOWThe application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.V-222423MEDIUMApplication data protection requirements must be identified and documented.V-222424MEDIUMThe application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.V-222425HIGHThe application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.V-222426MEDIUMThe application must enforce organization-defined discretionary access control policies over defined subjects and objects.V-222427MEDIUMThe application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.V-222428MEDIUMThe application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.V-222429MEDIUMThe application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.V-222430HIGHThe application must execute without excessive account permissions.V-222431MEDIUMThe application must audit the execution of privileged functions.V-222432HIGHThe application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.V-222433MEDIUMThe application administrator must follow an approved process to unlock locked user accounts.V-222434LOWThe application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.V-222435LOWThe application must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.V-222436LOWThe publicly accessible application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.V-222437LOWThe application must display the time and date of the users last successful logon.V-222438MEDIUMThe application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.V-222439MEDIUMFor applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail.V-222441MEDIUMThe application must provide audit record generation capability for the creation of session IDs.V-222442MEDIUMThe application must provide audit record generation capability for the destruction of session IDs.V-222443MEDIUMThe application must provide audit record generation capability for the renewal of session IDs.V-222444MEDIUMThe application must not write sensitive data into the application logs.V-222445MEDIUMThe application must provide audit record generation capability for session timeouts.V-222446MEDIUMThe application must record a time stamp indicating when the event occurred.V-222447MEDIUMThe application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.V-222448MEDIUMThe application must provide audit record generation capability for connecting system IP addresses.V-222449MEDIUMThe application must record the username or user ID of the user associated with the event.V-222450MEDIUMThe application must generate audit records when successful/unsuccessful attempts to grant privileges occur.V-222451MEDIUMThe application must generate audit records when successful/unsuccessful attempts to access security objects occur.V-222452MEDIUMThe application must generate audit records when successful/unsuccessful attempts to access security levels occur.V-222453MEDIUMThe application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.V-222454MEDIUMThe application must generate audit records when successful/unsuccessful attempts to modify privileges occur.V-222455MEDIUMThe application must generate audit records when successful/unsuccessful attempts to modify security objects occur.V-222456MEDIUMThe application must generate audit records when successful/unsuccessful attempts to modify security levels occur.V-222457MEDIUMThe application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.V-222458MEDIUMThe application must generate audit records when successful/unsuccessful attempts to delete privileges occur.V-222459MEDIUMThe application must generate audit records when successful/unsuccessful attempts to delete security levels occur.V-222460MEDIUMThe application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.V-222461MEDIUMThe application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.V-222462MEDIUMThe application must generate audit records when successful/unsuccessful logon attempts occur.V-222463MEDIUMThe application must generate audit records for privileged activities or other system-level access.V-222464MEDIUMThe application must generate audit records showing starting and ending time for user access to the system.V-222465MEDIUMThe application must generate audit records when successful/unsuccessful accesses to objects occur.V-222466MEDIUMThe application must generate audit records for all direct access to the information system.V-222467MEDIUMThe application must generate audit records for all account creations, modifications, disabling, and termination events.V-222468MEDIUMThe application must initiate session auditing upon startup.V-222469MEDIUMThe application must log application shutdown events.V-222470MEDIUMThe application must log destination IP addresses.V-222471MEDIUMThe application must log user actions involving access to data.V-222472MEDIUMThe application must log user actions involving changes to data.V-222473MEDIUMThe application must produce audit records containing information to establish when (date and time) the events occurred.V-222474MEDIUMThe application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.V-222475MEDIUMWhen using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.V-222476MEDIUMThe application must produce audit records that contain information to establish the outcome of the events.V-222477MEDIUMThe application must generate audit records containing information that establishes the identity of any individual or process associated with the event.V-222478MEDIUMThe application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.V-222479MEDIUMThe application must implement transaction recovery logs when transaction based.V-222480MEDIUMThe application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.V-222481MEDIUMThe application must off-load audit records onto a different system or media than the system being audited.V-222482MEDIUMThe application must be configured to write application logs to a centralized log repository.V-222483MEDIUMThe application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.V-222484MEDIUMApplications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.V-222485MEDIUMThe application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.V-222486MEDIUMThe application must shut down by default upon audit failure (unless availability is an overriding concern).V-222487MEDIUMThe application must provide the capability to centrally review and analyze audit records from multiple components within the system.V-222488MEDIUMThe application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.V-222489MEDIUMThe application must provide an audit reduction capability that supports on-demand reporting requirements.V-222490MEDIUMThe application must provide an audit reduction capability that supports on-demand audit review and analysis.V-222491MEDIUMThe application must provide an audit reduction capability that supports after-the-fact investigations of security incidents.V-222492MEDIUMThe application must provide a report generation capability that supports on-demand audit review and analysis.V-222493MEDIUMThe application must provide a report generation capability that supports on-demand reporting requirements.V-222494MEDIUMThe application must provide a report generation capability that supports after-the-fact investigations of security incidents.V-222495MEDIUMThe application must provide an audit reduction capability that does not alter original content or time ordering of audit records.V-222496MEDIUMThe application must provide a report generation capability that does not alter original content or time ordering of audit records.V-222497MEDIUMThe applications must use internal system clocks to generate time stamps for audit records.V-222498MEDIUMThe application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-222499MEDIUMThe application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.V-222500MEDIUMThe application must protect audit information from any type of unauthorized read access.V-222501MEDIUMThe application must protect audit information from unauthorized modification.V-222502MEDIUMThe application must protect audit information from unauthorized deletion.V-222503MEDIUMThe application must protect audit tools from unauthorized access.V-222504MEDIUMThe application must protect audit tools from unauthorized modification.V-222505MEDIUMThe application must protect audit tools from unauthorized deletion.V-222506MEDIUMThe application must back up audit records at least every seven days onto a different system or system component than the system or component being audited.V-222507MEDIUMThe application must use cryptographic mechanisms to protect the integrity of audit information.V-222508MEDIUMApplication audit tools must be cryptographically hashed.V-222509MEDIUMThe integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value.V-222510MEDIUMThe application must prohibit user installation of software without explicit privileged status.V-222511MEDIUMThe application must enforce access restrictions associated with changes to application configuration.V-222512MEDIUMThe application must audit who makes configuration changes to the application.V-222513MEDIUMThe application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.V-222514MEDIUMThe applications must limit privileges to change the software resident within software libraries.V-222515MEDIUMAn application vulnerability assessment must be conducted.V-222516MEDIUMThe application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.V-222517MEDIUMThe application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.V-222518MEDIUMThe application must be configured to disable non-essential capabilities.V-222519MEDIUMThe application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.V-222520MEDIUMThe application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.V-222521MEDIUMThe application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.V-222522HIGHThe application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-222523MEDIUMThe application must use multifactor (Alt. Token) authentication for network access to privileged accounts.V-222524MEDIUMThe application must accept Personal Identity Verification (PIV) credentials.V-222525MEDIUMThe application must electronically verify Personal Identity Verification (PIV) credentials.V-222526MEDIUMThe application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts.V-222527MEDIUMThe application must use multifactor (Alt. Token) authentication for local access to privileged accounts.V-222528MEDIUMThe application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts.V-222529MEDIUMThe application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.V-222530MEDIUMThe application must implement replay-resistant authentication mechanisms for network access to privileged accounts.V-222531MEDIUMThe application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.V-222532MEDIUMThe application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoD policy or by the data owner.V-222533MEDIUMThe application must authenticate all network connected endpoint devices before establishing any connection.V-222534MEDIUMService-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.V-222535MEDIUMThe application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.V-222536HIGHThe application must enforce a minimum 15-character password length.V-222537MEDIUMThe application must enforce password complexity by requiring that at least one uppercase character be used.V-222538MEDIUMThe application must enforce password complexity by requiring that at least one lowercase character be used.V-222539MEDIUMThe application must enforce password complexity by requiring that at least one numeric character be used.V-222540MEDIUMThe application must enforce password complexity by requiring that at least one special character be used.V-222541MEDIUMThe application must require the change of at least eight of the total number of characters when passwords are changed.V-222542HIGHThe application must only store cryptographic representations of passwords.V-222543HIGHThe application must transmit only cryptographically-protected passwords.V-222544MEDIUMThe application must enforce 24 hours/1 day as the minimum password lifetime.V-222545MEDIUMThe application must enforce a 60-day maximum password lifetime restriction.V-222546MEDIUMThe application must prohibit password reuse for a minimum of five generations.V-222547MEDIUMThe application must allow the use of a temporary password for system logons with an immediate change to a permanent password.V-222548MEDIUMThe application password must not be changeable by users other than the administrator or the user with which the password is associated.V-222549MEDIUMThe application must terminate existing user sessions upon account deletion.V-222550HIGHThe application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-222551HIGHThe application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.V-222552MEDIUMThe application must map the authenticated identity to the individual user or group account for PKI-based authentication.V-222553MEDIUMThe application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.V-222554HIGHThe application must not display passwords/PINs as clear text.V-222555HIGHThe application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.V-222556MEDIUMThe application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-222557MEDIUMThe application must accept Personal Identity Verification (PIV) credentials from other federal agencies.V-222558MEDIUMThe application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies.V-222559MEDIUMThe application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.V-222560MEDIUMThe application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.V-222561MEDIUMApplications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.V-222562MEDIUMApplications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications.V-222563MEDIUMApplications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications.V-222564MEDIUMApplications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions.V-222565MEDIUMThe application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.V-222566MEDIUMThe application must terminate all sessions and network connections when nonlocal maintenance is completed.V-222567MEDIUMThe application must not be vulnerable to race conditions.V-222568MEDIUMThe application must terminate all network connections associated with a communications session at the end of the session.V-222570MEDIUMThe application must utilize FIPS-validated cryptographic modules when signing application components.V-222571MEDIUMThe application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes.V-222572MEDIUMThe application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection.V-222573MEDIUMApplications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement.V-222574MEDIUMThe application user interface must be either physically or logically separated from data storage and management interfaces.V-222575MEDIUMThe application must set the HTTPOnly flag on session cookies.V-222576MEDIUMThe application must set the secure flag on session cookies.V-222577HIGHThe application must not expose session IDs.V-222578HIGHThe application must destroy the session ID value and/or cookie on logoff or browser close.V-222579MEDIUMApplications must use system-generated session identifiers that protect against session fixation.V-222580MEDIUMApplications must validate session identifiers.V-222581MEDIUMApplications must not use URL embedded session IDs.V-222582MEDIUMThe application must not re-use or recycle session IDs.V-222583MEDIUMThe application must generate a unique session identifier using a FIPS 140-2/140-3 approved random number generator.V-222584MEDIUMThe application must only allow the use of DoD-approved certificate authorities for verification of the establishment of protected sessions.V-222585HIGHThe application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.V-222586MEDIUMIn the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.V-222587MEDIUMThe application must protect the confidentiality and integrity of stored information when required by DOD policy or the information owner.V-222588HIGHThe application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.V-222589HIGHThe application must use appropriate cryptography in order to protect stored DOD information when required by the information owner or DOD policy.V-222590MEDIUMThe application must isolate security functions from non-security functions.V-222591MEDIUMThe application must maintain a separate execution domain for each executing process.V-222592MEDIUMApplications must prevent unauthorized and unintended information transfer via shared system resources.V-222593MEDIUMXML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.V-222594MEDIUMThe application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems.V-222595MEDIUMThe web service design must include redundancy mechanisms when used with high-availability systems.V-222596HIGHThe application must protect the confidentiality and integrity of transmitted information.V-222597MEDIUMThe application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).V-222598MEDIUMThe application must maintain the confidentiality and integrity of information during preparation for transmission.V-222599MEDIUMThe application must maintain the confidentiality and integrity of information during reception.V-222600MEDIUMThe application must not disclose unnecessary information to users.V-222601HIGHThe application must not store sensitive information in hidden fields.V-222602HIGHThe application must protect from Cross-Site Scripting (XSS) vulnerabilities.V-222603MEDIUMThe application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities.V-222604HIGHThe application must protect from command injection.V-222605MEDIUMThe application must protect from canonical representation vulnerabilities.V-222606MEDIUMThe application must validate all input.V-222607HIGHThe application must not be vulnerable to SQL Injection.V-222608HIGHThe application must not be vulnerable to XML-oriented attacks.V-222609HIGHThe application must not be subject to input handling vulnerabilities.V-222610MEDIUMThe application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.V-222611MEDIUMThe application must reveal error messages only to the ISSO, ISSM, or SA.V-222612HIGHThe application must not be vulnerable to overflow attacks.V-222613MEDIUMThe application must remove organization-defined software components after updated versions have been installed.V-222614MEDIUMSecurity-relevant software updates and patches must be kept up to date.V-222615MEDIUMThe application performing organization-defined security functions must verify correct operation of security functions.V-222616MEDIUMThe application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days.V-222617LOWThe application must notify the ISSO and ISSM of failed security verification tests.V-222618MEDIUMUnsigned Category 1A mobile code must not be used in the application in accordance with DoD policy.V-222619MEDIUMThe ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed.V-222620HIGHApplication web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoD DMZ.V-222621MEDIUMThe ISSO must ensure application audit trails are retained for at least 30 months (12 months active + 18 months cold storage) for applications without SAMI data and five years for applications including SAMI data.V-222622MEDIUMThe ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events.V-222623MEDIUMThe ISSO must report all suspected violations of IA policies in accordance with DoD information system IA procedures.V-222624MEDIUMThe ISSO must ensure active vulnerability testing is performed.V-222625MEDIUMExecution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated.V-222626MEDIUMThe designer must ensure the application does not store configuration and control files in the same directory as user data.V-222627MEDIUMThe ISSO must ensure if a DoD STIG or NSA guide is not available, a third-party product will be configured by following available guidance.V-222628MEDIUMNew IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoD Ports, Protocols, and Services Management (DoD PPSM)V-222629MEDIUMThe application must be registered with the DoD Ports and Protocols Database.V-222630MEDIUMThe Configuration Management (CM) repository must be properly patched and STIG compliant.V-222631MEDIUMAccess privileges to the Configuration Management (CM) repository must be reviewed every three months.V-222632MEDIUMA Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained.V-222633MEDIUMA Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established.V-222634MEDIUMThe application services and interfaces must be compatible with and ready for IPv6 networks.V-222635MEDIUMThe application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO.V-222636MEDIUMA contingency plan must exist in accordance with DOD policy based on the application's availability requirements.V-222637MEDIUMRecovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.V-222638MEDIUMData backup must be performed at required intervals in accordance with DoD policy.V-222639MEDIUMBack-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).V-222640MEDIUMProcedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application.V-222641MEDIUMThe application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange.V-222642HIGHThe application must not contain embedded authentication data.V-222643HIGHThe application must have the capability to mark sensitive/classified output when required.V-222644LOWPrior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed.V-222645MEDIUMApplication files must be cryptographically hashed prior to deploying to DoD operational networks.V-222646MEDIUMAt least one tester must be designated to test for security flaws in addition to functional testing.V-222647LOWTest procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.V-222648MEDIUMAn application code review must be performed on the application.V-222649LOWCode coverage statistics must be maintained for each release of the application.V-222650MEDIUMFlaws found during a code review must be tracked in a defect tracking system.V-222651MEDIUMThe changes to the application must be assessed for IA and accreditation impact prior to implementation.V-222652MEDIUMSecurity flaws must be fixed or addressed in the project plan.V-222653LOWThe application development team must follow a set of coding standards.V-222654LOWThe designer must create and update the Design Document for each release of the application.V-222655MEDIUMThreat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered.V-222656MEDIUMThe application must not be subject to error handling vulnerabilities.V-222657MEDIUMThe application development team must provide an application incident response plan.V-222658HIGHAll products must be supported by the vendor or the development team.V-222659HIGHThe application must be decommissioned when maintenance or support is no longer available.V-222660LOWProcedures must be in place to notify users when an application is decommissioned.V-222661MEDIUMUnnecessary built-in application accounts must be disabled.V-222662HIGHDefault passwords must be changed.V-222663MEDIUMAn Application Configuration Guide must be created and included with the application.V-222664MEDIUMIf the application contains classified data, a Security Classification Guide must exist containing data elements and their classification.V-222665MEDIUMThe designer must ensure uncategorized or emerging mobile code is not used in applications.V-222666MEDIUMProduction database exports must have database administration credentials and sensitive data removed before releasing the export.V-222667MEDIUMProtections against DoS attacks must be implemented.V-222668MEDIUMThe system must alert an administrator when low resource conditions are encountered.V-222669LOWAt least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.V-222670LOWThe application must provide notifications or alerts when product update and security related patches are available.V-222671MEDIUMConnections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ.V-222672LOWThe application must generate audit records when concurrent logons from different workstations occur.V-222673MEDIUMThe Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.V-265634MEDIUMThe application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.