STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 6 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

F5 BIG-IP TMOS NDM Security Technical Implementation Guide

Version

V1R2

Release Date

Jun 12, 2025

SCAP Benchmark ID

F5_BIG-IP_TMOS_NDM_STIG

Total Checks

29

Tags

other
CAT I: 8CAT II: 20CAT III: 1

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (29)

V-266064MEDIUMThe F5 BIG-IP appliance must be configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number.V-266065MEDIUMThe F5 BIG-IP appliance must terminate shared/group account credentials when members leave the group.V-266066MEDIUMThe F5 BIG-IP appliance must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.V-266067HIGHThe F5 BIG-IP appliance must be configured to assign appropriate user roles or access levels to authenticated users.V-266068MEDIUMThe F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.V-266069MEDIUMThe F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes.V-266070MEDIUMThe F5 BIG-IP appliance must be configured to display the Standard Mandatory DOD Notice and Consent Banner upon access to the TMOS User Interface.V-266074LOWThe F5 BIG-IP appliance must manage local audit storage capacity in accordance with organization-defined audit record storage requirements.V-266075HIGHThe F5 BIG-IP appliance must generate audit records and send records to redundant central syslog servers that are separate from the appliance.V-266077MEDIUMThe F5 BIG-IP appliance must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).V-266078MEDIUMThe F5 BIG-IP appliance must be configured to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.V-266079HIGHThe F5 BIG-IP appliance must be configured to use at least two authentication servers to authenticate administrative users.V-266080HIGHThe F5 BIG-IP appliance must be running an operating system release that is currently supported by the vendor.V-266083MEDIUMThe F5 BIG-IP appliance must obtain its public key certificates from an appropriate certificate policy through an approved service provider.V-266084HIGHThe F5 BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.V-266085HIGHThe F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins.V-266086MEDIUMThe F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.V-266087MEDIUMThe F5 BIG-IP appliance must enforce a minimum 15-character password length.V-266088MEDIUMThe F5 BIG-IP appliance must enforce password complexity by requiring that at least one uppercase character be used.V-266089MEDIUMThe F5 BIG-IP appliance must enforce password complexity by requiring that at least one lowercase character be used.V-266090MEDIUMThe F5 BIG-IP appliance must enforce password complexity by requiring that at least one numeric character be used.V-266091MEDIUMThe F5 BIG-IP appliance must enforce password complexity by requiring that at least one special character be used.V-266092MEDIUMThe F5 BIG-IP appliance must require that when a password is changed, the characters are changed in at least eight of the positions within the password.V-266093MEDIUMThe F5 BIG-IP appliance must prohibit the use of cached authenticators after eight hours or less.V-266094HIGHThe F5 BIG-IP appliance must be configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication.V-266095HIGHThe F5 BIG-IP appliance must set the idle time before automatic logout to five minutes of inactivity except to fulfill documented and validated mission requirements.V-266096MEDIUMThe F5 BIG-IP appliance must conduct backups of the configuration at a weekly or organization-defined frequency and store on a separate device.V-266134MEDIUMThe F5 BIG-IP appliance must be configured to display the Standard Mandatory DOD Notice and Consent Banner when accessing via SSH.V-266135MEDIUMThe F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session.