STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide

Version

V1R1

Benchmark ID

MongoDB_Enterprise_Advanced_8-x_STIG

Total Checks

55

Tags

database
CAT I: 12CAT II: 41CAT III: 2

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (55)

V-279331LOWMongoDB must limit the total number of concurrent connections to the database.V-279332HIGHMongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.V-279333HIGHMongoDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.V-279334MEDIUMMongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.V-279336MEDIUMThe audit information produced by MongoDB must be protected from unauthorized access, modification, and deletion.V-279337MEDIUMMongoDB must protect its audit features from unauthorized access, modification, and removal.V-279338MEDIUMMongoDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to MongoDB.V-279339HIGHMongoDB software installation account must be restricted to authorized users.V-279340MEDIUMMongoDB database software, including configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.V-279341MEDIUMMongoDB database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be owned by database/DBMS principals authorized for ownership.V-279342MEDIUMThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.V-279344MEDIUMUnused database components, MongoDB software, and database objects must be removed.V-279346MEDIUMMongoDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-279347MEDIUMMongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-279349HIGHMongoDB must, for password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.V-279350HIGHIf passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.V-279351HIGHMongoDB must enforce authorized access to all PKI private keys stored/used by the DBMS.V-279352MEDIUMMongoDB must map the PKI-authenticated identity to an associated user account.V-279353HIGHMongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.V-279354HIGHMongoDB must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations.V-279355MEDIUMMongoDB must separate user functionality (including user interface services) from database management functionality.V-279358MEDIUMMongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.V-279361HIGHMongoDB must protect the confidentiality and integrity of all information at rest.V-279363MEDIUMDatabase contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.V-279364MEDIUMAccess to database files must be limited to relevant processes and to authorized, administrative users.V-279365MEDIUMMongoDB must check the validity of all data inputs except those specifically identified by the organization.V-279366MEDIUMMongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.V-279367MEDIUMMongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.V-279368MEDIUMMongoDB must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA) and database administrator (DBA).V-279371MEDIUMMongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.V-279372MEDIUMMongoDB must enforce Discretionary Access Control (DAC) policies, as defined by the data owner, over defined subjects and objects.V-279373MEDIUMMongoDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.V-279375MEDIUMMongoDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.V-279376MEDIUMMongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.V-279380MEDIUMMongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.V-279381MEDIUMMongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).V-279382MEDIUMMongoDB must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.V-279383MEDIUMMongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.V-279385HIGHMongoDB must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.V-279386MEDIUMMongoDB must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.V-279387HIGHMongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.V-279389MEDIUMMongoDB must maintain the confidentiality and integrity of information during preparation for transmission.V-279390MEDIUMWhen invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.V-279391MEDIUMWhen updates are applied to MongoDB software, any software components that have been replaced or made unnecessary must be removed.V-279392MEDIUMSecurity-relevant software updates to MongoDB must be installed within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).V-279393HIGHMongoDB must be a version supported by the vendor.V-279394MEDIUMMongoDB must off-load audit data to a separate log management facility; this shall be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.V-279395MEDIUMMongoDB must be configured in accordance with the security configuration settings based on DOD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.V-279398MEDIUMMongoDB must prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate recognized and approved by the organization.V-279399MEDIUMMongoDB must require users to be individually authenticated before granting access to the shared accounts or resources.V-279409MEDIUMMongoDB must, for public key-based authentication, implement a local cache of revocation data to support path discovery and validation.V-279411MEDIUMMongoDB must include only approved trust anchors in trust stores or certificate stores managed by the organization.V-279412MEDIUMMongoDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.V-281700LOWMongoDB must terminate a user session after organization-defined conditions or trigger events requiring session disconnect via a scheduled script.V-282943MEDIUMMongoDB must be configured to restrict the use of administrator access to authorized IP addresses.