STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

VMware vSphere 7.0 ESXi Security Technical Implementation Guide

Version

V1R4

Release Date

Feb 11, 2025

SCAP Benchmark ID

VMW_vSphere_7-0_ESXi_STIG

Total Checks

75

Tags

vmware
CAT I: 4CAT II: 65CAT III: 6

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (75)

V-256375MEDIUMAccess to the ESXi host must be limited by enabling lockdown mode.V-256376MEDIUMThe ESXi host must verify the DCUI.Access list.V-256377MEDIUMThe ESXi host must verify the exception users list for lockdown mode.V-256378MEDIUMRemote logging for ESXi hosts must be configured.V-256379MEDIUMThe ESXi host must enforce the limit of three consecutive invalid logon attempts by a user.V-256380MEDIUMThe ESXi host must enforce an unlock timeout of 15 minutes after a user account is locked out.V-256381MEDIUMThe ESXi host must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via the Direct Console User Interface (DCUI).V-256382MEDIUMThe ESXi host must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via Secure Shell (SSH).V-256383MEDIUMThe ESXi host SSH daemon must be configured with the DOD logon banner.V-256384MEDIUMThe ESXi host Secure Shell (SSH) daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions.V-256385MEDIUMThe ESXi host Secure Shell (SSH) daemon must ignore ".rhosts" files.V-256386MEDIUMThe ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.V-256387LOWThe ESXi host Secure Shell (SSH) daemon must not allow authentication using an empty password.V-256388MEDIUMThe ESXi host Secure Shell (SSH) daemon must not permit user environment settings.V-256389MEDIUMThe ESXi host Secure Shell (SSH) daemon must perform strict mode checking of home directory configuration files.V-256390MEDIUMThe ESXi host Secure Shell (SSH) daemon must not allow compression or must only allow compression after successful authentication.V-256391LOWThe ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.V-256392MEDIUMThe ESXi host Secure Shell (SSH) daemon must be configured to not allow X11 forwarding.V-256393MEDIUMThe ESXi host Secure Shell (SSH) daemon must not permit tunnels.V-256394LOWThe ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.V-256395LOWThe ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.V-256396MEDIUMThe ESXi host must produce audit records containing information to establish what type of events occurred.V-256397MEDIUMThe ESXi host must be configured with a sufficiently complex password policy.V-256398MEDIUMThe ESXi host must prohibit the reuse of passwords within five iterations.V-256399MEDIUMThe ESXi host must disable the Managed Object Browser (MOB).V-256400MEDIUMThe ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).V-256401MEDIUMThe ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.V-256402LOWThe ESXi host must use Active Directory for local user authentication.V-256403MEDIUMESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.V-256404MEDIUMActive Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.V-256405MEDIUMThe ESXi host must set a timeout to automatically disable idle shell sessions after two minutes.V-256406MEDIUMThe ESXi host must terminate shell services after 10 minutes.V-256407MEDIUMThe ESXi host must log out of the console UI after two minutes.V-256408MEDIUMThe ESXi host must enable a persistent log location for all locally stored logs.V-256409MEDIUMThe ESXi host must configure NTP time synchronization.V-256410HIGHThe ESXi Image Profile and vSphere Installation Bundle (VIB) acceptance levels must be verified.V-256411MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.V-256412MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by protecting ESXi management traffic.V-256413MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.V-256414MEDIUMSimple Network Management Protocol (SNMP) must be configured properly on the ESXi host.V-256415MEDIUMThe ESXi host must enable bidirectional Challenge-Handshake Authentication Protocol (CHAP) authentication for Internet Small Computer Systems Interface (iSCSI) traffic.V-256416LOWThe ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.V-256417MEDIUMThe ESXi host must configure the firewall to restrict access to services running on the host.V-256418MEDIUMThe ESXi host must configure the firewall to block network traffic by default.V-256419MEDIUMThe ESXi host must enable Bridge Protocol Data Units (BPDU) filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.V-256420MEDIUMAll port groups on standard switches must be configured to reject forged transmits.V-256421HIGHAll port groups on standard switches must be configured to reject guest Media Access Control (MAC) address changes.V-256422MEDIUMAll port groups on standard switches must be configured to reject guest promiscuous mode requests.V-256423MEDIUMUse of the dvFilter network application programming interfaces (APIs) must be restricted.V-256424MEDIUMAll port groups on standard switches must be configured to a value other than that of the native virtual local area network (VLAN).V-256425MEDIUMAll port groups on standard switches must not be configured to virtual local area network (VLAN) 4095 unless Virtual Guest Tagging (VGT) is required.V-256426MEDIUMAll port groups on standard switches must not be configured to virtual local area network (VLAN) values reserved by upstream physical switches.V-256427MEDIUMThe ESXi host must not provide root/administrator-level access to Common Information Model (CIM)-based hardware monitoring tools or other third-party applications.V-256428HIGHThe ESXi host must have all security patches and updates installed.V-256429HIGHThe ESXi host must exclusively enable Transport Layer Security (TLS) 1.2 for all endpoints.V-256430MEDIUMThe ESXi host must enable Secure Boot.V-256431MEDIUMThe ESXi host must use DOD-approved certificates.V-256432MEDIUMThe ESXi host must not suppress warnings that the local or remote shell sessions are enabled.V-256433MEDIUMThe ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.V-256434MEDIUMThe ESXi host Secure Shell (SSH) daemon must disable port forwarding.V-256435MEDIUMThe ESXi host OpenSLP service must be disabled.V-256436MEDIUMThe ESXi host must enable audit logging.V-256437MEDIUMThe ESXi host must enable strict x509 verification for SSL syslog endpoints.V-256438MEDIUMThe ESXi host must verify certificates for SSL syslog endpoints.V-256439MEDIUMThe ESXi host must enable volatile key destruction.V-256440MEDIUMThe ESXi host must configure a session timeout for the vSphere API.V-256441MEDIUMThe ESXi Host Client must be configured with a session timeout.V-256442MEDIUMThe ESXi host rhttpproxy daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions.V-256443MEDIUMThe ESXi host must be configured with an appropriate maximum password age.V-256444MEDIUMThe ESXi host must not be configured to override virtual machine (VM) configurations.V-256445MEDIUMThe ESXi host must not be configured to override virtual machine (VM) logger settings.V-256446MEDIUMThe ESXi host must require TPM-based configuration encryption.V-256447MEDIUMThe ESXi host must implement Secure Boot enforcement.V-256448MEDIUMThe ESXi Common Information Model (CIM) service must be disabled.V-256449MEDIUMThe ESXi host SSH daemon must be configured to only use FIPS 140-2 validated ciphers.