STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

VMware vSphere 8.0 vCenter Security Technical Implementation Guide

Version

V2R3

Release Date

Jun 9, 2025

SCAP Benchmark ID

VMW_vSphere_8-0_vCenter_STIG

Total Checks

67

Tags

vmware
CAT I: 1CAT II: 64CAT III: 2

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (67)

V-258905MEDIUMThe vCenter Server must enforce the limit of three consecutive invalid login attempts by a user.V-258906MEDIUMThe vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before logon.V-258907MEDIUMThe vCenter Server must produce audit records containing information to establish what type of events occurred.V-258908MEDIUMvCenter Server plugins must be verified.V-258909MEDIUMThe vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.V-258910MEDIUMThe vCenter Server must require multifactor authentication.V-258911MEDIUMThe vCenter Server passwords must be at least 15 characters in length.V-258912MEDIUMThe vCenter Server must prohibit password reuse for a minimum of five generations.V-258913MEDIUMThe vCenter Server passwords must contain at least one uppercase character.V-258914MEDIUMThe vCenter Server passwords must contain at least one lowercase character.V-258915MEDIUMThe vCenter Server passwords must contain at least one numeric character.V-258916MEDIUMThe vCenter Server passwords must contain at least one special character.V-258917HIGHThe vCenter Server must enable FIPS-validated cryptography.V-258918MEDIUMThe vCenter Server must enforce a 90-day maximum password lifetime restriction.V-258919MEDIUMThe vCenter Server must enable revocation checking for certificate-based authentication.V-258920MEDIUMThe vCenter Server must terminate vSphere Client sessions after 15 minutes of inactivity.V-258921MEDIUMThe vCenter Server user roles must be verified.V-258922MEDIUMThe vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).V-258923MEDIUMThe vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.V-258924MEDIUMThe vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.V-258925MEDIUMThe vCenter Server must be configured to send logs to a central log server.V-258926MEDIUMThe vCenter server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.V-258927MEDIUMThe vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.V-258928MEDIUMThe vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.V-258929MEDIUMThe vCenter Server must enable data at rest encryption for vSAN.V-258930MEDIUMThe vCenter Server must disable the Customer Experience Improvement Program (CEIP).V-258931MEDIUMThe vCenter server must enforce SNMPv3 security features where SNMP is required.V-258932MEDIUMThe vCenter server must disable SNMPv1/2 receivers.V-258933MEDIUMThe vCenter Server must require an administrator to unlock an account locked due to excessive login failures.V-258934MEDIUMThe vCenter Server must disable the distributed virtual switch health check.V-258935MEDIUMThe vCenter Server must set the distributed port group Forged Transmits policy to "Reject".V-258936MEDIUMThe vCenter Server must set the distributed port group Media Access Control (MAC) Address Change policy to "Reject".V-258937MEDIUMThe vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".V-258938MEDIUMThe vCenter Server must only send NetFlow traffic to authorized collectors.V-258939MEDIUMThe vCenter Server must configure all port groups to a value other than that of the native virtual local area network (VLAN).V-258940MEDIUMThe vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized.V-258941MEDIUMThe vCenter Server must not configure all port groups to virtual local area network (VLAN) values reserved by upstream physical switches.V-258942MEDIUMThe vCenter Server must configure the "vpxuser" auto-password to be changed every 30 days.V-258943MEDIUMThe vCenter Server must configure the "vpxuser" password to meet length policy.V-258944LOWThe vCenter Server must be isolated from the public internet but must still allow for patch notification and delivery.V-258945MEDIUMThe vCenter Server must use unique service accounts when applications connect to vCenter.V-258946MEDIUMThe vCenter Server must protect the confidentiality and integrity of transmitted information by isolating Internet Protocol (IP)-based storage traffic.V-258947MEDIUMThe vCenter server must be configured to send events to a central log server.V-258948MEDIUMThe vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List (HCL) by use of an external proxy server.V-258949MEDIUMThe vCenter Server must configure the vSAN Datastore name to a unique name.V-258950MEDIUMThe vCenter Server must disable Username/Password and Windows Integrated Authentication.V-258951MEDIUMThe vCenter Server must restrict access to the default roles with cryptographic permissions.V-258952MEDIUMThe vCenter Server must restrict access to cryptographic permissions.V-258953MEDIUMThe vCenter Server must have Mutual Challenge Handshake Authentication Protocol (CHAP) configured for vSAN Internet Small Computer System Interface (iSCSI) targets.V-258954MEDIUMThe vCenter Server must have new Key Encryption Keys (KEKs) reissued at regular intervals for vSAN encrypted datastore(s).V-258955MEDIUMThe vCenter Server must use secure Lightweight Directory Access Protocol (LDAPS) when adding an LDAP identity source.V-258956MEDIUMThe vCenter Server must limit membership to the "SystemConfiguration.BashShellAdministrators" Single Sign-On (SSO) group.V-258957MEDIUMThe vCenter Server must limit membership to the "TrustedAdmins" Single Sign-On (SSO) group.V-258958MEDIUMThe vCenter server configuration must be backed up on a regular basis.V-258959MEDIUMThe vCenter server must have task and event retention set to at least 30 days.V-258960MEDIUMThe vCenter server Native Key Provider must be backed up with a strong password.V-258961MEDIUMThe vCenter server must require authentication for published content libraries.V-258962MEDIUMThe vCenter server must enable the OVF security policy for content libraries.V-258963MEDIUMThe vCenter Server must separate authentication and authorization for administrators.V-258964LOWThe vCenter Server must disable CDP/LLDP on distributed switches.V-258965MEDIUMThe vCenter Server must remove unauthorized port mirroring sessions on distributed switches.V-258966MEDIUMThe vCenter Server must not override port group settings at the port level on distributed switches.V-258967MEDIUMThe vCenter Server must reset port configuration when virtual machines are disconnected.V-258968MEDIUMThe vCenter Server must disable Secure Shell (SSH) access.V-258969MEDIUMThe vCenter Server must enable data in transit encryption for vSAN.V-265978MEDIUMThe vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.V-265979MEDIUMThe vCenter Server must disable accounts used for Integrated Windows Authentication (IWA).