STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must notify System Administrators and Information System Security Officers of account disabling actions.

DISA Rule

SV-222419r508029_rule

Vulnerability Number

V-222419

Group Title

SRG-APP-000293

Rule Version

APSC-DV-000400

Severity

CAT III

CCI(s)

• CCI-001685 - The information system notifies organization-defined personnel or roles for account disabling actions.

Weight

10

Fix Recommendation

Configure the application to notify the system administrator and the ISSO when application accounts are disabled.

Check Contents

Review the application and system documentation.

Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.

If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.

Ensure application is configured to notify system administrators when accounts are disabled by identifying system administrators who will be notified when accounts are disabled.

Disable a test account and check with a system administrator to verify notification was received.

If system administrators and ISSOs are not notified when accounts are disabled, this is a finding.

Vulnerability Number

V-222419

Documentable

False

Rule Version

APSC-DV-000400

Severity Override Guidance

Review the application and system documentation.

Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.

If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.

Ensure application is configured to notify system administrators when accounts are disabled by identifying system administrators who will be notified when accounts are disabled.

Disable a test account and check with a system administrator to verify notification was received.

If system administrators and ISSOs are not notified when accounts are disabled, this is a finding.

Check Content Reference

M

Target Key

4093

Comments