STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must electronically verify Personal Identity Verification (PIV) credentials.

DISA Rule

SV-222525r508029_rule

Vulnerability Number

V-222525

Group Title

SRG-APP-000392

Rule Version

APSC-DV-001570

Severity

CAT II

CCI(s)

• CCI-001954 - The information system electronically verifies Personal Identity Verification (PIV) credentials.

Weight

10

Fix Recommendation

Configure the application to require CAC authentication.

Check Contents

Review the application documentation and interview the application administrator to identify application access methods.

If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.

Ask the application administrator to log on to the application.

Validate the application prompts the user to provide a certificate from the CAC.

Validate the application requests the user to input their CAC PIN.

If the application allows access without requiring a CAC, this is a finding.

Vulnerability Number

V-222525

Documentable

False

Rule Version

APSC-DV-001570

Severity Override Guidance

Review the application documentation and interview the application administrator to identify application access methods.

If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.

Ask the application administrator to log on to the application.

Validate the application prompts the user to provide a certificate from the CAC.

Validate the application requests the user to input their CAC PIN.

If the application allows access without requiring a CAC, this is a finding.

Check Content Reference

M

Target Key

4093

Comments