STIGQter STIGQter: STIG Summary: VMware vSphere 6.7 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The vCenter Server must have new Key Encryption Keys (KEKs) reissued at regular intervals for vSAN encrypted datastore(s).

DISA Rule

SV-243121r719606_rule

Vulnerability Number

V-243121

Group Title

SRG-APP-000516

Rule Version

VCTR-67-000066

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If vSAN encryption is in use, ensure that a regular rekey procedure is in place.

Check Contents

Interview the SA to determine that a procedure has been implemented to perform a mustow rekey of all vSAN encrypted datastores at regular, site-defined intervals.

VMware recommends a 60-day rekey task, but this interval must be defined by the SA and the ISSO.

If vSAN encryption is not in use, this is not a finding.

Vulnerability Number

V-243121

Documentable

False

Rule Version

VCTR-67-000066

Severity Override Guidance

Interview the SA to determine that a procedure has been implemented to perform a mustow rekey of all vSAN encrypted datastores at regular, site-defined intervals.

VMware recommends a 60-day rekey task, but this interval must be defined by the SA and the ISSO.

If vSAN encryption is not in use, this is not a finding.

Check Content Reference

M

Target Key

5399

Comments