| Checked | Name | Title |
|---|
| ☐ | SV-70831r1_rule | The operating system must provide automated mechanisms for supporting account management functions. |
| ☐ | SV-70833r1_rule | The operating system must enable an application firewall, if available. |
| ☐ | SV-70835r1_rule | The operating system must automatically remove or disable temporary user accounts after 72 hours. |
| ☐ | SV-70837r2_rule | The operating system must audit all account creations. |
| ☐ | SV-70839r1_rule | The operating system must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period. |
| ☐ | SV-70843r1_rule | The operating system must limit the ability of non-privileged users to grant other users direct access to the contents of their home directories/folders. |
| ☐ | SV-70845r1_rule | The operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system. |
| ☐ | SV-70847r1_rule | The operating system must not allow an unattended or automatic logon to the system. |
| ☐ | SV-70849r1_rule | The operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files. |
| ☐ | SV-70851r1_rule | The operating system must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. |
| ☐ | SV-70853r1_rule | The operating system must display the Standard Mandatory DoD Notice and Consent Banner until users acknowledge the usage conditions and take explicit actions to log on for further access. |
| ☐ | SV-70855r1_rule | The operating system must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt. |
| ☐ | SV-70857r1_rule | The operating system must prevent the use of dictionary words for passwords. |
| ☐ | SV-70859r2_rule | The operating system must, at a minimum, off-load audit data from interconnected systems in real time and off-load audit data from standalone systems weekly. |
| ☐ | SV-70861r1_rule | The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
| ☐ | SV-70863r1_rule | The operating system must generate audit records for all kernel module load, unload, and restart actions, and also for all program initiations. |
| ☐ | SV-70865r1_rule | The operating system must generate audit records for all account creations, modifications, disabling, and termination events. |
| ☐ | SV-70867r1_rule | The operating system must generate audit records for all direct access to the information system. |
| ☐ | SV-70869r1_rule | The operating system must generate audit records when successful/unsuccessful accesses to objects occur. |
| ☐ | SV-70871r1_rule | The operating system must generate audit records when concurrent logons to the same account occur from different sources. |
| ☐ | SV-70873r1_rule | The operating system must generate audit records showing starting and ending time for user access to the system. |
| ☐ | SV-70875r1_rule | The audit system must be configured to audit the loading and unloading of dynamic kernel modules. |
| ☐ | SV-70877r1_rule | The operating system must generate audit records for privileged activities or other system-level access. |
| ☐ | SV-70879r1_rule | The operating system must generate audit records when successful/unsuccessful logon attempts occur. |
| ☐ | SV-70881r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to delete security objects occur. |
| ☐ | SV-70883r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to delete security levels occur. |
| ☐ | SV-70885r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to delete privileges occur. |
| ☐ | SV-70887r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur. |
| ☐ | SV-70889r1_rule | The operating system must limit the number of concurrent sessions to ten for all accounts and/or account types. |
| ☐ | SV-70891r1_rule | The operating system must retain a users session lock until that user reestablishes access using established identification and authentication procedures. |
| ☐ | SV-70893r1_rule | The operating system must initiate a session lock after a 15-minute period of inactivity for all connection types. |
| ☐ | SV-70895r1_rule | The operating system must provide the capability for users to directly initiate a session lock for all connection types. |
| ☐ | SV-70897r1_rule | The operating system must conceal, via the session lock, information previously visible on the display with a publicly viewable image. |
| ☐ | SV-70899r1_rule | The operating system must monitor remote access methods. |
| ☐ | SV-70901r1_rule | The operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions. |
| ☐ | SV-70903r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to modify security objects occur. |
| ☐ | SV-70905r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to modify privileges occur. |
| ☐ | SV-70907r1_rule | The operating system must produce audit records containing information to establish what type of events occurred. |
| ☐ | SV-70909r1_rule | The operating system must produce audit records containing information to establish when (date and time) the events occurred. |
| ☐ | SV-70911r1_rule | The operating system must produce audit records containing information to establish where the events occurred. |
| ☐ | SV-70913r1_rule | The operating system must produce audit records containing information to establish the source of the events. |
| ☐ | SV-70915r1_rule | The operating system must produce audit records containing information to establish the outcome of the events. |
| ☐ | SV-70917r1_rule | The operating system must generate audit records containing the full-text recording of privileged commands. |
| ☐ | SV-70919r1_rule | The operating system must produce audit records containing the individual identities of group account users. |
| ☐ | SV-70921r1_rule | The operating system must alert the ISSO and SA (at a minimum) in the event of an audit processing failure. |
| ☐ | SV-70923r1_rule | The operating system must shut down by default upon audit failure (unless availability is an overriding concern). |
| ☐ | SV-70925r1_rule | The operating system must provide the capability to centrally review and analyze audit records from multiple components within the system. |
| ☐ | SV-70927r1_rule | The operating system must provide the capability to filter audit records for events of interest based upon all audit fields within audit records. |
| ☐ | SV-70929r1_rule | The operating system must use internal system clocks to generate time stamps for audit records. |
| ☐ | SV-70931r1_rule | The operating system must protect audit information from unauthorized read access. |
| ☐ | SV-70933r1_rule | The operating system must protect audit information from unauthorized modification. |
| ☐ | SV-70935r1_rule | The operating system must protect audit information from unauthorized deletion. |
| ☐ | SV-70937r1_rule | The operating system must provide audit record generation capability for DoD-defined auditable events for all operating system components. |
| ☐ | SV-70939r1_rule | The operating system must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. |
| ☐ | SV-70941r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to access privileges occur. |
| ☐ | SV-70943r1_rule | The operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. |
| ☐ | SV-70945r1_rule | The operating system, for PKI-based authentication, must enforce authorized access to the corresponding private key. |
| ☐ | SV-70947r1_rule | The operating system must map the authenticated identity to the user or group account for PKI-based authentication. |
| ☐ | SV-70949r1_rule | The operating system must enforce password complexity by requiring that at least one upper-case character be used. |
| ☐ | SV-70951r1_rule | The operating system must enforce password complexity by requiring that at least one lower-case character be used. |
| ☐ | SV-70953r1_rule | The operating system must enforce password complexity by requiring that at least one numeric character be used. |
| ☐ | SV-70955r2_rule | The operating system must require the change of at least 50% of the total number of characters when passwords are changed. |
| ☐ | SV-70957r1_rule | The operating system must store only encrypted representations of passwords. |
| ☐ | SV-70959r1_rule | The operating system must transmit only encrypted representations of passwords. |
| ☐ | SV-70961r1_rule | Operating systems must enforce 24 hours/1 day as the minimum password lifetime. |
| ☐ | SV-70963r1_rule | Operating systems must enforce a 60-day maximum password lifetime restriction. |
| ☐ | SV-70965r1_rule | The operating system must prohibit password reuse for a minimum of five generations. |
| ☐ | SV-70971r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur. |
| ☐ | SV-70973r1_rule | The operating system must generate audit records when successful/unsuccessful attempts to access security objects occur. |
| ☐ | SV-70975r1_rule | The operating system must shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered. |
| ☐ | SV-70977r1_rule | The operating system must perform verification of the correct operation of security functions: upon system start-up and/or restart; upon command by a user with privileged access; and/or every 30 days. |
| ☐ | SV-70979r1_rule | The operating system must verify correct operation of all security functions. |
| ☐ | SV-70981r1_rule | The operating system must remove all software components after updated versions have been installed. |
| ☐ | SV-70983r1_rule | The operating system must implement address space layout randomization to protect its memory from unauthorized code execution. |
| ☐ | SV-70985r1_rule | The operating system must implement non-executable data to protect its memory from unauthorized code execution. |
| ☐ | SV-70987r1_rule | The operating system must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received. |
| ☐ | SV-70989r1_rule | The operating system must maintain the confidentiality and integrity of information during reception. |
| ☐ | SV-70991r1_rule | The operating system must maintain the confidentiality and integrity of information during preparation for transmission. |
| ☐ | SV-70993r1_rule | The operating system must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS). |
| ☐ | SV-70995r1_rule | The operating system must protect the confidentiality and integrity of transmitted information. |
| ☐ | SV-70997r1_rule | The operating system must protect against or limit the effects of Denial of Service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces. |
| ☐ | SV-70999r1_rule | The operating system must implement cryptographic mechanisms to prevent unauthorized disclosure of all information at rest on all operating system components. |
| ☐ | SV-71001r1_rule | The operating system must implement cryptographic mechanisms to prevent unauthorized modification of all information at rest on all operating system components. |
| ☐ | SV-71003r1_rule | The operating system must enforce a minimum 15-character password length. |
| ☐ | SV-71005r1_rule | The operating system must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. |
| ☐ | SV-71007r1_rule | The operating system must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
| ☐ | SV-71009r1_rule | The operating system must be configured to disable non-essential capabilities. |
| ☐ | SV-71011r1_rule | The operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments. |
| ☐ | SV-71013r1_rule | The operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users). |
| ☐ | SV-71015r1_rule | The operating system must use multifactor authentication for network access to privileged accounts. |
| ☐ | SV-71017r1_rule | The operating system must use multifactor authentication for network access to non-privileged accounts. |
| ☐ | SV-71019r1_rule | The operating system must use multifactor authentication for local access to privileged accounts. |
| ☐ | SV-71021r1_rule | The operating system must use multifactor authentication for local access to non-privileged accounts. |
| ☐ | SV-71023r1_rule | The operating system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator. |
| ☐ | SV-71025r1_rule | The operating system must implement replay-resistant authentication mechanisms for network access to privileged accounts. |
| ☐ | SV-71027r1_rule | The operating system must implement replay-resistant authentication mechanisms for network access to non-privileged accounts. |
| ☐ | SV-71029r1_rule | The operating system must uniquely identify peripherals before establishing a connection. |
| ☐ | SV-71031r1_rule | The operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity. |
| ☐ | SV-71033r2_rule | The operating system must only allow the use of DoD PKI-established certificate authorities for authentication in the establishment of protected sessions to the operating system. |
| ☐ | SV-71035r1_rule | The operating system must perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources. |
| ☐ | SV-71037r1_rule | The operating system must perform data integrity verification on the name/address resolution responses the system receives from authoritative sources. |
| ☐ | SV-71039r1_rule | The operating system must request data integrity verification on the name/address resolution responses the system receives from authoritative sources. |
| ☐ | SV-71041r1_rule | The operating system must request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources. |
| ☐ | SV-71043r1_rule | The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
| ☐ | SV-71045r1_rule | The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. |
| ☐ | SV-71047r1_rule | The operating system must verify remote disconnection at the termination of nonlocal maintenance and diagnostic sessions, when used for nonlocal maintenance sessions. |
| ☐ | SV-71049r1_rule | The operating system must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions. |
| ☐ | SV-71051r1_rule | The operating system must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users). |
| ☐ | SV-71053r1_rule | The operating system must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions. |
| ☐ | SV-71055r1_rule | The operating system must audit all activities performed during nonlocal maintenance and diagnostic sessions. |
| ☐ | SV-71057r1_rule | The operating system, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network. |
| ☐ | SV-71059r1_rule | The operating system must provide an audit reduction capability that supports on-demand reporting requirements. |
| ☐ | SV-71061r1_rule | The operating system must prohibit the use of cached authenticators after one day. |
| ☐ | SV-71063r1_rule | The operating system must allow the use of a temporary password for system logons with an immediate change to a permanent password. |
| ☐ | SV-71065r3_rule | The information system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours. |
| ☐ | SV-71067r1_rule | The operating system must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based. |
| ☐ | SV-71069r1_rule | The operating system must authenticate peripherals before establishing a connection. |
| ☐ | SV-71071r1_rule | The operating system must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions. |
| ☐ | SV-71073r1_rule | The operating system must electronically verify Personal Identity Verification (PIV) credentials. |
| ☐ | SV-71075r1_rule | The operating system must accept Personal Identity Verification (PIV) credentials. |
| ☐ | SV-71077r1_rule | The operating system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access. |
| ☐ | SV-71083r1_rule | The operating system must require devices to re-authenticate when changing authenticators. |
| ☐ | SV-71087r1_rule | The operating system must require users to re-authenticate when changing authenticators. |
| ☐ | SV-71089r1_rule | The operating system must terminate all sessions and network connections related to nonlocal maintenance when nonlocal maintenance is completed. |
| ☐ | SV-71091r1_rule | The operating system must require users to re-authenticate when changing roles. |
| ☐ | SV-71095r1_rule | The operating system must separate user functionality (including user interface services) from operating system management functionality. |
| ☐ | SV-71097r1_rule | The operating system must require users to re-authenticate for privilege escalation. |
| ☐ | SV-71101r2_rule | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. |
| ☐ | SV-71103r1_rule | The operating system must isolate security functions from nonsecurity functions. |
| ☐ | SV-71105r1_rule | The operating system must prevent program execution in accordance with local policies regarding software program usage and restrictions and/or rules authorizing the terms and conditions of software program usage. |
| ☐ | SV-71109r1_rule | The operating system must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization. |
| ☐ | SV-71111r1_rule | The operating system must audit the enforcement actions used to restrict access associated with changes to the system. |
| ☐ | SV-71113r1_rule | Operating systems must prevent unauthorized and unintended information transfer via shared system resources. |
| ☐ | SV-71121r1_rule | The operating system must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks. |
| ☐ | SV-71125r1_rule | The operating system must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements. |
| ☐ | SV-71129r1_rule | The operating system must fail to a secure state if system initialization fails, shutdown fails, or aborts fail. |
| ☐ | SV-71137r1_rule | The operating system must protect the confidentiality and integrity of all information at rest. |
| ☐ | SV-71143r1_rule | The operating system must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). |
| ☐ | SV-71147r1_rule | The operating system must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. |
| ☐ | SV-71163r1_rule | The operating system must reveal error messages only to authorized users. |
| ☐ | SV-71169r1_rule | Any publically accessible connection to the operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. |
| ☐ | SV-71173r2_rule | The operating system must audit all account modifications. |
| ☐ | SV-71177r1_rule | The operating system must audit all account disabling actions. |
| ☐ | SV-71181r1_rule | The operating system must audit all account removal actions. |
| ☐ | SV-71195r1_rule | The operating system must implement cryptography to protect the integrity of remote access sessions. |
| ☐ | SV-71199r1_rule | The operating system must initiate session audits at system start-up. |
| ☐ | SV-71429r1_rule | The operating system must enforce access restrictions. |
| ☐ | SV-71431r1_rule | The operating system must produce audit records containing information to establish the identity of any individual or process associated with the event. |
| ☐ | SV-71433r1_rule | The operating system must protect audit tools from unauthorized access. |
| ☐ | SV-71435r1_rule | The operating system must protect audit tools from unauthorized modification. |
| ☐ | SV-71437r1_rule | The operating system must protect audit tools from unauthorized deletion. |
| ☐ | SV-71439r1_rule | The operating system must notify designated personnel if baseline configurations are changed in an unauthorized manner. |
| ☐ | SV-71441r1_rule | The operating system must prohibit user installation of system software without explicit privileged status. |
| ☐ | SV-71443r1_rule | The operating system must limit privileges to change software resident within software libraries. |
| ☐ | SV-71445r1_rule | The operating system must enforce dual authorization for movement and/or deletion of all audit information, when such movement or deletion is not part of an authorized automatic process. |
| ☐ | SV-71447r1_rule | The operating system must enforce password complexity by requiring that at least one special character be used. |
| ☐ | SV-71449r1_rule | The operating system must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). |
| ☐ | SV-71451r1_rule | In the event of a system failure, the operating system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes. |
| ☐ | SV-71453r1_rule | The operating system must record time stamps for audit records that meet a minimum granularity of one second for a minimum degree of precision. |
| ☐ | SV-71455r2_rule | The operating system must notify system administrators and ISSOs when accounts are created. |
| ☐ | SV-71457r2_rule | The operating system must notify system administrators and ISSOs when accounts are modified. |
| ☐ | SV-71459r2_rule | The operating system must notify system administrators and ISSOs when accounts are disabled. |
| ☐ | SV-71461r2_rule | The operating system must notify system administrators and ISSOs when accounts are removed. |
| ☐ | SV-71463r1_rule | The operating system must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second. |
| ☐ | SV-71465r1_rule | The operating system must use cryptographic mechanisms to protect the integrity of audit tools. |
| ☐ | SV-71467r1_rule | The operating system must automatically terminate a user session after inactivity time-outs have expired or at shutdown. |
| ☐ | SV-71469r1_rule | The operating system must provide a logoff capability for user-initiated communications sessions when requiring user access authentication. |
| ☐ | SV-71471r1_rule | The operating system must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions. |
| ☐ | SV-71473r1_rule | The operating system must control remote access methods. |
| ☐ | SV-71475r1_rule | The operating system must provide the capability to immediately disconnect or disable remote access to the operating system. |
| ☐ | SV-71477r1_rule | The operating system must protect wireless access to and from the system using encryption. |
| ☐ | SV-71479r1_rule | The operating system must protect wireless access to the system using authentication of users and/or devices. |
| ☐ | SV-71481r2_rule | The operating system must audit all account enabling actions. |
| ☐ | SV-71483r2_rule | The operating system must notify system administrators and ISSOs of account enabling actions. |
| ☐ | SV-71485r1_rule | The operating system must allow operating system admins to pass information to any other operating system admin or user. |
| ☐ | SV-71487r1_rule | The operating system must allow operating system admins to grant their privileges to other operating system admins. |
| ☐ | SV-71489r1_rule | The operating system must allow operating system admins to change security attributes on users, the operating system, or the operating systems components. |
| ☐ | SV-71491r1_rule | The operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
| ☐ | SV-71493r1_rule | The operating system must prevent all software from executing at higher privilege levels than users executing the software. |
| ☐ | SV-71495r1_rule | The operating system must audit the execution of privileged functions. |
| ☐ | SV-71497r1_rule | The operating system must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur. |
| ☐ | SV-71499r1_rule | The operating system must provide the capability for assigned IMOs/ISSOs or designated SAs to change the auditing to be performed on all operating system components, based on all selectable event criteria in near real time. |
| ☐ | SV-71505r1_rule | The operating system must allocate audit record storage capacity to store at least one weeks worth of audit records, when audit records are not immediately sent to a central audit record storage facility. |
| ☐ | SV-71507r1_rule | The operating system must off-load audit records onto a different system or media from the system being audited. |
| ☐ | SV-71509r1_rule | The operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity. |
| ☐ | SV-71511r1_rule | The operating system must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events requiring real-time alerts. |
| ☐ | SV-71513r1_rule | The operating system must provide an audit reduction capability that supports on-demand audit review and analysis. |
| ☐ | SV-71515r1_rule | The operating system must provide an audit reduction capability that supports after-the-fact investigations of security incidents. |
| ☐ | SV-71517r1_rule | The operating system must provide a report generation capability that supports on-demand audit review and analysis. |
| ☐ | SV-71519r1_rule | The operating system must provide a report generation capability that supports on-demand reporting requirements. |
| ☐ | SV-71521r1_rule | The operating system must provide a report generation capability that supports after-the-fact investigations of security incidents. |
| ☐ | SV-71523r1_rule | The operating system must not alter original content or time ordering of audit records when it provides an audit reduction capability. |
| ☐ | SV-71525r1_rule | The operating system must not alter original content or time ordering of audit records when it provides a report generation capability. |
| ☐ | SV-71527r1_rule | The operating system must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). |
| ☐ | SV-79303r1_rule | The operating system must protect the confidentiality and integrity of communications with wireless peripherals. |
STIGQter: STIG Summary: