# findings

vuln_id: V-218795
rule_id: SV-218795r960963_rule
status: NotAFinding
comments: There are no sample files in the targeted directories. This is Not a Finding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: A61E6E1F4236FBB1D74C63FF96102D9E19672555
  ~~~~~
  There are no files or folders with names containing 'sample' in the targeted directories.


  To determine the correct status, a manual review is still required to identify if any example code, example applications or tutorials exist and are not explicitly used by the production website per the check text.


vuln_id: V-218796
rule_id: SV-218796r960963_rule
status: NotAFinding
comments: There are no accounts created by uninstalled features. This is Not a Finding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: 18A38144AE758B632F13BB4CD7F8C15B7EA37790
  ~~~~~
  Local user accounts on this system:

  DefaultAccount
  DOD_Admin
  Visitor
  WDAGUtilityAccount
  X_Admin


vuln_id: V-218797
rule_id: SV-218797r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: A651C464F3C53AD8D73A90109651B37A8084D1B7
  ~~~~~
  The following Windows features are installed:

  AzureArcSetup
  DeviceHealthAttestationService
  FileAndStorage-Services
  File-Services
  FS-FileServer
  NET-Framework-45-ASPNET
  NET-Framework-45-Core
  NET-Framework-45-Features
  NET-WCF-HTTP-Activation45
  NET-WCF-Services45
  NET-WCF-TCP-PortSharing45
  PowerShell
  PowerShellRoot
  Storage-Services
  System-DataArchiver
  WAS
  WAS-Config-APIs
  WAS-Process-Model
  Web-App-Dev
  Web-Asp-Net45
  Web-Common-Http
  Web-Default-Doc
  Web-Dir-Browsing
  Web-Filtering
  Web-Health
  Web-Http-Errors
  Web-Http-Logging
  Web-Http-Tracing
  Web-Includes
  Web-ISAPI-Ext
  Web-ISAPI-Filter
  Web-Mgmt-Console
  Web-Mgmt-Tools
  Web-Net-Ext45
  Web-Performance
  Web-Security
  Web-Server
  Web-Stat-Compression
  Web-Static-Content
  Web-WebServer
  Windows-Defender
  WoW64-Support

comments:
  Regularly reviewed the IIS 10.0 web server and removed any unnecessary operating system features, utility programs, plug-ins, and modules. This is Not a Finding


vuln_id: V-218798
rule_id: SV-218798r1112381_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be OPEN on 03/05/2026
  ResultHash: 47C2C311101A88836E6EF2E986BC87A38AC57B63
  ~~~~~
  The following invalid MIME types for OS shell program extensions are configured:

  .exe
  .dll
  .csh

comments:
  Manual check shows settings as follows:

  No invalid MIME types for OS shell program extensions found.


vuln_id: V-218799
rule_id: SV-218799r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 11E9E664D97AAF7C5FF4F4BDDCF9203D790D431E
  ~~~~~
  WebDAV is not installed.


vuln_id: V-218801
rule_id: SV-218801r961083_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 7C036395A18A2F6B324D665A6F665274B1C279AC
  ~~~~~
  No .java or .jpp files were found on the system.


vuln_id: V-218802
rule_id: SV-218802r1138072_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: 9A3718B89C7FADF6CB49CB06D125501748FAE274
  ~~~~~
  Below is a list of local groups and their members (if any):

  Group:	Access Control Assistance Operators

  Group:	Administrators
    X_Admin
    DOD_Admin
    Server Administrator Group

  Group:	Backup Operators
    Server Administrator Group

  Group:	Certificate Service DCOM Access

  Group:	Cryptographic Operators

  Group:	Distributed COM Users

  Group:	Event Log Readers

  Group:	Guests
    Visitor

  Group:	Hyper-V Administrators

  Group:	IIS_IUSRS

  Group:	Network Configuration Operators

  Group:	Performance Log Users

  Group:	Performance Monitor Users

  Group:	Power Users

  Group:	Print Operators

  Group:	RDS Endpoint Servers

  Group:	RDS Management Servers

  Group:	RDS Remote Access Servers

  Group:	Remote Desktop Users
    Server Administrator Group

  Group:	Remote Management Users

  Group:	Replicator

  Group:	Storage Replica Administrators

  Group:	System Managed Accounts Group
    DefaultAccount

  Group:	Users
    INTERACTIVE
    Authenticated Users
    Domain Users

comments:
  Restricted system resource access to authorized administrators, enforce least privilege, disable unnecessary user access, and conduct regular audits to ensure compliance. This is Not a Finding


vuln_id: V-218803
rule_id: SV-218803r1138074_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
comments:
  Ensured all IIS 10.0 scripts, applications, and configuration files have proper permissions to prevent unauthorized access, modification, or execution. This is Not a Finding


vuln_id: V-218804
rule_id: SV-218804r1043180_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 82F8F3236DC4CEA119EF339FF044AF71A3B6F80F
  ~~~~~
  Cookie Settings Mode is configured to 'UseCookies'


vuln_id: V-218805
rule_id: SV-218805r1067583_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 7533F9E6958FD6D045546A3732F63AFD8472E223
  ~~~~~
  Cookie Settings Mode is configured to 'UseCookies'
  Time-out is configured to '00:15:00'


vuln_id: V-218806
rule_id: SV-218806r961122_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
comments:
  Disabled directory browsing in IIS 10.0 to prevent unauthorized users from viewing file and folder listings, reducing exposure to sensitive information. This is Not a Finding


vuln_id: V-218807
rule_id: SV-218807r1067586_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 530DCB7F759E36FF01EB01CF5B0A9E37991A6046
  ~~~~~
  Validation method is configured to 'HMACSHA256'
  Encryption method is configured to 'Auto'


vuln_id: V-218808
rule_id: SV-218808r961158_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 5386A3B2F3411A770BCAD2C194ACBAEBD1970A52
  ~~~~~
  Directory Browsing is disabled.


vuln_id: V-218809
rule_id: SV-218809r961167_rule
status: Not_Applicable
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT APPLICABLE on 03/05/2026
  ResultHash: 4BD2B86D8CFC3DF2188407FE8BEF3C5953DFB07F
  ~~~~~
  The ContentIndex\Catalogs key does not exist so this check is Not Applicable.


vuln_id: V-218810
rule_id: SV-218810r1022657_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 8DD7CFE973D10647A1435F5B797FDBD4463D27D1
  ~~~~~
  Error Responses is configured to 'Detailed errors for local requests and custom error pages for remote requests'

  errorMode:	DetailedLocalOnly


vuln_id: V-218812
rule_id: SV-218812r961278_rule
status: Not_Applicable
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT APPLICABLE on 03/05/2026
  ResultHash: 69339D5EDE3A1D594FB554D39E84CA77B3304C98
  ~~~~~
  The remote management feature of IIS is not installed so this check is Not Applicable.


vuln_id: V-218813
rule_id: SV-218813r961281_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 32AFF8CF36570A0DC084CA270EE023B4DED1D486
  ~~~~~
  There is nothing preventing an administrator from shutting down either the webservice or an individual IIS site in the event of an attack. Documentation exists describing how.


vuln_id: V-218814
rule_id: SV-218814r1067589_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 3D17137C642E0082CB98AAEDAD92AC406296074C
  ~~~~~
  Path:			C:\inetpub
  OverallState:	More restrictive than Expected
  Compliance:	Compliant
  Unexpected rules...
  ---------------------
  State:		MoreRestrictive
  Compliant:	True
  Identity:		APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES
  Type:		N/A
  Basic:		N/A
  Expected:		ReadAndExecute
  Advanced:	
  Expected:		ExecuteFile, ListDirectory, ReadAttributes, ReadData, ReadExtendedAttributes, ReadPermissions, Traverse
  Inherited:		N/A
  AppliesTo:	N/A
  Summary:		Missing Rule: An expected rule with rights 'ReadAndExecute' was not found on the system.

  State:		MoreRestrictive
  Compliant:	True
  Identity:		APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES
  Type:		N/A
  Basic:		N/A
  Expected:		ReadAndExecute
  Advanced:	
  Expected:		ExecuteFile, ListDirectory, ReadAttributes, ReadData, ReadExtendedAttributes, ReadPermissions, Traverse
  Inherited:		N/A
  AppliesTo:	N/A
  Summary:		Missing Rule: An expected rule with rights 'ReadAndExecute' was not found on the system.
  ---------------------


vuln_id: V-218815
rule_id: SV-218815r961392_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 6ADE9501D86E927416808AF0B186536D51A249DE
  ~~~~~
  Logs are set to roll over Daily.


vuln_id: V-218816
rule_id: SV-218816r1067591_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: C7672C2E607627099A46E345AF4C5CCB919F07F7
  ~~~~~
  Path:			C:\WINDOWS\system32\inetsrv\Inetmgr.exe
  OverallState:	More restrictive than Expected
  Compliance:	Compliant
  Unexpected rules...
  ---------------------
  State:		MoreRestrictive
  Compliant:	True
  Identity:		CREATOR OWNER
  Type:		N/A
  Basic:		N/A
  Expected:		FullControl
  Advanced:	
  Expected:		AppendData, ChangePermissions, CreateDirectories, CreateFiles, Delete, DeleteSubdirectoriesAndFiles, ExecuteFile, ListDirectory, ReadAttributes, ReadData, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, WriteAttributes, WriteData, WriteExtendedAttributes
  Inherited:		N/A
  AppliesTo:	N/A
  Summary:		Missing Rule: An expected rule with rights 'FullControl' was not found on the system.
  ---------------------


vuln_id: V-218817
rule_id: SV-218817r961470_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: 909864146B7EF18AC7E6CCAEB573BFB88320271A
  ~~~~~
  Software installed on this system:

  ActivID ActivClient x64
  Axway Desktop Validator
  CRLAutoCache
  DoD Secure Host Baseline Server
  InstallRoot
  Microsoft Edge
  Microsoft NetBanner
  Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.38.33130
  Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.38.33130
  STIG Viewer 3 (Machine)
  Veritas Backup Exec Remote Agent for Windows
  WinZip 23.0

comments:
  Enabled and enforced TLS 1.2 or higher in IIS 10.0 to ensure secure encrypted communication and protect against vulnerabilities in outdated protocols. This is Not a Finding


vuln_id: V-218818
rule_id: SV-218818r961470_rule
status: Not_Applicable
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT APPLICABLE on 03/05/2026
  ResultHash: 1BA0DAED412A266D2A2A6B88E64E20ADB5E27D37
  ~~~~~
  'C:\WINDOWS\web\printers' does not exist.

  The Print Services role and the Internet Printing role are not installed so this check is Not Applicable.


vuln_id: V-218819
rule_id: SV-218819r1022659_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 8CBC995ED18829A1A7D2C11A22AFC94E2B587D36
  ~~~~~
  Registry Path:	HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  Value Name:	URIEnableCache
  Value:		0
  Type:		REG_DWORD

  Registry Path:	HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  Value Name:	UriMaxUriBytes
  Value:		0
  Type:		REG_DWORD

  Registry Path:	HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  Value Name:	UriScavengerPeriod
  Value:		0
  Type:		REG_DWORD


vuln_id: V-218820
rule_id: SV-218820r961632_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: C25C8289B0EA2E5E62D0AB638195DFF95EA06806
  ~~~~~
  keepSessionIdSecure is set to True


vuln_id: V-218821
rule_id: SV-218821r1067596_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: B61C09790F563535A9E85CCAE0DFEC8635007810
  ~~~~~
  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
  ValueName 'DisabledByDefault' is '0' (REG_DWORD)
  ValueName 'Enabled' is '1' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)


vuln_id: V-218822
rule_id: SV-218822r961632_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 4BDF84B533F31E10B68E8C1D4A5EA500F955AE4A
  ~~~~~
  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
  ValueName 'DisabledByDefault' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)

  HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
  ValueName 'DisabledByDefault' is '1' (REG_DWORD)
  ValueName 'Enabled' is '0' (REG_DWORD)


vuln_id: V-218823
rule_id: SV-218823r961863_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: 5A9A993DF5E4702982BD11FC1A399EF47A354B5D
  ~~~~~
  Local user accounts on this system.  Confirm if any are used by IIS and if so, verify that default passwords have been changed:

  Name:		DOD_Admin
  Enabled:		True
  SID:			S-1-5-21-2359828523-3188837691-268305261-1000
  Password Age:	113 days

comments:
  Ensured IIS 10.0 web server logs all required HTTP request details to facilitate auditing, forensic analysis, and security monitoring. This is Not a Finding


vuln_id: V-218824
rule_id: SV-218824r961863_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 6CC480805F1D38F03EA4026B3D32A856071B7CC3
  ~~~~~
  Unspecified ISAPI is not enabled. NOT A FINDING.
  Unspecified CGI is not enabled. NOT A FINDING.


vuln_id: V-218825
rule_id: SV-218825r1067593_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: A801FC129AB7FA426BB47F800991FE54A5673509
  ~~~~~
  Compliant Rules:
  ----------------
  Mode:	allow
  Users:	All Users
  Roles:	
  Verbs:	

  Mode:	deny
  Users:	Anonymous Users
  Roles:	
  Verbs:


vuln_id: V-218826
rule_id: SV-218826r960735_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 5A7B32B2A3CB2520F7640F390CB84EC0B4D2A14A
  ~~~~~
  MaxConnections is set to 4294967295


vuln_id: V-218827
rule_id: SV-218827r1112380_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be OPEN on 03/05/2026
  ResultHash: F09EC8ADFB484180B5174DA75304B712E14EBA02
  ~~~~~
  HSTS is not enabled. FINDING.
  HSTS max-age is not configured. FINDING.
  HSTS includeSubDomains is enabled. NOT A FINDING.
  HSTS redirectHttpToHttps is enabled. NOT A FINDING.

comments:
  Manual check shows al setting are as follows:


  HSTS is enabled. NOT A FINDING.
  HSTS max-age is 5. NOT A FINDING.
  HSTS includeSubDomains is enabled. NOT A FINDING.
  HSTS redirectHttpToHttps is enabled. NOT A FINDING.

  This is Not a Finding


vuln_id: V-228572
rule_id: SV-228572r960963_rule
status: Not_Applicable
comments: The IIS web server is not running SMTP relay services, this is Not Applicable.
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: 3B7C7319D6AEB5A130CFDA357A0A502827AB79ED
  ~~~~~
  SMTP-Server Feature:	Available

  System is not listening on port 25.  Confirm there are no SMTP relays using a custom port.  If no SMTP relays exist, this may be marked as 'Not Applicable'.


vuln_id: V-241789
rule_id: SV-241789r1022662_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 66B7D124A0E1520B94BF24EE1F406C85600BB6A2
  ~~~~~
  'X-Powered-By' HTTP header has been removed.


vuln_id: V-268325
rule_id: SV-268325r1025163_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 9C13D4E19413A0316E06B6FA6D701ADB52DBB1C6
  ~~~~~
  Registry Path:	HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  Value Name:	DisableRequestSmuggling
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-218736
rule_id: SV-218736r1022669_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 453FAD461534700007B4F585B0D2FD1A4236A4FD
  ~~~~~
  Cookie Settings is set to 'UseCookies'


vuln_id: V-218737
rule_id: SV-218737r1022671_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: 1F8B0BF251048DDF52481451B9AA669A5C254D2B
  ~~~~~
  Require SSL is NOT enabled

comments:
  Ensured only Secure Socket Layer (SSL) connections are accepted by enabling the "Require SSL" setting in IIS Manager. This is Not A Finding


vuln_id: V-218738
rule_id: SV-218738r1022673_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: 1F8B0BF251048DDF52481451B9AA669A5C254D2B
  ~~~~~
  Require SSL is NOT enabled

comments:
  Ensured only Secure Socket Layer (SSL) connections are accepted by enabling the "Require SSL" setting in IIS Manager. This is Not A Finding


vuln_id: V-218739
rule_id: SV-218739r1022675_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 0B44ED3D6039C1A0BDB60FE41477857D9DAB447E
  ~~~~~
  'File' is the only option selected.

comments:
  Manual check shows setting as follows:

  Both ETW and Log file logging are enabled.

  This is Not a Finding


vuln_id: V-218741
rule_id: SV-218741r1022677_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 7599E6F84AF0FE02631E378C3BDEFF3AC6CE19D6
  ~~~~~
  Log format is 'W3C'

  The 'Request Header >> Connection' custom field is NOT configured.

  The 'Request Header >> Warning' custom field is NOT configured.

comments:
  Manual check shows setting as follows:

  Log format is 'W3C'

  The 'Request Header >> Connection' custom field is configured.

  The 'Request Header >> Warning' custom field is configured.


vuln_id: V-218742
rule_id: SV-218742r1022679_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: C3C26BB04CA1EEAB0A14FFB0A603274C530242F3
  ~~~~~
  Log format is 'W3C'

  User Agent, User Name, and Referrer are all logged.

  The 'Request Header >> Authorization' custom field is NOT configured.

  The 'Response Header >> Content-Type' custom field is NOT configured.

comments:
  Manual check shows setting as follows:

  Log format is 'W3C'

  User Agent, User Name, and Referrer are all logged.

  The 'Request Header >> Authorization' custom field is configured.

  The 'Response Header >> Content-Type' custom field is configured.


vuln_id: V-218743
rule_id: SV-218743r1156522_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 655AA1250F9F447877A75E551AC19473E3E576A5
  ~~~~~
  WSUS Hosted: False

  The following invalid MIME types for OS shell program extensions are configured:

  .exe
  .dll
  .csh

comments:
  Manual check shows setting as follows:

  WSUS Hosted: False

  No invalid MIME types for OS shell program extensions found.


vuln_id: V-218744
rule_id: SV-218744r1135545_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: 273D18146DC4BC86A65EF8CB8BEEC3EE2EA27C2B
  ~~~~~
  Access Policy: Read,Script

  Enabled Handler Mappings:
  -----------------------------------
  Name:		xamlx-ISAPI-4.0_64bit
  Path:			*.xamlx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		xamlx-ISAPI-4.0_32bit
  Path:			*.xamlx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		xamlx-Integrated-4.0
  Path:			*.xamlx
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		rules-ISAPI-4.0_64bit
  Path:			*.rules
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		rules-ISAPI-4.0_32bit
  Path:			*.rules
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		rules-Integrated-4.0
  Path:			*.rules
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		xoml-ISAPI-4.0_64bit
  Path:			*.xoml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		xoml-ISAPI-4.0_32bit
  Path:			*.xoml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		xoml-Integrated-4.0
  Path:			*.xoml
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		svc-ISAPI-4.0_64bit
  Path:			*.svc
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		svc-ISAPI-4.0_32bit
  Path:			*.svc
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		svc-Integrated-4.0
  Path:			*.svc
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		AXD-ISAPI-4.0_64bit
  Path:			*.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		PageHandlerFactory-ISAPI-4.0_64bit
  Path:			*.aspx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		SimpleHandlerFactory-ISAPI-4.0_64bit
  Path:			*.ashx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		WebServiceHandlerFactory-ISAPI-4.0_64bit
  Path:			*.asmx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-rem-ISAPI-4.0_64bit
  Path:			*.rem
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-soap-ISAPI-4.0_64bit
  Path:			*.soap
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		aspq-ISAPI-4.0_64bit
  Path:			*.aspq
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		cshtm-ISAPI-4.0_64bit
  Path:			*.cshtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		cshtml-ISAPI-4.0_64bit
  Path:			*.cshtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		vbhtm-ISAPI-4.0_64bit
  Path:			*.vbhtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		vbhtml-ISAPI-4.0_64bit
  Path:			*.vbhtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		TraceHandler-Integrated-4.0
  Path:			trace.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		WebAdminHandler-Integrated-4.0
  Path:			WebAdmin.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		AssemblyResourceLoader-Integrated-4.0
  Path:			WebResource.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		PageHandlerFactory-Integrated-4.0
  Path:			*.aspx
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		SimpleHandlerFactory-Integrated-4.0
  Path:			*.ashx
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		WebServiceHandlerFactory-Integrated-4.0
  Path:			*.asmx
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-rem-Integrated-4.0
  Path:			*.rem
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-soap-Integrated-4.0
  Path:			*.soap
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		aspq-Integrated-4.0
  Path:			*.aspq
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		cshtm-Integrated-4.0
  Path:			*.cshtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		cshtml-Integrated-4.0
  Path:			*.cshtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		vbhtm-Integrated-4.0
  Path:			*.vbhtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		vbhtml-Integrated-4.0
  Path:			*.vbhtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		ScriptHandlerFactoryAppServices-Integrated-4.0
  Path:			*_AppService.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		ScriptResourceIntegrated-4.0
  Path:			*ScriptResource.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		AXD-ISAPI-4.0_32bit
  Path:			*.axd
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		PageHandlerFactory-ISAPI-4.0_32bit
  Path:			*.aspx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		SimpleHandlerFactory-ISAPI-4.0_32bit
  Path:			*.ashx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		WebServiceHandlerFactory-ISAPI-4.0_32bit
  Path:			*.asmx
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-rem-ISAPI-4.0_32bit
  Path:			*.rem
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		HttpRemotingHandlerFactory-soap-ISAPI-4.0_32bit
  Path:			*.soap
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		aspq-ISAPI-4.0_32bit
  Path:			*.aspq
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		cshtm-ISAPI-4.0_32bit
  Path:			*.cshtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		cshtml-ISAPI-4.0_32bit
  Path:			*.cshtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		vbhtm-ISAPI-4.0_32bit
  Path:			*.vbhtm
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		vbhtml-ISAPI-4.0_32bit
  Path:			*.vbhtml
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		SSINC-stm
  Path:			*.stm
  State:		Enabled
  PathType:		File
  Handler:		ServerSideIncludeModule
  ReqAccess:	Script

  Name:		SSINC-shtm
  Path:			*.shtm
  State:		Enabled
  PathType:		File
  Handler:		ServerSideIncludeModule
  ReqAccess:	Script

  Name:		SSINC-shtml
  Path:			*.shtml
  State:		Enabled
  PathType:		File
  Handler:		ServerSideIncludeModule
  ReqAccess:	Script

  Name:		TRACEVerbHandler
  Path:			*
  State:		Enabled
  PathType:		Unspecified
  Handler:		ProtocolSupportModule
  ReqAccess:	None

  Name:		OPTIONSVerbHandler
  Path:			*
  State:		Enabled
  PathType:		Unspecified
  Handler:		ProtocolSupportModule
  ReqAccess:	None

  Name:		ExtensionlessUrlHandler-ISAPI-4.0_32bit
  Path:			*.
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		ExtensionlessUrlHandler-ISAPI-4.0_64bit
  Path:			*.
  State:		Enabled
  PathType:		Unspecified
  Handler:		IsapiModule
  ReqAccess:	Script

  Name:		ExtensionlessUrlHandler-Integrated-4.0
  Path:			*.
  State:		Enabled
  PathType:		Unspecified
  Handler:		ManagedPipelineHandler
  ReqAccess:	Script

  Name:		StaticFile
  Path:			*
  State:		Enabled
  PathType:		File or Folder
  Handler:		StaticFileModule,DefaultDocumentModule,DirectoryListingModule
  ReqAccess:	Read

  Disabled Handler Mappings:
  -----------------------------------
  Name:		ISAPI-dll
  Path:			*.dll
  State:		Disabled
  PathType:		File
  Handler:		IsapiModule
  ReqAccess:	Execute

comments:
  Removed mappings to unused or vulnerable scripts on the IIS 10.0 website to prevent unauthorized script execution. This is Not a Finding


vuln_id: V-218745
rule_id: SV-218745r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: 2F23BA53ABD5080AF448F9773A244BEC788276EC
  ~~~~~
  Denied file extensions:
  -----------------------------------
  FileExtension:	.asax
  Allowed:		False

  FileExtension:	.ascx
  Allowed:		False

  FileExtension:	.master
  Allowed:		False

  FileExtension:	.skin
  Allowed:		False

  FileExtension:	.browser
  Allowed:		False

  FileExtension:	.sitemap
  Allowed:		False

  FileExtension:	.config
  Allowed:		False

  FileExtension:	.cs
  Allowed:		False

  FileExtension:	.csproj
  Allowed:		False

  FileExtension:	.vb
  Allowed:		False

  FileExtension:	.vbproj
  Allowed:		False

  FileExtension:	.webinfo
  Allowed:		False

  FileExtension:	.licx
  Allowed:		False

  FileExtension:	.resx
  Allowed:		False

  FileExtension:	.resources
  Allowed:		False

  FileExtension:	.mdb
  Allowed:		False

  FileExtension:	.vjsproj
  Allowed:		False

  FileExtension:	.java
  Allowed:		False

  FileExtension:	.jsl
  Allowed:		False

  FileExtension:	.ldb
  Allowed:		False

  FileExtension:	.dsdgm
  Allowed:		False

  FileExtension:	.ssdgm
  Allowed:		False

  FileExtension:	.lsad
  Allowed:		False

  FileExtension:	.ssmap
  Allowed:		False

  FileExtension:	.cd
  Allowed:		False

  FileExtension:	.dsprototype
  Allowed:		False

  FileExtension:	.lsaprototype
  Allowed:		False

  FileExtension:	.sdm
  Allowed:		False

  FileExtension:	.sdmDocument
  Allowed:		False

  FileExtension:	.mdf
  Allowed:		False

  FileExtension:	.ldf
  Allowed:		False

  FileExtension:	.ad
  Allowed:		False

  FileExtension:	.dd
  Allowed:		False

  FileExtension:	.ldd
  Allowed:		False

  FileExtension:	.sd
  Allowed:		False

  FileExtension:	.adprototype
  Allowed:		False

  FileExtension:	.lddprototype
  Allowed:		False

  FileExtension:	.exclude
  Allowed:		False

  FileExtension:	.refresh
  Allowed:		False

  FileExtension:	.compiled
  Allowed:		False

  FileExtension:	.msgx
  Allowed:		False

  FileExtension:	.vsdisco
  Allowed:		False

  FileExtension:	.rules
  Allowed:		False

  Allowed file extensions:
  -----------------------------------
  None

comments:
  Configured IIS 10.0 websites to disable serving specific file types by setting appropriate resource mappings. This is Not a Finding


vuln_id: V-218748
rule_id: SV-218748r1043177_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 8E8482E042BD27CE6D91B327DB52B5325B740854
  ~~~~~

  The site is NOT bound to a specific host header on port 80

comments:
  The site is bound to schr-dp-001.schroeder.navy.mil on port 443
  The site is bound to yourwebsite.com on port 443

  This is Not a Finding


vuln_id: V-218749
rule_id: SV-218749r1111805_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: C9147AB75E3FE047BDF3394C860E38FD3A03A4FC
  ~~~~~
  Client Certificates is NOT set to 'Require'

  Confirm if this this is a public server.  If so, mark this finding as Not Applicable.

comments:
  Set client certificate to  to transmit session identifier to assure integrity. This is Not a Finding

  Client Certificates is set to 'Require'


vuln_id: V-218750
rule_id: SV-218750r1138073_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 11B73503DAE06F01B5185CC126C80F8941A56D00
  ~~~~~
  Anonymous Authentication is Enabled and using the account 'IUSR' for authentication.

  IUSR is not a member of any privileged groups.


vuln_id: V-218751
rule_id: SV-218751r1043181_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 4DAFD73A73E142C404EAA5FA34EAB3F3718A717C
  ~~~~~
  Mode is set to 'InProc'


vuln_id: V-218752
rule_id: SV-218752r1111807_rule
status: NotAFinding
comments:
  Manual check shows setting as follows:

  The OS is installed on C:
  The web site is installed on I:

hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 82833DC68D5FCB33EF4976B85E80237A71D613C3
  ~~~~~
  Both the OS and the web site are installed on C:


vuln_id: V-218753
rule_id: SV-218753r961152_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: F2EA50F0C244BFF62634234D1860279E15690490
  ~~~~~
  MaxURL is set to '4096'


vuln_id: V-218754
rule_id: SV-218754r1156525_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 61B975D8C5C29BE38FE820498269486B83933521
  ~~~~~
  MaxAllowedContentLength is set to '30000000'


vuln_id: V-218755
rule_id: SV-218755r961152_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 0B0E1D157A012760B8EF8577018C2CE9536125C3
  ~~~~~
  MaxQueryString is set to '2048'


vuln_id: V-218756
rule_id: SV-218756r961152_rule
status: NotAFinding
comments:
  Manual check shows setting as follows:

  AllowHighBitCharacters is Disabled

hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 545E96FB53E421DBB94A039FB5D6FBC26514D6A0
  ~~~~~
  AllowHighBitCharacters is Enabled


vuln_id: V-218757
rule_id: SV-218757r961152_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: ABDEB31F62077F38682F3B6A94057B49A3CFDE3A
  ~~~~~
  AllowDoubleEscaping is Disabled


vuln_id: V-218758
rule_id: SV-218758r1156527_rule
status: NotAFinding
comments:
  Manual check shows setting as follows:

  AllowUnlisted is Disabled

hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: B5726175B8459E9B878193D0B97D55FA98562ED9
  ~~~~~
  AllowUnlisted is Enabled


vuln_id: V-218759
rule_id: SV-218759r961158_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 0F0103BE5E8235FF5226B744537FC12082EF2285
  ~~~~~
  Directory Browsing is Disabled


vuln_id: V-218760
rule_id: SV-218760r1022690_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 8DD7CFE973D10647A1435F5B797FDBD4463D27D1
  ~~~~~
  Error Responses is configured to 'Detailed errors for local requests and custom error pages for remote requests'

  errorMode:	DetailedLocalOnly


vuln_id: V-218761
rule_id: SV-218761r961167_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: DA86857153490799139F10F11554C3FC6F2FE873
  ~~~~~
  Debug is set to 'False'


vuln_id: V-218762
rule_id: SV-218762r1043182_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 014F652F7321865AAC624F62B49DF31D1BF1CA97
  ~~~~~
  Idle Time-out is configured to '20' total minutes


vuln_id: V-218763
rule_id: SV-218763r1043182_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: CC80929894FE26706CBF815CB07276E9E7A98AC3
  ~~~~~
  Time-out is configured to '00:15:00'


vuln_id: V-218764
rule_id: SV-218764r961281_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 32AFF8CF36570A0DC084CA270EE023B4DED1D486
  ~~~~~
  There is nothing preventing an administrator from shutting down either the webservice or an individual IIS site in the event of an attack. Documentation exists describing how.


vuln_id: V-218765
rule_id: SV-218765r961392_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 6ADE9501D86E927416808AF0B186536D51A249DE
  ~~~~~
  Logs are set to roll over Daily.


vuln_id: V-218766
rule_id: SV-218766r1111809_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: D43BD30938BEE28D70E09D5B397315762DD4C2D3
  ~~~~~
  All ports are PPSM approved.

  Below are the current HTTP and HTTPS bindings:

  http (*:80:)


vuln_id: V-218767
rule_id: SV-218767r1111811_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: 7B47C3FC645686A5BBF0E23296FB14E0C58713A2
  ~~~~~
  There are no HTTPS bindings on this site.

comments:
  Ensured the IIS 10.0 website accepts only client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).


vuln_id: V-218768
rule_id: SV-218768r1156529_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: 6275DCDEF057117A4E22688BC519EA5B675A222E
  ~~~~~
  The following SSL flags are missing:

  Ssl
  SslRequireCert
  Ssl128

comments:
  The IIS 10.0 private website employs cryptographic mechanisms (TLS) and require client certificates. This is Not a Finding


  Ssl, SslRequireCert, and Ssl128 are all set.


vuln_id: V-218769
rule_id: SV-218769r961632_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 88428619BE4167554B71D4EBAEE30C7BD51B4A99
  ~~~~~
  KeepSessionIdSecure is set to 'True'


vuln_id: V-218770
rule_id: SV-218770r1111816_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 03/05/2026
  Site: Default Web Site
  ResultHash: FE11E6C510BB860B5F598EF635D52AFCEA9CEE15
  ~~~~~
  RequireSSL is set to 'False'

  CompressionEnabled is set to 'False'

comments:
  Manual check shows setting as follows:

  RequireSSL is set to 'True'

  CompressionEnabled is set to 'False'


vuln_id: V-218771
rule_id: SV-218771r961863_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 5335ED9BAD61DF8DC37184AF69529D1843D12936
  ~~~~~
  ApplicationPool:	DefaultAppPool
  WebSiteUsage:	Default Web Site


vuln_id: V-218772
rule_id: SV-218772r1022694_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  Site: Default Web Site
  ResultHash: A56676E8EA3BFCF08B73F6A5B5A76450CBBE9579
  ~~~~~
  Application Pool:	.NET v4.5
  Request Limit:		0

  Application Pool:	.NET v4.5 Classic
  Request Limit:		0

  Application Pool:	DefaultAppPool
  Request Limit:		0

comments:
  The maximum number of requests an application pool can process for each IIS 10.0 website is explicitly set.

  Application Pool:	DefaultAppPool
  Request Limit:		10


vuln_id: V-218775
rule_id: SV-218775r1022696_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 630A16ADFDB7CF1BE1A54B6AD5648CC5D3357FBA
  ~~~~~
  Compliant AppPools:
  -----------------------------------
  AppPool:	.NET v4.5
  Condition:	time [Enabled=True; LogEnabled=True]

  AppPool:	.NET v4.5 Classic
  Condition:	time [Enabled=True; LogEnabled=True]

  AppPool:	DefaultAppPool
  Condition:	time [Enabled=True; LogEnabled=True]


vuln_id: V-218777
rule_id: SV-218777r961863_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: D20E64BF1B05FA68EEE046BE06AB34AE4CE8C3AF
  ~~~~~
  Application Pool:		.NET v4.5
  Rapid Fail Protection:	True

  Application Pool:		.NET v4.5 Classic
  Rapid Fail Protection:	True

  Application Pool:		DefaultAppPool
  Rapid Fail Protection:	True


vuln_id: V-218778
rule_id: SV-218778r961863_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: B30004B860C1C6BA9D64F62621C3F9D9CB69C162
  ~~~~~
  Application Pool:	.NET v4.5
  Failure Interval:	5

  Application Pool:	.NET v4.5 Classic
  Failure Interval:	5

  Application Pool:	DefaultAppPool
  Failure Interval:	5


vuln_id: V-218779
rule_id: SV-218779r1022698_rule
status: Not_Applicable
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT APPLICABLE on 03/05/2026
  Site: Default Web Site
  ResultHash: 6A077B4054A7B71BCF2A558FC6BFD199ED9070AA
  ~~~~~
  CGI is not installed so this requirement is NA.


vuln_id: V-218782
rule_id: SV-218782r1111818_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
comments:
  Displayed the required DoD consent banner to authenticated users accessing private IIS 10.0 websites. This is Not a Finding


vuln_id: V-278953
rule_id: SV-278953r1135550_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026
  Site: Default Web Site
  ResultHash: 104E498E88DEE469BE248058E3FD241D25AF3ECD
  ~~~~~
  Registry Path:	HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  Value Name:	DisableServerHeader
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235719
rule_id: SV-235719r1156558_rule
status: NotAFinding
comments:
  Proxy setting are correctly set as follows:

  {"ProxyMode": "direct"}

  This is Not a Finding

hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be OPEN on 03/05/2026
  ResultHash: EC0EC4B4146EC68BE0B5FF96A0FCCA30E8EF2031
  ~~~~~
  Improper configuration detected. Refer to https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#proxysettings

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ProxySettings
  Value:		ADD YOUR PROXY CONFIGURATIONS HERE
  Type:		REG_SZ

  Proper configuration of this setting requires that it be enclosed in { } brackets.


vuln_id: V-235720
rule_id: SV-235720r960852_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: C33E388254DDCB5B7A5AA275DCEC3789FA6C6D8C
  ~~~~~
  'Prevent bypassing Microsoft Defender SmartScreen prompts for sites' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PreventSmartScreenPromptOverride
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235721
rule_id: SV-235721r960852_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 00754A8B44AD87CBB6D5FBC53E664288E16117B4
  ~~~~~
  'Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PreventSmartScreenPromptOverrideForFiles
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235722
rule_id: SV-235722r960852_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 252F745C52C3FE26367A884C0FFF075A7D5765B7
  ~~~~~
  'Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings' is Not Configured in Group Policy which is acceptable per the STIG.


vuln_id: V-235723
rule_id: SV-235723r960864_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 6A26062584CE53C883FDC08AC7C990D375CD472F
  ~~~~~
  'Configure InPrivate mode availability' is Enabled with 'InPrivate mode disabled'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	InPrivateModeAvailability
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235724
rule_id: SV-235724r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: A95AA40B6F30C779A0CE892F14BD0215ED60B0AA
  ~~~~~
  'Continue running background apps after Microsoft Edge closes' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	BackgroundModeEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235725
rule_id: SV-235725r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: A3DBEC9663EEDC90775D105ED8029C5BC806A409
  ~~~~~
  'Default pop-up window setting' is Enabled with 'Do not allow any site to show pop-ups'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DefaultPopupsSetting
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235726
rule_id: SV-235726r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 859E1524C5E43114ADA3981FB6DFA4354BB11E7A
  ~~~~~

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ManagedSearchEngines
  Value:		[{"allow_search_engine_discovery": false},{"is_default": true,"name": "Microsoft Bing","keyword": "bing","search_url": "https://www.bing.com/search?q={searchTerms}"},{"name": "Google","keyword": "google","search_url": "https://www.google.com/search?q={searchTerms}"}]
  Type:		REG_SZ

  Search URLs
  =======================
  https://www.bing.com/search?q={searchTerms}
  https://www.google.com/search?q={searchTerms}


vuln_id: V-235727
rule_id: SV-235727r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 8FC1BA97C73E26DF2F4FFBFA42EEF58E3174020A
  ~~~~~
  'Disable synchronization of data using Microsoft sync services' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	SyncDisabled
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235728
rule_id: SV-235728r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: C3B61B9619246C488256EF969782678101E04209
  ~~~~~
  'Enable network prediction' is Enabled with 'Don't predict network actions on any network connection'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	NetworkPredictionOptions
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235729
rule_id: SV-235729r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: E3CAF58DF9DE07E23A04EE57FFC5F9C8460C6537
  ~~~~~
  'Enable search suggestions' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	SearchSuggestEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235730
rule_id: SV-235730r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: F08C62B7F2ABE15A36FB514AA57C9D82DC746279
  ~~~~~
  'Allow importing of autofill form data' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportAutofillFormData
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235731
rule_id: SV-235731r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 9C262364743C3FB68606CA959D2E3A2DCA16CB69
  ~~~~~
  'Allow importing of browser settings' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportBrowserSettings
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235732
rule_id: SV-235732r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 16BF98FC3F0EBB1565C797CB6FFC1D57C15A20D6
  ~~~~~
  'Allow importing of cookies' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportCookies
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235733
rule_id: SV-235733r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 63C9813DC2198C4155927B003A768D2286A93864
  ~~~~~
  'Allow importing of extensions' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportExtensions
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235734
rule_id: SV-235734r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 5A369FE00E668F3D5C55ABC808997BA81CD6BF1E
  ~~~~~
  'Allow importing of browsing history' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportHistory
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235735
rule_id: SV-235735r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 8A5E12CFE2D497A7160E25D907CE340169B6750C
  ~~~~~
  'Allow importing of home page settings' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportHomepage
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235736
rule_id: SV-235736r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 94DC9B1B6FE2DD930D8E55CE31A926ACC092E032
  ~~~~~
  'Allow importing of open tabs' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportOpenTabs
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235737
rule_id: SV-235737r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 4C351B4F0B7E4589FBCAC8225414BBCC72F8003B
  ~~~~~
  'Allow importing of payment info' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportPaymentInfo
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235738
rule_id: SV-235738r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 1C95A1EA9C9DCB1DC440C4F491925769F6EA7AD2
  ~~~~~
  'Allow importing of saved passwords' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportSavedPasswords
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235739
rule_id: SV-235739r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: BF82D8CD5BAE85B427F586A1EBFE413B23378C4F
  ~~~~~
  'Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of search engine settings' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportSearchEngine
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235740
rule_id: SV-235740r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 7F3AD249882C08B8647088E3B2BAE57EC9CB22F2
  ~~~~~
  'Computer Configuration/Administrative Templates/Microsoft Edge/Allow importing of shortcuts' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ImportShortcuts
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235741
rule_id: SV-235741r1007485_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 7B48931F199FBAC2686E7530ADC669B50010403D
  ~~~~~
  'Allow media autoplay for websites' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AutoplayAllowed
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235742
rule_id: SV-235742r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 38497FE6B80E6BB81740D721841068941DA03567
  ~~~~~
  'Control use of the WebUSB API' is Enabled with 'Do not allow any site to request access to USB devices via the WebUSB API'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DefaultWebUsbGuardSetting
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235743
rule_id: SV-235743r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 1528C14AEEB65CCC54DF466080527EB385DF1760
  ~~~~~
  'Enable Google Cast' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	EnableMediaRouter
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235744
rule_id: SV-235744r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 77C9F2CFAD6FB07DF15769E13BF655A14D6EC237
  ~~~~~
  'Control use of the Web Bluetooth API' is Enabled with 'Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DefaultWebBluetoothGuardSetting
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235745
rule_id: SV-235745r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: D09B8C1D767D0AF121E2C7FBFDF4C858A96F2B8A
  ~~~~~
  'Enable AutoFill for credit cards' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AutofillCreditCardEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235746
rule_id: SV-235746r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: B2677DF844BBD760C645DA2D8809408E9415C159
  ~~~~~
  'Enable AutoFill for addresses' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AutofillAddressEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235747
rule_id: SV-235747r961038_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 759AF9B5A64AFD60ADA201529452464B1D8B669F
  ~~~~~
  'Enable online OCSP/CRL checks' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	EnableOnlineRevocationChecks
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235748
rule_id: SV-235748r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: B9CCB256B27A09591F64025AEF672F537D8DC814
  ~~~~~
  'Allow personalization of ads, search and news by sending browsing history to Microsoft' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PersonalizationReportingEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235749
rule_id: SV-235749r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: DBF4B8660CC702E433B75A2A859CD9E4E1FC7B5F
  ~~~~~
  'Computer Configuration/Administrative Templates/Microsoft Edge/Content settings/Default geolocation setting' is Enabled with 'Don't allow any site to track users' physical location'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DefaultGeolocationSetting
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235750
rule_id: SV-235750r960864_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: BB37C332F0F43CE9B237493C3740BF5AFCDB70DB
  ~~~~~
  'Computer Configuration/Administrative Templates/Microsoft Edge/Enable deleting browser and download history' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AllowDeletingBrowserHistory
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235751
rule_id: SV-235751r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: D0C011C3620DE26B3AC5D2A94FE6AC62E823B8E6
  ~~~~~
  'Computer Configuration/Administrative Templates/Microsoft Edge/Control where developer tools can be used' is Enabled with 'Don't allow using the developer tools'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DeveloperToolsAvailability
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235752
rule_id: SV-235752r1156563_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: BE3D82589FDCADE0CBAA20C00C665847239339B7
  ~~~~~
  'Allow download restrictions' is Enabled with (1)'BlockDangerousDownloads' or (2)'Block potentially dangerous or unwanted downloads' or (3)'Block all downloads' or (4) 'Block malicious downloads'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DownloadRestrictions
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235753
rule_id: SV-235753r1015297_rule
status: NotAFinding
comments: URLs are allowlisted for plugin use. This is Not a Finding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: F277020857C97BCB2CDBE776BF649532A4E75FC3
  ~~~~~
  'Allow pop-up windows on specific sites' is Configured

  Allowed popups:
  ===========================
  	[*.]mil
  	[*.]gov


vuln_id: V-235754
rule_id: SV-235754r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 4097A18D2792A95FE262E20A225523C05426B446
  ~~~~~
  'Control which extensions cannot be installed' is Enabled (With '*' added to the list)

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist
  Value Name:	1
  Value:		*
  Type:		REG_SZ


vuln_id: V-235755
rule_id: SV-235755r961479_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 74D93E07BB01C85E69D696BD1039ECC68270753C
  ~~~~~
  'Allow specific extensions to be installed' is Not Configured in Group Policy which is acceptable per the STIG.

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallAllowlist
  Value Name:	 (Not found)


vuln_id: V-235756
rule_id: SV-235756r961521_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 7BCE53DE564BDFF816DA0D34AF460FA8B5561B18
  ~~~~~
  'Enable saving passwords to the password manager' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PasswordManagerEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235758
rule_id: SV-235758r1117151_rule
status: NotAFinding
comments:
  The version of Microsoft Edge running on the system is a supported version.
  This is Not a Finding

hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) was unable to determine a Status but found the below configuration on 03/05/2026:
  ResultHash: C8FEAB4CAE85FA4E90B6C6E61F778F398997D8EF
  ~~~~~
  Microsoft Edge Version: 145.0.3800.70


vuln_id: V-235760
rule_id: SV-235760r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: CDC59BF3B7F9E172DADA2D5A1B99AD5112919D25
  ~~~~~
  'Enable site isolation for every site' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	SitePerProcess
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235761
rule_id: SV-235761r1043177_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: D729C535227E8041CCECF0203A782A4147B1857A
  ~~~~~
  'Supported authentication schemes' is Enabled with 'ntlm,negotiate'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AuthSchemes
  Value:		ntlm,negotiate
  Type:		REG_SZ


vuln_id: V-235763
rule_id: SV-235763r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 0FE1775D93652DFC1E9031585F819F9158C92E5A
  ~~~~~
  'Configure Microsoft Defender SmartScreen' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	SmartScreenEnabled
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235764
rule_id: SV-235764r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: AF7BFAF51876CD911EA583D31A1AB2F474242704
  ~~~~~
  'Configure Microsoft Defender SmartScreen to block potentially unwanted apps' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	SmartScreenPuaEnabled
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235765
rule_id: SV-235765r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 83E6551EBCA0DB90D3E94FCB2E45DB4FB4E84AAB
  ~~~~~
  'Ask where to save downloaded files' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PromptForDownloadLocation
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235766
rule_id: SV-235766r1051115_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: BFB209185613574AFDC8D1FDCE5645138B8F0AF6
  ~~~~~
  'Block tracking of users' web-browsing activity' is Enabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	TrackingPrevention
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235767
rule_id: SV-235767r960972_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: F85BD56BBF7FAFBC610EBA052F199608B6E3DE06
  ~~~~~
  'Allow websites to query for available payment methods' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	PaymentMethodQueryEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235768
rule_id: SV-235768r1015298_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 5FE8B17D491D95624AA3D36520DEE4CABCA519E7
  ~~~~~
  'Suggest similar pages when a webpage can't be found' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	AlternateErrorPagesEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235769
rule_id: SV-235769r960981_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: A9C3CB492BC4DCF667581F324F2BF3C87024DD4D
  ~~~~~
  'Allow user feedback' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	UserFeedbackAllowed
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235770
rule_id: SV-235770r960984_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 2D6CF3DC871908B27103BD2A0AADA788DC08FE5D
  ~~~~~
  'Enable the Collections feature' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	EdgeCollectionsEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235771
rule_id: SV-235771r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: AF9F31C9048C1464BABE364BC395F8BF0F0D2874
  ~~~~~
  'Configure the Share experience' is Enabled with 'Don't allow using the Share experience'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ConfigureShare
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-235772
rule_id: SV-235772r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: C41C1EBCD929E62126289710DB0512B0C3589702
  ~~~~~
  'Enable guest mode' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	BrowserGuestModeEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-235773
rule_id: SV-235773r960993_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: B57A03559EAFB980D5E9D52175B1F7A68F888C51
  ~~~~~
  'Notify a user that a browser restart is recommended or required for pending updates' is Enabled with 'Required'

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	RelaunchNotification
  Value:		0x00000002 (2)
  Type:		REG_DWORD


vuln_id: V-235774
rule_id: SV-235774r1015299_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: B76F0C6311068EC7685D073365C478451F16B7A8
  ~~~~~
  'Use built-in DNS client' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	BuiltInDnsClientEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-246736
rule_id: SV-246736r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 9F96AAF9C4DC4B5A831AA5160BD50D280B3F5EC2
  ~~~~~
  'Allow QUIC protocol' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	QuicAllowed
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-251694
rule_id: SV-251694r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 53EFE8294F1A016100A439E68BDC4A955D8F191C
  ~~~~~
  'Allow media autoplay on specific sites' is Configured

  Allowed sites:
  ===========================


vuln_id: V-260465
rule_id: SV-260465r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 78DBF7703C4344E1C9FEC6958B7770D32210875B
  ~~~~~
  'Visual search enabled' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	VisualSearchEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-260466
rule_id: SV-260466r960963_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: E2685576C3025DD255C16A3C12819DC1828509E9
  ~~~~~
  'Show Hubs Sidebar' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	HubsSidebarEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


vuln_id: V-260467
rule_id: SV-260467r960864_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: CC86029292DF41B85ACCCA8CD609A962C4964A04
  ~~~~~
  'Configure cookies' is Enabled: (Keep cookies for the duration of the session, except ones listed in 'SaveCookiesOnExit')

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	DefaultCookiesSetting
  Value:		0x00000004 (4)
  Type:		REG_DWORD


vuln_id: V-266981
rule_id: SV-266981r1169858_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: D584CFBF4BC3ECBB5AAA9121E3B5A91B09C02156
  ~~~~~
  'Configure the default paste format of URLs copied from Microsoft Edge, and determine if additional formats will be available to users' is Enabled: (The plain URL without any extra information, such as the page's title.)

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ConfigureFriendlyURLFormat
  Value:		0x00000001 (1)
  Type:		REG_DWORD


vuln_id: V-279940
rule_id: SV-279940r1156561_rule
status: NotAFinding
hostname: SCHR-P3-DP-001
host_ip: 164.231.170.44
workflow_status: Open
created_at: 2026-03-12 19:38:14
updated_at: 2026-03-12 19:38:14
finding_details:
  Evaluate-STIG 1.2601.0 (Scan-MicrosoftEdge_Checks) found this to be NOT A FINDING on 03/05/2026
  ResultHash: 502C8B71437749D29CB3E33985BDF72B0D30248E
  ~~~~~
  'Control access to Microsoft 365 Copilot writing assistance in Microsoft Edge for Business' is Disabled

  Registry Path:	HKLM:\SOFTWARE\Policies\Microsoft\Edge
  Value Name:	ComposeInlineEnabled
  Value:		0x00000000 (0)
  Type:		REG_DWORD


# audit_log

entity_type: system
action: startup_config
changed_by: system
changed_at: 2026-02-26T18:56:37.719184+00:00
new_value:
  session_timeout=30m, rate_limit=60/min, registration_enabled=true, session_secure=default, csrf_secret_set=False


# users

username: admin
email: admin@csids.local
role: admin
created_at: 2026-02-09T13:00:22.036949
last_login: 2026-02-19T16:27:21.393479
password_changed_at: 2026-02-09T13:00:22.036949
password_hash:
  pbkdf2:7f69f12b9f9e83d3bafe3db5e6bb8bed:1a3722ee8b18a5ff13ed8ce72088eb0a34b596efc3c83c83a404178ee6d69139


# nessus_findings

plugin_name: Unencrypted Telnet Server
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.7
host_ip: 164.231.187.7
protocol: tcp
svc_name: telnet
synopsis: The remote Telnet server transmits traffic in cleartext.
solution: Disable the Telnet service and use SSH instead.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host is running a Telnet server over an unencrypted channel.

  Using Telnet over an unencrypted channel is not recommended as logins, passwords, and commands are transferred in cleartext. This allows a remote, man-in-the-middle attacker to eavesdrop on a Telnet session to obtain credentials or other sensitive information and to modify traffic exchanged between a client and server.

  SSH is preferred over Telnet since it protects credentials from eavesdropping and can tunnel additional data streams such as an X11 session.

plugin_output:
  Nessus collected the following banner from the remote Telnet server :

  ------------------------------ snip ------------------------------

  Sorry, the maximum number of telnet sessions are active.  Try again later.

  ------------------------------ snip ------------------------------


plugin_name: SSH Server CBC Mode Ciphers Enabled
plugin_family: Misc.
risk_factor: Low
hostname: 164.231.187.7
host_ip: 164.231.187.7
protocol: tcp
svc_name: ssh
synopsis: The SSH server is configured to use Cipher Block Chaining.
cves: CVE-2008-5161
xrefs: CERT:958563, CWE:200
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The SSH server is configured to support Cipher Block Chaining (CBC) encryption.  This may allow an attacker to recover the plaintext message from the ciphertext. 

  Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.

solution:
  Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.

plugin_output:
  The following client-to-server Cipher Block Chaining (CBC) algorithms
  are supported : 

    aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,3des-cbc

  The following server-to-client Cipher Block Chaining (CBC) algorithms
  are supported : 

    aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,3des-cbc


plugin_name: SSH Weak MAC Algorithms Enabled
plugin_family: Misc.
risk_factor: Low
hostname: 164.231.187.7
host_ip: 164.231.187.7
protocol: tcp
svc_name: ssh
synopsis: The remote SSH server is configured to allow MD5 and 96-bit MAC algorithms.
solution: Contact the vendor or consult product documentation to disable MD5 and 96-bit MAC algorithms.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak.

  Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions.

plugin_output:
  The following client-to-server Message Authentication Code (MAC) algorithms
  are supported : 

    hmac-sha1-96,hmac-md5,hmac-sha1,hmac-md5-96

  The following server-to-client Message Authentication Code (MAC) algorithms
  are supported : 

    hmac-sha1-96,hmac-md5,hmac-sha1,hmac-md5-96


plugin_name: SSH Weak Key Exchange Algorithms Enabled
plugin_family: Misc.
risk_factor: Low
hostname: 164.231.187.7
host_ip: 164.231.187.7
protocol: tcp
svc_name: ssh
synopsis: The remote SSH server is configured to allow weak key exchange algorithms.
solution: Contact the vendor or consult product documentation to disable the weak algorithms.
see_also: https://datatracker.ietf.org/doc/html/rfc9142
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote SSH server is configured to allow key exchange algorithms which are considered weak.

  This is based on the IETF draft document Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH) RFC9142. Section 4 lists guidance on key exchange algorithms that SHOULD NOT and MUST NOT be enabled. This includes:

    diffie-hellman-group-exchange-sha1

    diffie-hellman-group1-sha1

    gss-gex-sha1-*

    gss-group1-sha1-*

    gss-group14-sha1-*

    rsa1024-sha1

  Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions.

plugin_output:
  The following weak key exchange algorithms are enabled : 

    diffie-hellman-group14-sha1,diffie-hellman-group1-sha1


plugin_name: ICMP Timestamp Request Remote Date Disclosure
plugin_family: General
risk_factor: Low
hostname: 164.231.187.2
host_ip: 164.231.187.2
protocol: icmp
svc_name: general
synopsis: It is possible to determine the exact time set on the remote host.
solution: Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
plugin_output: The difference between the local and remote clocks is -1742 seconds.
cves: CVE-1999-0524
xrefs: CWE:200
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host answers to an ICMP timestamp request.  This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.

  Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.


plugin_name: Unencrypted Telnet Server
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.2
host_ip: 164.231.187.2
protocol: tcp
svc_name: telnet
synopsis: The remote Telnet server transmits traffic in cleartext.
solution: Disable the Telnet service and use SSH instead.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host is running a Telnet server over an unencrypted channel.

  Using Telnet over an unencrypted channel is not recommended as logins, passwords, and commands are transferred in cleartext. This allows a remote, man-in-the-middle attacker to eavesdrop on a Telnet session to obtain credentials or other sensitive information and to modify traffic exchanged between a client and server.

  SSH is preferred over Telnet since it protects credentials from eavesdropping and can tunnel additional data streams such as an X11 session.

plugin_output:
  Nessus collected the following banner from the remote Telnet server :

  ------------------------------ snip ------------------------------
  C
  ##### Military Sealift Command (MSC) #####
  ##### MSC Corporate Data Center (MCDC) #####
  -------------------------------------------------------------------------
  DOD WARNING BANNER
  -------------------------------------------------------------------------
  You are accessing a U.S. Government (USG) Information System (IS) that
  is provided for USG-authorized use only. By using this IS (which includes
  any device attached to this IS), you consent to the following conditions:
  -The USG routinely intercepts and monitors communications on this IS
  for purposes including, but not limited to, penetration testing, COMSEC
  monitoring, network operations and defense, personnel misconduct (PM),
  law enforcement (LE), and counterintelligence (CI) investigations.
  -At any time, the USG may inspect and seize data stored on this IS.
  -Communications using, or data stored on, this IS are not private, are
  subject to routine monitoring, interception, and search, and may be
  disclosed or used for any USG authorized purpose.
  -This IS includes security measures (e.g., authentication and access
  controls) to protect USG interests--not for your personal benefit or
  privacy.
  -Notwithstanding the above, using this IS does not constitute consent to
  PM, LE or CI investigative searching or monitoring of the content of
  privileged communications, or work product, related to personal
  representation or services by attorneys, psychotherapists, or clergy,
  and their assistants. Such communications and work product are private
  and confidential. See User Agreement for details.
  -------------------------------------------------------------------------
  DOD WARNING BANNER
  -------------------------------------------------------------------------


  User Access Verification

  Username: 
  ------------------------------ snip ------------------------------


plugin_name: Network Time Protocol (NTP) Mode 6 Scanner
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.2
host_ip: 164.231.187.2
protocol: udp
svc_name: ntp
synopsis: The remote NTP server responds to mode 6 queries.
solution: Restrict NTP mode 6 queries.
see_also:
  https://www.nessus.org/u?18e62de1
  https://www.virtuesecurity.com/kb/ntp-mode-6-vulnerabilities/

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote NTP server responds to mode 6 queries. Devices that respond to these queries have the potential to be used in NTP amplification attacks. An unauthenticated, remote attacker could potentially exploit this, via a specially crafted mode 6 query, to cause a reflected denial of service condition.

plugin_output:
  Nessus elicited the following response from the remote
    host by sending an NTP mode 6 query :

  'version="4", processor="unknown", system="UNIX", leap=0, stratum=4,
  precision=-19, rootdelay=, rootdisp=, refid=164.231.69.13,
  reftime=0xED54EC2F.CF835BE5, clock=0xED54F039.E9BE6DA1, peer=50512,
  tc=10, mintc=3, offset=, frequency=, sys_jitter=, clk_jitter=,
  clk_wander='


plugin_name: SSH Weak Key Exchange Algorithms Enabled
plugin_family: Misc.
risk_factor: Low
hostname: 164.231.187.2
host_ip: 164.231.187.2
protocol: tcp
svc_name: ssh
synopsis: The remote SSH server is configured to allow weak key exchange algorithms.
solution: Contact the vendor or consult product documentation to disable the weak algorithms.
see_also: https://datatracker.ietf.org/doc/html/rfc9142
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 602 characters]

plugin_output:
  The following weak key exchange algorithms are enabled : 

    diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1


plugin_name: Network Time Protocol (NTP) Mode 6 Scanner
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.1
host_ip: 164.231.187.1
protocol: udp
svc_name: ntp
synopsis: The remote NTP server responds to mode 6 queries.
solution: Restrict NTP mode 6 queries.
see_also:
  https://www.nessus.org/u?18e62de1
  https://www.virtuesecurity.com/kb/ntp-mode-6-vulnerabilities/

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote NTP server responds to mode 6 queries. Devices that respond to these queries have the potential to be used in NTP amplification attacks. An unauthenticated, remote attacker could potentially exploit this, via a specially crafted mode 6 query, to cause a reflected denial of service condition.

plugin_output:
  Nessus elicited the following response from the remote
    host by sending an NTP mode 6 query :

  'version="4", processor="unknown", system="UNIX", leap=0, stratum=4,
  precision=-10, rootdelay=820.000, rootdisp=47.724, refid=164.231.69.13,
  reftime=0xED54E95E.66E979F0, clock=0xED54EE44.F70A4018, peer=48652,
  tc=10, mintc=3, offset=-0.499, frequency=-57.167, sys_jitter=5.775,
  clk_jitter=10.349, clk_wander=0.002'


plugin_name: ICMP Timestamp Request Remote Date Disclosure
plugin_family: General
risk_factor: Low
hostname: MONT-AP-002
host_ip: 164.231.187.39
protocol: icmp
svc_name: general
synopsis: It is possible to determine the exact time set on the remote host.
solution: Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
cves: CVE-1999-0524
xrefs: CWE:200
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host answers to an ICMP timestamp request.  This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.

  Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.

plugin_output:
  This host returns non-standard timestamps (high bit is set)
  The ICMP timestamps might be in little endian format (not in network format)
  The remote clock is synchronized with the local clock.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-AP-002
host_ip: 164.231.187.39
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :

    - First, the top of the certificate chain sent by the     server might not be descended from a known public     certificate authority. This can occur either when the     top of the chain is an unrecognized, self-signed     certificate, or when intermediate certificates are     missing that would connect the top of the certificate     chain to a known public certificate authority.

    - Second, the certificate chain may contain a certificate     that is not valid at the time of the scan. This can     occur either when the scan occurs before one of the     certificate's 'notBefore' dates, or after one of the     certificate's 'notAfter' dates.

    - Third, the certificate chain may contain a signature     that either didn't match the certificate's information     or could not be verified. Bad signatures can be fixed by     getting the certificate with the bad signature to be     re-signed by its issuer. Signatures that could not be     verified are the result of the certificate's issuer     using a signing algorithm that Nessus either does not     support or does not recognize.

  If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 3
  |-Issuer  : C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 3


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-AP-002
host_ip: 164.231.187.39
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :

    - First, the top of the certificate chain sent by the     server might not be descended from a known public     certificate authority. This can occur either when the     top of the chain is an unrecognized, self-signed     certificate, or when intermediate certificates are     missing that would connect the top of the certificate     chain to a known public certificate authority.

    - Second, the certificate chain may contain a certificate     that is not valid at the time of the scan. This can     occur either when the scan occurs before one of the     certificate's 'notBefore' dates, or after one of the     certificate's 'notAfter' dates.

    - Third, the certificate chain may contain a signature     that either didn't match the certificate's information     or could not be verified. Bad signatures can be fixed by     getting the certificate with the bad signature to be     re-signed by its issuer. Signatures that could not be     verified are the result of the certificate's issuer     using a signing algorithm that Nessus either does not     support or does not recognize.

  If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-AP-002.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-AP-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-AP-002
host_ip: 164.231.187.39
protocol: tcp
svc_name: www
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The X.509 certificate chain for this service is not signed by a recognized certificate authority.  If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. 

  Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 3


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-AP-002
host_ip: 164.231.187.39
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The X.509 certificate chain for this service is not signed by a recognized certificate authority.  If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. 

  Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-AP-002.MONTFORD-POINT.navy.mil


plugin_name: ICMP Timestamp Request Remote Date Disclosure
plugin_family: General
risk_factor: Low
hostname: MONT-DB-002.MONTFORD-POINT.navy.mil
host_ip: 164.231.187.38
protocol: icmp
svc_name: general
synopsis: It is possible to determine the exact time set on the remote host.
solution: Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
cves: CVE-1999-0524
xrefs: CWE:200
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 400 characters]

plugin_output:
  The ICMP timestamps seem to be in little endian format (not in network format)
  The remote clock is synchronized with the local clock.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-DB-002.MONTFORD-POINT.navy.mil
host_ip: 164.231.187.38
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :

    - First, the top of the certificate chain sent by the     server might not be descended from a known public     certificate authority. This can occur either when the     top of the chain is an unrecognized, self-signed     certificate, or when intermediate certificates are     missing that would connect the top of the certificate     chain to a known public certificate authority.

    - Second, the certificate chain may contain a certificate     that is not valid at the time of the scan. This can     occur either when the scan occurs before one of the     certificate's 'notBefore' dates, or after one of the     certificate's 'notAfter' dates.

    - Third, the certificate chain may contain a signature     that either didn't match the certificate's information     or could not be verified. Bad signatures can be fixed by     getting the certificate with the bad signature to be     re-signed by its issuer. Signatures that could not be     verified are the result of the certificate's issuer     using a signing algorithm that Nessus either does not     support or does not recognize.

  If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-DB-002.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-DB-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-DB-002.MONTFORD-POINT.navy.mil
host_ip: 164.231.187.38
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The X.509 certificate chain for this service is not signed by a recognized certificate authority.  If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. 

  Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-DB-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate with Wrong Hostname
plugin_family: General
risk_factor: Medium
hostname: MONT-BE-002
host_ip: 164.231.187.37
protocol: tcp
svc_name: mssql
synopsis: The SSL certificate for this service is for a different host.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The 'commonName' (CN) attribute of the SSL certificate presented for this service is for a different machine.

plugin_output:
  The identities known by Nessus are :

    164.231.187.37
    mont-be-002
    mont-be-002.montford-point.navy.mil
    164.231.187.37

  The Common Name in the certificate is :

    SSL_Self_Signed_Fallback


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-BE-002
host_ip: 164.231.187.37
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-BE-002.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-BE-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-BE-002
host_ip: 164.231.187.37
protocol: tcp
svc_name: mssql
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=SSL_Self_Signed_Fallback
  |-Issuer  : CN=SSL_Self_Signed_Fallback


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-BE-002
host_ip: 164.231.187.37
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-BE-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-BE-002
host_ip: 164.231.187.37
protocol: tcp
svc_name: mssql
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=SSL_Self_Signed_Fallback


plugin_name: Microsoft Exchange Server Unsupported Version Detection
plugin_family: Windows
risk_factor: Critical
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: cifs
synopsis: The Microsoft Exchange Server running on the remote host is no longer supported.
solution: Upgrade to a version of Microsoft Exchange Server that is currently supported.
xrefs: IAVA:0001-A-0554
see_also:
  http://www.nessus.org/u?a7ccf95d
  http://www.nessus.org/u?bdbd11f6

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  According to its self-reported version number, the installation of Microsoft Exchange Server on the remote host is no longer supported.

  Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

plugin_output:
  The remote host is running Microsoft Exchange Server 2016 CU23.
  Microsoft Exchange Server 2016 is no longer supported.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD SW CA-67
  |-Issuer  : C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 3


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-MB-002.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-MB-002.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-MB-002.MONTFORD-POINT.navy.mil


plugin_name: HSTS Missing From HTTPS Server (RFC 6797)
plugin_family: Web Servers
risk_factor: Medium
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: www
synopsis: The remote web server is not enforcing HSTS, as defined by RFC 6797.
solution: Configure the remote web server to use HSTS.
see_also: https://tools.ietf.org/html/rfc6797
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

plugin_output:
  HTTP/1.1 302 Moved Temporarily

  Cache-Control: no-cache
  Pragma: no-cache
  Location: https://164.231.187.36/owa/
  Server: Microsoft-IIS/10.0
  X-FEServer: MONT-MB-002
  X-RequestId: 2e24f2d9-19f9-469d-96fc-78ea03ccbe40
  Date: Fri, 06 Mar 2026 05:42:23 GMT
  Connection: close
  Content-Length: 0


  The remote HTTPS server does not send the HTTP
  "Strict-Transport-Security" header.


plugin_name: Security Updates for Microsoft Exchange Server (December 2025)
plugin_family: Windows : Microsoft Bulletins
risk_factor: High
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: cifs
synopsis: The Microsoft Exchange Server installed on the remote host is affected by multiple vulnerabilities.
cves: CVE-2025-64666, CVE-2025-64667
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the December, 2025 security bulletin.

    - Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges     over a network. (CVE-2025-64666)

    - User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an     unauthorized attacker to perform spoofing over a network. (CVE-2025-64667)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

solution:
  Microsoft has released the following security updates to address this issue:
    -KB5071873
    -KB5071874
    -KB5071875

plugin_output:
  Path              : E:\ExchangeV15\
    Installed version : 15.1.2507.61
    Fixed version     : 15.1.2507.63

xrefs:
  MSFT:MS25-5071873, MSFT:MS25-5071874, MSFT:MS25-5071875, MSKB:5071873, MSKB:5071874, MSKB:5071875, IAVA:2025-A-0913


plugin_name: Security Updates for Microsoft Exchange Server (February 2026)
plugin_family: Windows : Microsoft Bulletins
risk_factor: Medium
hostname: MONT-MB-002
host_ip: 164.231.187.36
protocol: tcp
svc_name: cifs
synopsis: The Microsoft Exchange Server installed on the remote host is affected by a vulnerability.
cves: CVE-2026-21527
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by a vulnerability as referenced in the February, 2026 security bulletin.

    - User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an     unauthorized attacker to perform spoofing over a network. (CVE-2026-21527)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

solution:
  Microsoft has released the following security updates to address this issue:
    -KB5074993
    -KB5074994
    -KB5074995

plugin_output:
  Path              : E:\ExchangeV15\
    Installed version : 15.1.2507.61
    Fixed version     : 15.1.2507.66

xrefs:
  MSFT:MS26-5074993, MSFT:MS26-5074994, MSFT:MS26-5074995, MSKB:5074993, MSKB:5074994, MSKB:5074995, IAVA:2026-A-0127

see_also:
  https://support.microsoft.com/help/5074993
  https://support.microsoft.com/help/5074994
  https://support.microsoft.com/help/5074995


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-DC-004
host_ip: 164.231.187.35
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-DC-004.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-DC-004.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-DC-004
host_ip: 164.231.187.35
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-DC-004.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-DC-003
host_ip: 164.231.187.34
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-DC-003.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-DC-003.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-DC-003
host_ip: 164.231.187.34
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-DC-003.MONTFORD-POINT.navy.mil


plugin_name: IP Forwarding Enabled
plugin_family: Firewalls
risk_factor: Medium
hostname: 164.231.187.33
host_ip: 164.231.187.33
protocol: tcp
svc_name: general
synopsis: The remote host has IP forwarding enabled.
cves: CVE-1999-0511
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host has IP forwarding enabled. An attacker can exploit this to route packets through the host and potentially bypass some firewalls / routers / NAC filtering.

  Unless the remote host is a router, it is recommended that you disable IP forwarding.

solution:
  On Linux, you can disable IP forwarding by doing :

  echo 0 > /proc/sys/net/ipv4/ip_forward

  On Windows, set the key 'IPEnableRouter' to 0 under

  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

  On Mac OS X, you can disable IP forwarding by executing the command :

  sysctl -w net.inet.ip.forwarding=0

  For other systems, check with your vendor.

plugin_output:
  IP forwarding appears to be enabled on the remote host.

   Detected local MAC Address        : 00155dcdd503
   Response from local MAC Address   : 00155dcdd503

   Detected Gateway MAC Address      : 2c0be9d7bd41
   Response from Gateway MAC Address : 2c0be9d7bd41


plugin_name: Network Time Protocol (NTP) Mode 6 Scanner
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.33
host_ip: 164.231.187.33
protocol: udp
svc_name: ntp
synopsis: The remote NTP server responds to mode 6 queries.
solution: Restrict NTP mode 6 queries.
see_also:
  https://www.nessus.org/u?18e62de1
  https://www.virtuesecurity.com/kb/ntp-mode-6-vulnerabilities/

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote NTP server responds to mode 6 queries. Devices that respond to these queries have the potential to be used in NTP amplification attacks. An unauthenticated, remote attacker could potentially exploit this, via a specially crafted mode 6 query, to cause a reflected denial of service condition.

plugin_output:
  Nessus elicited the following response from the remote
    host by sending an NTP mode 6 query :

  'version="4", processor="unknown", system="UNIX", leap=0, stratum=4,
  precision=-19, rootdelay=, rootdisp=, refid=164.231.69.13,
  reftime=0xED54F043.CDF047B9, clock=0xED54F07F.09091CE0, peer=50512,
  tc=10, mintc=3, offset=, frequency=, sys_jitter=, clk_jitter=,
  clk_wander='


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: 164.231.187.122
host_ip: 164.231.187.122
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/ST=CT/L=Ledyard/O=Emprise Corporation/OU=ESTA/CN=sip-edock-server-001-081/E=support@emprisecorporation.com/2.16.840.1.113730.1.13=001-081
  |-Issuer  : C=US/ST=CT/L=Ledyard/O=Emprise Corporation/OU=ESTA/CN=Military Sealift Command SIP/PENG CA/E=support@emprisecorporation.com/2.16.840.1.113730.1.13=


plugin_name: TLS Version 1.0 Protocol Detection
plugin_family: Service detection
risk_factor: Medium
hostname: 164.231.187.122
host_ip: 164.231.187.122
protocol: tcp
svc_name: www
synopsis: The remote service encrypts traffic using an older version of TLS.
solution: Enable support for TLS 1.2 and 1.3, and disable support for TLS 1.0.
plugin_output: TLSv1 is enabled and the server supports at least one cipher.
xrefs: CWE:327
see_also: https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-00
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible.

  As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

  PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30, 2018, except for POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits.


plugin_name: TLS Version 1.1 Deprecated Protocol
plugin_family: Service detection
risk_factor: Medium
hostname: 164.231.187.122
host_ip: 164.231.187.122
protocol: tcp
svc_name: www
synopsis: The remote service encrypts traffic using an older version of TLS.
solution: Enable support for TLS 1.2 and/or 1.3, and disable support for TLS 1.1.
plugin_output: TLSv1.1 is enabled and the server supports at least one cipher.
xrefs: CWE:327
see_also:
  https://datatracker.ietf.org/doc/html/rfc8996
  http://www.nessus.org/u?c8ae820d

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote service accepts connections encrypted using TLS 1.1. TLS 1.1 lacks support for current and recommended cipher suites. Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1

  As of March 31, 2020, Endpoints that are not enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: 164.231.187.121
host_ip: 164.231.187.121
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/ST=CT/L=Ledyard/O=Emprise Corporation/OU=ESTA/CN=sip-edock-server-001-080/E=support@emprisecorporation.com/2.16.840.1.113730.1.13=001-080
  |-Issuer  : C=US/ST=CT/L=Ledyard/O=Emprise Corporation/OU=ESTA/CN=Military Sealift Command SIP/PENG CA/E=support@emprisecorporation.com/2.16.840.1.113730.1.13=


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92010.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92010.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92010.MONTFORD-POINT.navy.mil


plugin_name: Apache Log4j 2.0-beta9 < 2.25.3 MitM
plugin_family: Misc.
risk_factor: Medium
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: general
synopsis: A logging library installed on the remote host is affected by a man in the middle vulnerability.
solution: Upgrade to Apache Log4j version 2.25.3 or later.
cves: CVE-2025-68161
xrefs: IAVA:2026-A-0001
see_also: https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The version of Apache Log4j on the remote host is 2.0-beta9 through 2.25.2. The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:

    - The attacker is able to intercept or redirect network traffic between the client and the log receiver.
   
    - The attacker can present a server certificate issued by a certification authority trusted by the Socket     Appender’s configured trust store (or by the default Java trust store if no custom trust store is     configured).

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\CMP\data\log4j-core-2.18.0.jar
    Installed version : 2.18.0
    Fixed version     : 2.25.3


plugin_name: Microsoft Edge (Chromium) < 145.0.3800.58 (CVE-2026-0102)
plugin_family: Windows
risk_factor: Low
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: cifs
synopsis: The remote host has an web browser installed that is affected by a vulnerability.
solution: Upgrade to Microsoft Edge version 145.0.3800.58 or later.
cves: CVE-2026-0102
xrefs: IAVA:2026-A-0168
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The version of Microsoft Edge installed on the remote Windows host is prior to 145.0.3800.58. It is, therefore, affected by a vulnerability as referenced in the February 14, 2026 advisory.

    - Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially     without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses,     email, or phone number metadata. (CVE-2026-0102)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files (x86)\Microsoft\Edge\Application
    Installed version : 144.0.3719.115
    Fixed version     : 145.0.3800.58

see_also:
  http://www.nessus.org/u?73998014
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0102


plugin_name: Microsoft Edge (Chromium) < 144.0.3719.130 (CVE-2026-2441)
plugin_family: Windows
risk_factor: Critical
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: cifs
synopsis: The remote host has an web browser installed that is affected by a vulnerability.
solution: Upgrade to Microsoft Edge version 144.0.3719.130 or later.
cves: CVE-2026-2441
xrefs: IAVA:2026-A-0168, IAVA:2026-A-0162
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The version of Microsoft Edge installed on the remote Windows host is prior to 144.0.3719.130. It is, therefore, affected by a vulnerability as referenced in the February 17, 2026 advisory.

    - Use after free in CSS allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2026-2441)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files (x86)\Microsoft\Edge\Application
    Installed version : 144.0.3719.115
    Fixed version     : 144.0.3719.130

see_also:
  http://www.nessus.org/u?73998014
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2441


plugin_name: Microsoft Edge (Chromium) < 145.0.3800.70 Multiple Vulnerabilities
plugin_family: Windows
risk_factor: Critical
hostname: MONT-WS-92010
host_ip: 164.231.187.45
protocol: tcp
svc_name: cifs
synopsis: The remote host has an web browser installed that is affected by multiple vulnerabilities.
solution: Upgrade to Microsoft Edge version 145.0.3800.70 or later.
cves: CVE-2026-2648, CVE-2026-2649, CVE-2026-2650
xrefs: IAVA:2026-A-0162
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The version of Microsoft Edge installed on the remote Windows host is prior to 145.0.3800.70. It is, therefore, affected by multiple vulnerabilities as referenced in the February 20, 2026 advisory.

    - Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2026-2650)

    - Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to     perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)     (CVE-2026-2648)

    - Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2026-2649)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files (x86)\Microsoft\Edge\Application
    Installed version : 144.0.3719.115
    Fixed version     : 145.0.3800.70

see_also:
  http://www.nessus.org/u?3a37a9de
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2648
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2649
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2650


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-DP-001
host_ip: 164.231.187.44
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-DP-001.MONTFORD-POINT.NAVY.MIL
  |-Issuer  : CN=SMS Issuing


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-DP-001
host_ip: 164.231.187.44
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-DP-001.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-DP-001.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-DP-001
host_ip: 164.231.187.44
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-DP-001.MONTFORD-POINT.navy.mil


plugin_name: HSTS Missing From HTTPS Server (RFC 6797)
plugin_family: Web Servers
risk_factor: Medium
hostname: MONT-DP-001
host_ip: 164.231.187.44
protocol: tcp
svc_name: www
synopsis: The remote web server is not enforcing HSTS, as defined by RFC 6797.
solution: Configure the remote web server to use HSTS.
see_also: https://tools.ietf.org/html/rfc6797
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

plugin_output:
  HTTP/1.1 200 OK

  Content-Type: text/html
  Last-Modified: Thu, 03 Nov 2022 18:34:25 GMT
  Accept-Ranges: bytes
  ETag: "c3af9ae6b2efd81:0"
  Server: Microsoft-IIS/10.0
  Date: Fri, 06 Mar 2026 05:36:51 GMT
  Content-Length: 703


  The remote HTTPS server does not send the HTTP
  "Strict-Transport-Security" header.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-004
host_ip: 164.231.187.43
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-004.montford-point.navy.mil
  |-Issuer  : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-004.montford-point.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-004
host_ip: 164.231.187.43
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-VSF-004.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-VSF-004.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-004
host_ip: 164.231.187.43
protocol: tcp
svc_name: www
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-004.montford-point.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-004
host_ip: 164.231.187.43
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-VSF-004.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-003
host_ip: 164.231.187.42
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-003.MONTFORD-POINT.navy.mil
  |-Issuer  : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-003.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-003
host_ip: 164.231.187.42
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-VSF-003.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-VSF-003.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-003
host_ip: 164.231.187.42
protocol: tcp
svc_name: www
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : C=US/ST=Texas/L=Houston/O=Hewlett Packard Enterprise/OU=Hewlett Packard Enterprise Network Management Software (SMH)/CN=MONT-VSF-003.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-VSF-003
host_ip: 164.231.187.42
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-VSF-003.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate with Wrong Hostname
plugin_family: General
risk_factor: Medium
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service is for a different host.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The 'commonName' (CN) attribute of the SSL certificate presented for this service is for a different machine.

plugin_output:
  The identities known by Nessus are :

    164.231.187.41
    mont-nas
    164.231.187.41

  The Common Name in the certificate is :

    QNAP NAS


plugin_name: IP Forwarding Enabled
plugin_family: Firewalls
risk_factor: Medium
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: general
synopsis: The remote host has IP forwarding enabled.
cves: CVE-1999-0511
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The remote host has IP forwarding enabled. An attacker can exploit this to route packets through the host and potentially bypass some firewalls / routers / NAC filtering.

  Unless the remote host is a router, it is recommended that you disable IP forwarding.

solution:
  On Linux, you can disable IP forwarding by doing :

  echo 0 > /proc/sys/net/ipv4/ip_forward

  On Windows, set the key 'IPEnableRouter' to 0 under

  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

  On Mac OS X, you can disable IP forwarding by executing the command :

  sysctl -w net.inet.ip.forwarding=0

  For other systems, check with your vendor.

plugin_output:
  IP forwarding appears to be enabled on the remote host.

   Detected local MAC Address        : 00155dcdd503
   Response from local MAC Address   : 00155dcdd503

   Detected Gateway MAC Address      : 245ebe0ece90
   Response from Gateway MAC Address : 245ebe0ece90


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : C=TW/ST=Taipei/L=Taipei/O=QNAP Systems, Inc./OU=QTS/CN=QNAP NAS/E=support@qnap.com
  |-Issuer  : C=TW/ST=Taipei/L=Taipei/O=QNAP Systems, Inc./OU=QTS/CN=QNAP NAS/E=support@qnap.com


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: www
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : C=TW/ST=Taipei/L=Taipei/O=QNAP Systems, Inc./OU=QTS/CN=QNAP NAS/E=support@qnap.com


plugin_name: SMB Signing not required
plugin_family: Misc.
risk_factor: Medium
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: cifs
synopsis: Signing is not required on the remote SMB server.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  Signing is not required on the remote SMB server. An unauthenticated, remote attacker can exploit this to conduct man-in-the-middle attacks against the SMB server.

solution:
  Enforce message signing in the host's configuration. On Windows, this is found in the policy setting 'Microsoft network server: Digitally sign communications (always)'. On Samba, the setting is called 'server signing'. See the 'see also' links for further details.

see_also:
  http://www.nessus.org/u?df39b8b3
  http://technet.microsoft.com/en-us/library/cc731957.aspx
  http://www.nessus.org/u?74b80723
  https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
  http://www.nessus.org/u?a3cac4ea


plugin_name: OpenSSH < 10.1 / 10.1p1 Multiple Vulnerabilities
plugin_family: Misc.
risk_factor: Low
hostname: 164.231.187.41
host_ip: 164.231.187.41
protocol: tcp
svc_name: ssh
synopsis: The SSH server running on the remote host is affected by multiple vulnerabilities.
solution: Upgrade to OpenSSH version 10.1/10.1p1 or later.
cves: CVE-2025-61984, CVE-2025-61985
xrefs: IAVA:2025-A-0806, IAVA:2025-A-0729-S
see_also: https://www.openssh.com/releasenotes.html#10.1p1
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  The version of OpenSSH installed on the remote host is prior to 10.1. It is, therefore, affected by multiple vulnerabilities:

    - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly     untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted     sources are the command line and %-sequence expansion of a configuration file. (A configuration file     that provides a complete literal username is not categorized as an untrusted source.) (CVE-2025-61984)

    - ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a     ProxyCommand is used. (CVE-2025-61985)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Version source    : SSH-2.0-OpenSSH_10.0
    Installed version : 10.0
    Fixed version     : 10.1 / 10.1.p1


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-ACAS-001
host_ip: 164.231.187.40
protocol: tcp
svc_name: www
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : O=Nessus Users United/OU=Nessus Server/L=New York/C=US/ST=NY/CN=MONT-ACAS-001
  |-Issuer  : O=Nessus Users United/OU=Nessus Certification Authority/L=New York/C=US/ST=NY/CN=Nessus Certification Authority


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-ACAS-001
host_ip: 164.231.187.40
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-ACAS-001.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-ACAS-001.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-ACAS-001
host_ip: 164.231.187.40
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-ACAS-001.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92230
host_ip: 164.231.187.71
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92230.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92230.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92230
host_ip: 164.231.187.71
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92230.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92026
host_ip: 164.231.187.70
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92026.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92026.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92026
host_ip: 164.231.187.70
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92026.MONTFORD-POINT.navy.mil


plugin_name: Autodesk 2025 < 2025.1.2 Multiple Vulnerabilities (AutoCAD) (adsk-sa-2025-0001)
plugin_family: Windows
risk_factor: High
hostname: MONT-WS-92026
host_ip: 164.231.187.70
protocol: tcp
svc_name: cifs
solution: Upgrade to Autodesk AutoCAD versions 2025.1.2 or later.
xrefs: IAVA:2025-A-0184-S
see_also: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
synopsis:
  The version of Autodesk AutoCAD installed on the remote Windows host is affected by multiple vulnerabilities.

description:
  The 2025 version of Autodesk AutoCAD installed on the remote Windows host is a version prior to 2025.1.2. It is, therefore, affected by multiple vulnerabilities:

    - A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an     Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash,     read sensitive data, or execute arbitrary code in the context of the current process. (CVE-2025-1427)

    - A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read     vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or     execute arbitrary code in the context of the current process. (CVE-2025-1428)

    - A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption     vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context     of the current process. (CVE-2025-1430)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\Autodesk\AutoCAD LT 2025\
    Installed version : 25.0.154.0.0
    Fixed version     : 25.1.2

cves:
  CVE-2025-1427, CVE-2025-1428, CVE-2025-1429, CVE-2025-1430, CVE-2025-1432, CVE-2025-1433, CVE-2025-1649, CVE-2025-1650, CVE-2025-1651


plugin_name: Autodesk Multiple Vulnerabilities (AutoCAD) (adsk-sa-2025-0017)
plugin_family: Windows
risk_factor: High
hostname: MONT-WS-92026
host_ip: 164.231.187.70
protocol: tcp
svc_name: cifs
solution: Upgrade to Autodesk AutoCAD versions 2023.1.8, 2024.1.8, 2025.1.3, 2026.1 or later.
cves: CVE-2025-5046, CVE-2025-5047, CVE-2025-5048
xrefs: IAVA:2025-A-0617-S
see_also: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0017
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
synopsis:
  The version of Autodesk AutoCAD installed on the remote Windows host is affected by multiple vulnerabilities.

description:
  The 2025 version of Autodesk AutoCAD installed on the remote Windows host is a version prior to 2026.1. It is, therefore, affected by multiple vulnerabilities:

    - A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds     Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive     data, or execute arbitrary code in the context of the current process. (CVE-2025-5046)

    - A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable     vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data,     or execute arbitrary code in the context of the current process. (CVE-2025-5047)

    - A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory     Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in     the context of the current process. (CVE-2025-5048)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\Autodesk\AutoCAD LT 2025\
    Installed version : 25.0.154.0.0
    Fixed version     : 25.0.171.0 (2025.1.3)


plugin_name: Autodesk Installer Privilege Escalation (CVE-2025-10885)
plugin_family: Windows
risk_factor: High
hostname: MONT-WS-92026
host_ip: 164.231.187.70
protocol: tcp
svc_name: cifs
synopsis: A software component installed on the remote Windows host is affected by a privilege escalation.
solution: Upgrade to Autodesk Installer 2.19 or later.
cves: CVE-2025-10885
xrefs: IAVA:2025-A-0830
see_also: https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0022
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  This vulnerability is a privilege escalation flaw in the Autodesk Installer, where improper validation of files loaded during the installation process allows a local, low-privileged attacker to craft a malicious file that is executed with elevated permissions, ultimately enabling arbitrary code execution as NT AUTHORITY\SYSTEM and full compromise of the host system.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\Autodesk\AdODIS\V1\Installer.exe
    Installed version : 2.10.0.9
    Fixed version     : 2.19


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-99181
host_ip: 164.231.187.69
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-99181.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-99181.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-99181
host_ip: 164.231.187.69
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-99181.MONTFORD-POINT.navy.mil


plugin_name: Windows Defender Antimalware/Antivirus Signature Definition Check
plugin_family: Windows
risk_factor: High
hostname: MONT-WS-99181
host_ip: 164.231.187.69
protocol: tcp
svc_name: cifs
solution: Trigger an update manually and/or enable auto-updates.
see_also: https://www.microsoft.com/en-us/wdsi/definitions
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
synopsis:
  Windows Defender AntiMalware / AntiVirus Signatures are continuously not and should not be more than 1 day old

description:
  Windows Defender has an AntiMalware/AntiVirus signature that gets updated continuously. The signature definition has not been updated in more than 1 day.

plugin_output:
  Malware Signature Timestamp : Mar.  4, 2026 at 11:14:11 GMT
    Malware Signature Version   : 1.445.354.0


plugin_name: Tenable Nessus Agent < 10.9.3 / 11.x < 11.0.3 Privilege Escalation Vulnerability (TNS-2026-01)
plugin_family: Windows
risk_factor: High
hostname: MONT-WS-99181
host_ip: 164.231.187.69
protocol: tcp
svc_name: cifs
solution: Upgrade to Tenable Nessus Agent 10.9.3 / 11.0.3 or later.
cves: CVE-2025-36640
xrefs: IAVA:2026-A-0149
see_also:
  http://www.nessus.org/u?3bdd8712
  https://www.tenable.com/security/TNS-2026-01

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
synopsis:
  An instance of Nessus Agent installed on the remote system is affected by Privilege Escalation Vulnerability.

description:
  According to its self-reported version, the Tenable Nessus Agent running on the remote host is prior to 10.9.3 or 11.0.3. It is, therefore, affected by a Privilege Escalation Vulnerability as referenced in the TNS-2026-01 advisory.

    - A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows     Hosts which could lead to escalation of privileges. (CVE-2025-36640)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\Tenable\Nessus Agent
    Installed version : 10.9.0
    Fixed version     : 10.9.3


plugin_name: Tenable Nessus Agent < 11.0.4 / 11.1.x < 11.1.2 DoS (TNS-2026-05)
plugin_family: Windows
risk_factor: Medium
hostname: MONT-WS-99181
host_ip: 164.231.187.69
protocol: tcp
svc_name: general
synopsis: An instance of Nessus Agent installed on the remote system is affected by a vulnerability.
solution: Upgrade to Tenable Nessus Agent 11.0.4, 11.1.2 or later.
cves: CVE-2026-2026
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
  According to its self-reported version, the Tenable Nessus Agent running on the remote host is prior to 11.0.4 or 11.1.x prior to 11.1.2.
  It is, therefore, affected by a vulnerability as referenced in the TNS-2026-05 advisory.

    - A vulnerability has been identified where weak file permissions in the Nessus Agent directory could allow     unauthorized access, potentially permitting Denial of Service (DoS) attacks. Tenable has released Nessus     Agent 11.0.4 and 11.1.2 to address these issues. The installation files can be obtained from the Tenable     Downloads Portal (https://www.tenable.com/downloads/nessus). (CVE-2026-2026)

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

plugin_output:
  Path              : C:\Program Files\Tenable\Nessus Agent
    Installed version : 10.9.0
    Fixed version     : 11.0.4

see_also:
  https://docs.tenable.com/release-notes/Content/agent/2026.htm
  https://www.tenable.com/security/TNS-2026-05


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92229
host_ip: 164.231.187.68
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92229.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92229.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92229
host_ip: 164.231.187.68
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92229.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92202
host_ip: 164.231.187.67
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92202.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92202.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92202
host_ip: 164.231.187.67
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92202.MONTFORD-POINT.navy.mil


plugin_name: ICMP Timestamp Request Remote Date Disclosure
plugin_family: General
risk_factor: Low
hostname: MONT-WS-92038.MONTFORD-POINT.navy.mil
host_ip: 164.231.187.66
protocol: icmp
svc_name: general
synopsis: It is possible to determine the exact time set on the remote host.
solution: Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
cves: CVE-1999-0524
xrefs: CWE:200
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 400 characters]

plugin_output:
  This host returns non-standard timestamps (high bit is set)
  The ICMP timestamps might be in little endian format (not in network format)
  The difference between the local and remote clocks is 6 seconds.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92245
host_ip: 164.231.187.77
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92245.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92245.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92245
host_ip: 164.231.187.77
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92245.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92032
host_ip: 164.231.187.76
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92032.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92032.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92032
host_ip: 164.231.187.76
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92032.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92095
host_ip: 164.231.187.75
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92095.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92095.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92095
host_ip: 164.231.187.75
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92095.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92024
host_ip: 164.231.187.74
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92024.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92024.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92024
host_ip: 164.231.187.74
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92024.MONTFORD-POINT.navy.mil


plugin_name: Microsoft Office ActiveX Controls Enabled Without Restrictions Or Prompting
plugin_family: Windows
risk_factor: Medium
hostname: MONT-WS-92024
host_ip: 164.231.187.74
protocol: tcp
svc_name: general
solution: Disable ActiveX controls or enable them with prompt and with additional restrictions.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
synopsis:
  A Microsoft Office application installed on the remote host has ActiveX controls enabled without restrictions and without prompting.

description:
  A Microsoft Office application installed on the remote host has ActiveX controls enabled without restrictions and without prompting.

plugin_output:
  SID: S-1-5-21-1360995287-4027491577-3040029667-1244
  Username: MONTFORD-POINT.NAVY.MIL\Joseph.R.Lo-Guidice
  The Microsoft Office installed on this machine for this user has ActiveX Controls enabled without restrictions and without prompting.


plugin_name: Microsoft Office Protected View Disabled
plugin_family: Windows
risk_factor: Medium
hostname: MONT-WS-92024
host_ip: 164.231.187.74
protocol: tcp
svc_name: general
synopsis: A Microsoft Office application installed on the remote host has protected view disabled.
description: A Microsoft Office application installed on the remote host has protected view disabled.
solution: Enable protected view settings.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
plugin_output:
  SID              : S-1-5-21-1360995287-4027491577-3040029667-1244
  Username         : MONTFORD-POINT.NAVY.MIL\Joseph.R.Lo-Guidice
  Registry Key     : HKU\S-1-5-21-1360995287-4027491577-3040029667-1244\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV = 1
  This application : Excel in Microsoft Office 2016/2019 has protected view from files originating from the internet disabled.
  Registry Key     : HKU\S-1-5-21-1360995287-4027491577-3040029667-1244\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV = 1
  This application : Excel in Microsoft Office 2016/2019 has protected view from files located from potentially unsafe locations disabled.


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92034
host_ip: 164.231.187.73
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92034.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92034.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92034
host_ip: 164.231.187.73
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92034.MONTFORD-POINT.navy.mil


plugin_name: SSL Certificate Cannot Be Trusted
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92040
host_ip: 164.231.187.72
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate for this service cannot be trusted.
solution: Purchase or generate a proper SSL certificate for this service.
see_also:
  https://www.itu.int/rec/T-REC-X.509/en
  https://en.wikipedia.org/wiki/X.509

workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 1512 characters]

plugin_output:
  The following certificate was at the top of the certificate
  chain sent by the remote host, but it is signed by an unknown
  certificate authority :

  |-Subject : CN=MONT-WS-92040.MONTFORD-POINT.navy.mil
  |-Issuer  : CN=MONT-WS-92040.MONTFORD-POINT.navy.mil


plugin_name: SSL Self-Signed Certificate
plugin_family: General
risk_factor: Medium
hostname: MONT-WS-92040
host_ip: 164.231.187.72
protocol: tcp
svc_name: msrdp
synopsis: The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
solution: Purchase or generate a proper SSL certificate for this service.
workflow_status: Open
created_at: 2026-03-06 17:48:07
updated_at: 2026-03-06 17:48:07
description:
[cell repeats an earlier one in this file: 426 characters]

plugin_output:
  The following certificate was found at the top of the certificate
  chain sent by the remote host, but is self-signed and was not
  found in the list of known certificate authorities :

  |-Subject : CN=MONT-WS-92040.MONTFORD-POINT.navy.mil


# tradsec_checks

vuln_id: V-245722
stig_id: CS-01.01.01
title: COMSEC Account Management - Equipment and Key Storage
severity: high
check_text:
  Ask the COMSEC Custodian, COMSEC Responsible Officer (CRO), Security Manager or ISSM how COMSEC equipment and materials are transported, handled and stored.  Physically check that crypto equipment, keys, and keyed crypto are handled and stored properly. Reviewers must annotate specific types of crypto devices observed in the finding details or comments, (e.g. TACLANE, KIV 7, etc.)


vuln_id: V-245723
stig_id: CS-01.03.01
title: COMSEC Account Management - Appointment of Responsible Person
severity: low
check_text:
  Check there is a current COMSEC Custodian appointment letter or verify there is a Hand Receipt Holder for COMSEC key material received from a supporting account.  NOTE:  Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DoDIN assets. COMSEC accounts or items not used with DoDIN assets should not be inspected.


vuln_id: V-245724
stig_id: CS-01.03.02
title: COMSEC Account Management - Program Management and Standards Compliance
severity: low
check_text:
  Ask how the COMSEC account is managed. Check for written procedures and inspection reports.

  NOTES:

  1. Applies in a tactical environment if the crypto equipment and key material being observed is at a location where supporting staff (IAM, SM, COMSEC Custodian) would logically be located. If it is a mobile tactical organization, responsibility for program management might simply be the identification of an individual responsible for keeping track of and maintaining COMSEC materials, but supporting documentation may not be immediately available and should not be written as a finding; however, observations and comments may still be documented.

  2. Note in the report the COMSEC Account type e.g. NSA, Navy, Army, etc.

  3. Note in the report the last COMSEC Inspection Date based on observed documentation. (Summarize the overall results and if the site is taking action to address/correct findings.)

  4. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.

  5. This check is not intended to be an inspection of the COMSEC Program, rather it is a verification that a viable program is in place with NSA or oversight. The idea is to ensure that NSA or Service oversight inspection findings/deficiencies are being corrected in a timely manner by the site.


vuln_id: V-245726
stig_id: CS-02.02.02
title: COMSEC Training - COMSEC User
severity: medium
check_text:
  Check proof of user training.

  NOTES:

  1. Applies in a tactical environment if the crypto equipment and key material being observed is at a location where supporting staff (IAM, SM, COMSEC Custodian/COMSEC Responsible Officer (CRO) AKA: Hand Receipt Holder) would logically be located. If it is a mobile tactical organization, COMSEC users should previously have received proper training; however, since the documentation will likely not be available in a field environment this check will be NA.

  2. Observations and comments may be entered for the record, even if there is no finding.

  3. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.


vuln_id: V-245727
stig_id: CS-03.01.01
severity: high
title:
  Classified Transmission - Electronic Means using Cryptographic System Authorized by the Director, NSA

check_text:
  GENERAL REQUIREMENT: Classified information shall be transmitted by electronic means over an approved secure communications system authorized by the Director, NSA, or a Protected Distribution System (PDS) designed and installed to meet the requirements of Committee on National Security Systems Instruction (CNSSI) 7003. This applies to voice, data, message (both organizational and email), and facsimile transmissions.

  CHECK: Where classified (SIPRNet) transmissions are outside of an area approved for unprotected transmission check that the cryptographic system is designed and installed IAW NSA approved guidelines. Generally an area not approved for unprotected SIPRNet transmissions will be any transmission through an area that is not a SCIF, Secret or higher Vault or Secure Room or Secret or higher Controlled Access Area (CAA).

  NOTES:

  1. This check is applicable in a tactical environment regardless if the unprotected SIPRNet transmission line is located within a fixed facility, or field/mobile environment.

  2. This check is NA if the unencrypted signal is installed in a proper Protected Distribution System (PDS).


vuln_id: V-245728
stig_id: CS-04.01.01
severity: high
title:
  Protected Distribution System (PDS) Construction - Point of Presence (PoP) and Terminal Equipment Protection.  This requirement concerns security of both the starting and ending points for PDS within proper physically protected and access controlled environments.

check_text:
  This check concerns security requirements for the physical locations of both the starting and ending points for Protected Distribution Systems (PDS) within a physical enclave.

  Check to ensure:
  1. The PDS originates within the room or area containing the SIPRNet Point of Presence (PoP) for the facility or area, which must be in a Secret or above Secure Room, Vault, SCIF or alternatively in an Information Processing Systems (IPS) Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (e.g., printer, copier, fax)). An IPS container is a specially designed safe for secured operation of classified network and end user equipment.

  2. PDS terminal equipment (wall jacks/ports) are located in a Secret or higher Controlled Access Area (CAA), Secret or higher vault, Secret or higher Secure Room or in a SCIF.

  3. PDS terminating in areas not a Secret or higher CAA may alternatively terminate in an IPS Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (printer, copier, and fax)).

  4. If an IPS container is used to secure equipment at a PDS termination point, ensure it is located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  5. In exceptional situations, when the PDS termination area cannot be access controlled to the level of the data carried by the PDS (e.g., in a multi-use conference room), ensure the PDS termination point (wall jack/port) is secured with a lock box. Access Controlled to the level of the data carried by the PDS for SIPRNet connections means the PDS termination area must minimally be a secret CAA. The lock box must meet the same construction requirements as a pull box for the PDS carrier type. *Specifications for pull boxes and termination lock boxes are covered in rule: Protected Distribution System (PDS) Construction - Accessible Pull Box Security, STIG ID: CS-04.01.03, Rule ID: SV-41000r3_rule Vuln ID: V-245730. A finding for deficient pull box or termination lock box construction should be cited under STIG ID: CS-04.01.03.

  6. If a lock box is used to secure a PDS termination/end point (wall jack/port), ensure it is located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  7. PDS lock boxes located within a LAA are physically disconnected (cables pulled) from equipment and the lock boxes secured with an approved PDS lock when the lock box is not under the continuous observation and control of a properly cleared person (secret security clearance for SIPRNet).

  NOTES:

  Access to all PDS points with breakouts must be restricted to personnel cleared at the highest level of the breakout and therefore, the PDS terminal equipment (end point) must either be locked or continuously safeguarded by cleared persons to prevent tampering.

  The S&G 8077 changeable combination padlock is the DOD standard/required PDS lock for user termination lock boxes that are opened/closed on a routine or frequent basis. Tamper evident locks (keyed padlocks with seals) are not permitted to be used within the DOD, per guidance from USD(I) Policy.


vuln_id: V-245729
stig_id: CS-04.01.02
title: Protected Distribution System (PDS) Construction - Hardened Carrier
severity: high
check_text:
  1. A Hardened Carrier IAW CNSSI 7003 must be constructed of ferrous, electrical metallic tubing (EMT); ferrous pipe conduit; or ferrous rigid sheet metal ducting. Flexible conduit and armored cables must not be used as a hardened carrier. The carrier must not open to expose data cables (e.g., removable covers), except at approved pull boxes and termination boxes. The carrier must utilize elbows, couplings, nipples, and connectors of the same materials.  All joints and connections must be sealed.

  NOTE: A vendor product (AKA: Modular PDS) may be used if constructed of solid metal components and sealed - as described above.

  2. The PDS is not within an Uncontrolled Access Area (UAA).


vuln_id: V-245730
stig_id: CS-04.01.03
title: Protected Distribution System (PDS) Construction - Pull Box Security
severity: high
check_text:
  If pull box covers are capable of being opened and used for accessing the transmission cable, the following 6 checks apply:

  Check 1. Box covers do not have removable hinge pins. The hinge must be hidden or mechanically blocked to prevent removal.

  Check 2. If the pull box will be accessed after installation, the pull box cover must be secured with an approved PDS lock. Multiple locks may be required for larger pull-boxes.

  NOTE 1: The ONLY approved PDS Lock within the DoD is the General Services Administration (GSA) approved changeable combination padlock and has historically been the lock used for securing accessible pull boxes and PDS termination boxes. The only padlock currently meeting this standard is the S&G 8077, changeable combination padlock.

  NOTE 2: A newer alternative PDS lock listed by the CNSSI 7003 is the tamper indicative padlock with a wire loop seal. This is a "keyed" padlock with an attached seal that is issued exclusively by the lock proponent, which is the National Security Agency (NSA) Information Assurance Division (IAD) Lock and Seal Office. The USD(I) has determined this lock will not be used for protecting PDS Pull Boxes within the DoD.

  NOTE 3: The new CNSSI 7003 under the PDS Lock definition identified the wrong federal specification for the changeable combination padlock. The lock identified under FF-L-2740B is designed for safes and will not fit properly on a small PDS lock box. The correct lock (S&G 8077 changeable combination padlock) is under the FF-P-110J federal specification. That is what the CNSSI 7003 proponent "intended" and the DoD TEMPEST Advisory Group (TAG) and NSA Protective Technologies Group are taking action to coordinate correction of this oversight.

  Check 3. Hasps (used with PDS locks) to secure the cover on the pull box are permanently and securely attached to the box (e.g., tack welded or with rivets) in such a way as it cannot be removed without breaking the hasp or its connection.

  Check 4. Ensure boxes with prepunched knockouts are not used.

  Check 5. Ensure that for medium threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 14 gauge and must have a cover that can be locked. However, the material need not be thicker than the PDS carrier or the thickness needed for box rigidity.

  Check 6. Ensure that for low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  If pull box covers are NOT capable of being opened or used for accessing the transmission cable, the following 4 checks apply:

  Check 7. Ensure covers are secured to the pull boxes by welding or epoxy after installation as follows:
    - If welded, at least one weld must be applied on each side of the box and cover.
    - If epoxy is used, it must be applied between all mating surfaces continuously around the cover.
    - Painted surfaces must be treated to form a mechanically strong epoxy bond.

  Check 8. Ensure hinge-pins for pull-box covers are non-removable. The hinge must be hidden or mechanically blocked to prevent removal.

  Check 9. Boxes with pre-punched knockouts are not used under any circumstances.

  Check 10. For low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  NOTE: Pull boxes located in medium threat areas must have a lockable cover per the CNSSI 7003 and are therefore addressed in check #5 above under pull box covers capable of being opened and used for accessing the transmission cable.


vuln_id: V-245731
stig_id: CS-04.01.04
title: Protected Distribution System (PDS) Construction - Buried PDS Carrier
severity: high
check_text:
  Check Content for exterior PDS.

  If the Category 2 hardened carrier is buried:

  1. Check to ensure the buried carrier is constructed of conduit consisting of EMT, rigid pipe, PVC, or a similar type of plastic electrical conduit. (CAT I finding)

  2. Check that all connections are permanently sealed completely around all mating surfaces (e.g., welding, epoxy, fusion, or PVC glue). (CAT I finding)

  3. Check to ensure it is buried a minimum of 1 meter (39 inches) below the surface and on the property (in a LOW Threat area within CONUS) owned or leased by the U.S. Government or the contractor having control of the PDS. NOTE: As an alternative, if the carrier cannot be buried to a one-meter depth due to soil conditions or blocked passage, a lesser depth may be used within a low threat area with prior approval of the Authorizing Official (AO) if the carrier is encased within the center of mass of approximately 20 centimeters (8 inches) of concrete. (CAT I finding)

  4. Check that the buried carrier departs and enters a building through the building's concrete slab or basement wall. NOTE: As an alternative all portions of the PDS above the one-meter (39 inches) depth and not within a CAA (e.g., a PDS rising to a pull box on the side of a building) must meet the requirements of a Category 2 hardened carrier. (CAT I finding)

  5. Check that manholes or any other access (e.g., hand hole) to the buried PDS are secured with a PDS lock or an alarm. The PDS lock must be visible for daily inspection. If a PDS lock cannot be used due to the physical construction of the manhole, then a standard locking manhole cover and micro-switch alarm should be used. NOTE: As an alternative to a PDS lock or approved micro-switch alarms, manhole covers may be completely welded around the opening surface to impede opening and provide for clear evidence of penetration. Spot-welding is not acceptable.  If operational security needs dictate exceeding the STIG requirements, the site is always free to expand upon and increase their security posture by welding manhole covers. However, prior to this alternative method being instituted, the site must conduct and document an in-depth THREAT Assessment for their AOR and the assessment requires Senior Agency Official approval. This approval will be maintained on file. Also, daily visual inspections are still required per CNSSI 7003, Section X, para b. 3. (CAT I finding)

  NOTE: The USD(I) Policy has determined the PDS Locks referred to in the CNSSI 7003 as Tamper Indicative Padlock with a wire loop seal and Tamper Evident Seal ARE NOT permitted for use in the DoD. This is because neither product was properly vetted and listed by the DoD Lock Program. ONLY the SG 8077 Changeable Combination Padlock is to be used for securing Buried PDS manhole covers protecting SIPRNet within the DoD.

  6. If the carrier is buried in a MEDIUM threat location, check to ensure it is buried a minimum of 1 meter (39 inches) below the surface AND be encased within the center of mass of approximately 20 centimeters (8 inches) of concrete. NOTE: A concrete and steel container of sufficient size (to preclude surreptitious penetration in a period less than two hours as confirmed by laboratory tests) may be used in lieu of the 20 centimeters (8 inches) of concrete. (CAT I finding)

  NOTE for Reviewers: If portions of the buried carrier cannot be checked due to being physically inaccessible, conduct whatever physical review is possible and attempt to validate PDS construction by reviewing contract/build documents, engineering drawings or certification documents from installation engineers that contain information about the physical makeup of the buried carrier.

  7. Check the PDS is not within an Uncontrolled Access Area (UAA). (CAT I finding)


vuln_id: V-245732
stig_id: CS-04.01.05
title: Protected Distribution System (PDS) Construction - External Suspended PDS
severity: high
check_text:
  Suspended carriers (Exterior PDS) may be used for short runs when it is not practical to bury the PDS between buildings (e.g., between the 3rd floors of adjacent buildings).

  Check to ensure:

  1. Suspended carriers between buildings terminate in a Secret or higher Controlled Access Area (CAA) on each end OR immediately enter a hardened PDS at the building boundary.  (CAT I)

  2. Suspended carriers are hung directly between buildings.  (CAT I)

  3. Suspended carriers are elevated a minimum of 5 meters (16 feet 4 inches).  (CAT I)

  4. Suspended carriers are on property owned or leased by the USG or by a USG contractor or vendor that controls the PDS. (CAT I)

  5. Suspended carriers are installed to provide unimpeded visual inspection and be clear of any obstruction or device which encroaches upon the system to facilitate tampering. (CAT I)

  6. The areas containing suspended carriers are illuminated at night. (CAT I)

  7. The PDS is not located within an Uncontrolled Access Area (UAA).  (CAT I)


vuln_id: V-245733
stig_id: CS-04.01.06
title: Protected Distribution System (PDS) Construction - Continuously Viewed Carrier
severity: high
check_text:
  Interior or Exterior PDS: Continuously viewed Carrier.  This is one of five types of Category 2 PDS allowed IAW the CNSSI 7003.

  Check to ensure:

  1. The transmission line is under continuous observation, 24 hours per day, including when non-operational. (CAT I finding)

  2. It is separated from all non-continuously viewed circuits ensuring an open field of view. (CAT III finding)

  3. The carrier has an SOP that includes the requirement to investigate any attempt to disturb the PDS. The requirement must include that appropriate security personnel investigate the area of attempted penetration within 15 minutes of discovery. (CAT II finding)

  4. The PDS is not located within an Uncontrolled Access Area (UAA).  (CAT I)


vuln_id: V-245734
stig_id: CS-04.01.07
title: Protected Distribution System (PDS) Construction - Tactical Environment Application
severity: high
check_text:
  PDS in a tactical environment.  Check to ensure:

  1. The PDS is located within the limits of the installation and command post, or in an area directly under the commander's physical control.

  2. Continuously viewed Carriers must be used in tactical environments with mobile systems employing inter-shelter cabling.

  3. Continuously viewed Carriers may also be used in tactical environments with "fixed facilities" ONLY if it is determined through a documented Risk Assessment that the cost or feasibility to install a Category 2 PDS (Hardened or Alarmed Carrier) is not warranted. If applicable based on the risk assessment STIG ID VULS CS-04.01.01 through CS-04.01.06 may be used for fixed facilities in a theater of operations.

  4. ALL PDS in a tactical environment must be included in a well-documented Risk Assessment, for which residual risk has been acknowledged and accepted by the PDS Approval Authority.


vuln_id: V-245735
stig_id: CS-04.01.08
title: Protected Distribution System (PDS) Construction - Alarmed Carrier
severity: high
check_text:
  An Alarmed PDS is one of five types of Category 2 PDS IAW the CNSSI 7003. It is a suitable alternative for the two types of interior PDS, which are Hardened Carrier or Continuously Viewed Carrier. It should be used when the unencrypted data transmission line is concealed above suspended ceilings, below raised floors, between walls or in any situation where the line is not visible for inspection.  In lieu of daily visual inspections the functionality of the PDS alarm must be tested at least weekly - or as based on guidance in the CNSSI 7003.

  Use this set of checks where the unencrypted SIPRNet cable must be installed in a PDS and the site indicates it is an alarmed PDS.

  Check to ensure SIPRNet data cables are installed in a carrier properly configured as an "Alarmed Carrier" IAW the following guidelines:

  1. Ideally the carrier will be constructed of solid electrical metallic tubing (EMT), ferrous conduit or pipe, or rigid-sheet steel ducting, utilizing elbows, couplings, nipples, and connectors of the same material. Connectors need not be permanently sealed in an alarmed carrier.  As a minimum the carrier may consist of any material equal to or better than standards for a "Simple PDS" (e.g., wood, PVT, EMT, ferrous conduit.  The key to determining the appropriateness of a PDS carrier is its suitability for supporting the functionality of the approved alarm sensor, which provides a means to detect tampering and/or breach of the actual PDS carrier - *not a breach of the space surrounding the carrier. An alarmed carrier must be protected by an alarm system that detects attempted penetration of the carrier. An IDS sensor capable of detecting changes in carrier air pressure is an example of an acceptable detection methodology. (CAT I)

  2. As an alternative to an alarmed carrier, the space surrounding the entire carrier may be covered by an area or volumetric (e.g., infrared, motion detection) alarm system.  (CAT I)

  3. The carrier and/or volumetric alarm system sensor employed must be approved by the cognizant physical security authorities.  Documentation must exist to support this approval. (CAT II)

  4. The alarm system and signal transmission must be part of an Intrusion Detection System (IDS) meeting the requirements of the Appendix to Enclosure 3 of DoD Manual 5200.01,V3 (INFOSEC - Protection of Classified Information). For instance: The alarm must provide protection from tampering and be able to register malfunctions. The alarm system must also transmit a line fault message to the annunciator panel if the system fails. (CAT I)

  5. The alarm signal must be sent to a 24/7 monitor station that is supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination according to DoD Manual 5200.02 Procedures for the DoD Personnel Security Program (PSP). (CAT I)

  6. The monitor station must be capable of notifying security forces that can respond within 15 minutes. (CAT I)

  *NOTE: May be reduced to a CAT II severity level finding if the monitor station is capable of notifying security forces but the security forces are not capable of responding within 15 minutes.

  7. PDS alarm functionality and performance must be verified on at least a weekly basis IAW Table 5 of the CNSSI 7003. (CAT I)

  *NOTE: Alarm functionality tests performed less than weekly, but at least once every 3-months can be reduced to a CAT II severity level finding.

  8. A Standard Operating Procedure (SOP) must be available, which is approved by the facility security officer or security manager and commander/director, and the PDS approval authority. (CAT III)

  This SOP must include procedures to:

  a. Verify the alarm functionality and performance on at least a weekly basis IAW Table 5 of the CNSSI 7003.

  b. Ensure response by security personnel in the area of possible attempted penetration, within 15 minutes of discovery;

  c. Provide for inspection of the PDS to determine the cause of the alarm;

  d. Define action to be taken regarding the termination of transmission;

  e. Initiate investigation of actual intrusion attempt, etc.

  9. The PDS is not located within an Uncontrolled Access Area (UAA) and National Manager (NSA) approved encryption solutions must be employed.  (CAT I)


vuln_id: V-245736
stig_id: CS-04.02.01
title: Protected Distribution System (PDS) Construction - Visible for Inspection and Marked
severity: medium
check_text:
  Check to ensure:

  1. The PDS is visible for inspection. The Category 2 (Hardened) carrier should be installed in plain view to meet both Visual and Technical inspection requirements.

  2. The PDS is not installed above a false ceiling, below a false floor, or inside a wall unless it is clear that all portions within the wall, above the ceiling or below the floor are inspectable by means identified in the PDS approval request.

  NOTE: If the PDS cannot be installed in plain view, or is rendered un-inspectable, then the PDS must be an alarmed carrier.

  3. The PDS is marked to make it easily identifiable to the inspector. The markings should be placed at sufficient intervals to facilitate inspections, however, intervals shall not exceed 3 meters (approximately 10 feet).

  4. The PDS markings consist of tape, paint, cable tags, or any other suitable method that does not obscure or impair inspection.

  5. The PDS is not labeled as a PDS, or labeled with text that would indicate that it carries National Security Information (NSI).

  6. The markings are not red, since this color is often used to identify fire sprinkler systems, fire alarm wires, and NSI.

  7. The PDS is not painted unless using a distribution system that has a factory painted coating.


vuln_id: V-245737
stig_id: CS-04.02.02
title: Protected Distribution System (PDS) Construction - Sealed Joints
severity: medium
check_text:
  Check to ensure:

  1. All PDS seams and connectors are permanently sealed completely around all surfaces (e.g., welding (continuous or track), epoxy, fusion).

  2. When a connection consists of more than one seam (e.g., a compression couple), then all seams must be sealed.

  3. The seal provides a mechanical bond between the components of the carrier and are visible for inspection.

  4. Epoxy seals use a thick, opaque material.

  5. Couplers that are secured with a "set screw" are not used.

  6. If pull boxes are used during installation, check that the pull-box covers are secured/sealed to the pull boxes by welding or epoxy after installation.

  7. If welded, at least one weld must be applied on each side of the box and cover.

  8. If epoxy is used, it is applied between all mating surfaces continuously around the cover.

  9. Painted surfaces are treated to form a mechanically strong epoxy bond.

  10. Boxes with pre-punched knockouts are not used under any circumstances.

  NOTE:  If a pre-fabricated (Modular types such as Holocom or Wiremold) PDS is used it is also required to have all joints sealed as specified above.


vuln_id: V-245738
stig_id: CS-05.03.01
title: Protected Distribution System (PDS) Documentation - Signed Approval
severity: low
check_text:
  Validate that:

  1. The approval authority is the system Authorizing Official (AO), cognizant security office for contractors or other Department or Agency designee having Approval Authority for the installation and operation of the PDS and

  2. A documented approval of the PDS is signed and dated by the current approval authority.

  NOTE: In tactical environments mobile systems employing inter-shelter cabling need not be re-approved for each relocation if the relocation provides security comparable to that of the original approval. Otherwise, new approval must be obtained.


vuln_id: V-245739
stig_id: CS-05.03.02
title: Protected Distribution System (PDS) Documentation - Request for Approval Documentation
severity: low
check_text:
  This check concerns the documentation prepared and submitted to the PDS approval authority.  Any subsequent requests for modification of the PDS should also be available for review.  Check to ensure:

  1. The PDS documentation is complete and current. Review a copy of the initial Request for Approval of PDS, which must contain the information IAW Annex A, CNSSI 7003.

  2. Any requests for modification of the PDS approval are also available for review and contain the appropriate information.

  3. PDS are recertified when modified or when the threat level or security posture changes.

  4. PDS approval documentation and all updates are kept for the lifetime of the physical structure of the PDS.

  5. That a standard operating procedure (SOP) to ensure proper installation, maintenance, operation and inspection of the PDS is developed by the PDS owner, approved by the AO, and approved by the cognizant security authority. *The SOP must be submitted as a part of the PDS approval documentation.

  NOTES:  Applies in a tactical environment but will likely not be available in mobile field locations.  Such documentation should be available for inspection at a location where supporting headquarters staff (ISSM, SM) would logically be located. Observations and comments may be entered, even if there is no finding.


vuln_id: V-245740
stig_id: CS-06.02.01
title: Protected Distribution System (PDS) Monitoring - Daily (Visual) Checks
severity: medium
check_text:
  A PDS carrying SIPRNet cable is subject to periodic visual inspections IAW (Table 3. Visual Inspection Schedule, of CNSSI 7003).  Check to ensure:

  1. At least one daily inspection of the PDS line is conducted or more frequently if required by Table 3.

  2. A log is maintained of the PDS inspections. The log must contain the date of the inspection, the time of the inspection, the inspector's name, and the inspector's title. The log must be kept on record for a minimum of one year.

  3. Person(s) are formally appointed (in writing) to conduct the visual inspections.

  4. The person(s) appointed to accomplish the visual inspection are trained sufficiently to recognize physical changes in PDS including attempts at penetration and tampering.

  5. That visual PDS inspections as detailed in Table 3 are conducted 365 days a year.

  NOTES:

  Visual inspections are not absolutely required for portions of PDS traversing a Secret or higher CAA but may be required by the AO.

  In a tactical environment periodic visual checks are not applicable for Continuously Viewed Carriers since they are under continuous observation, 24 hours per day (including when operational).  This check for visual inspections is only applicable to tactical environments where Hardened Carriers - versus Continuously Viewed Carriers - are used.


vuln_id: V-245741
stig_id: CS-06.02.02
title: Protected Distribution System (PDS) Monitoring - Reporting Incidents
severity: medium
check_text:
  1. Check to ensure there are procedures written that cover how to handle all possible types of potential PDS incidents.

  2. Check daily and technical inspection results (logs) for evidence of discovered PDS anomalies.

  3. Ensure any incidents of tampering, penetration, or unauthorized interception were reported immediately to the PDS Approving Authority and the local security/law enforcement authority.

  4. Subject to law enforcement procedures, which take precedence, check to ensure the PDS was not used until the incident was assessed and its security status determined.

  5. If discontinued use of the PDS is or was not practical, check to ensure users of all impacted PDS were notified of the possible breach in security, and instructed that use of systems running on the PDS be limited to the greatest extent possible.

  6. Discovery of an anomaly in the PDS that is not properly reported and resolved is a finding. All discoveries must be documented and such documentation retained indefinitely -for as long as the PDS remains functional.

  NOTES:

  1. This check is applicable to tactical environments.  Incidents of possible tampering must be reported to the PDS approving authority in as expeditious a manner as possible.

  2. Even if there is no finding, in the reviewer notes provide a brief note of any reported incidents or anomalies previously noted by the site, including the date it was initially noted.


vuln_id: V-245742
stig_id: CS-06.03.01
title: Protected Distribution System (PDS) Monitoring - Technical Inspections
severity: low
check_text:
  Check to ensure:

  1. Technical inspections of PDS are conducted at least one or more times annually IAW Table 4. PDS Technical Inspection Schedule of the CNSSI 7003.

  2. Checks and results must be documented and retained on file for a minimum of one year - or longer if required by the AO.

  3. The person selected to accomplish the technical system inspection is trained to recognize changes in the technical aspects of PDS, e.g., by-pass circuitry, attachment or removal of devices or components, inappropriate or suspicious signal levels, and mechanical, TEMPEST, and RED/BLACK integrity of the PDS. If conducted by the CTTA this meets the requirement; otherwise, sufficient documented proof of training must be provided for the person conducting the inspection.

  NOTE: This check is applicable within a tactical environment in a fixed facility but not applicable in a mobile field environment.


vuln_id: V-245743
stig_id: CS-06.03.02
title: Protected Distribution System (PDS) Monitoring - Initial Inspection
severity: low
check_text:
  Check to ensure:

  1. The PDS was inspected prior to initial operation.  Documentation of the inspection and results should be available for review. This meets the following requirement from the CNSSI 7003: "The Approval Authority (AO) must ensure PDS are inspected in accordance with SECTION XI and certified prior to initial operation."

  2. The initial inspection was a technical inspection performed by a trained CTTA prior to approval of the PDS by the AO.

  3. The initial inspection documented the path of the PDS, the locations for all pull boxes, and the locations for all conduit joints at intervals less than the length of conduit segments (typically 10 feet).

  NOTES:

  1. The PDS may be documented using detailed "as-built" installation drawings or photographs. *Subsequent technical inspections can then verify the path of the PDS and the location of pull boxes and joints.

  2. When test equipment is locally available and resident expertise allows, the initial inspection should measure and record the electrical characteristics of the PDS lines to obtain a baseline electrical profile of the PDS.

  3. Such measurements may consist of signal levels, voltage levels, time domain reflectometer (TDR) recorded readings, and any other electrical measurements that may be recorded and retained. * Subsequent technical inspections may then record and compare measurements taken to the previously recorded baseline measurements to identify possible tampering attempts.

  4. This check is applicable in a tactical environment if the PDS is located within a fixed facility.  It is not applicable to field/mobile PDS.

  5. In the reviewer notes be sure to provide the date of the initial inspection, name of inspector and general description of results.


vuln_id: V-245744
stig_id: EC-01.02.01
title: Environmental IA Controls - Emergency Power Shut-Off (EPO)
severity: medium
check_text:
  Check an emergency power cut-off (EPO) switch is located inside the IT room or area near the main entrance/exit. It must be clearly labeled and have a protective cover. Per NFPA 76 and OSHA Emergency Stop Requirements the EPO shall be bright yellow with red button, an emergency push button, "e-stop" or emergency stop/disconnection is required where there is a risk of an emergency or potential unsafe condition for equipment or for the operator. The switch shall be continually operable, readily accessible, and initiated via a single human action via a mechanical latching mechanism. This requirement is only for computer centers with large server rooms and/or supporting infrastructure rooms hosting large amounts of network equipment and/or equipment such as chillers, battery backup, transformers, etc.

  NOTES: In general, a server/computer room will have raised floor space and air conditioning and host multiple servers. The requirement should not be applied to purely administrative/office space. Also, this requirement should not be applied to a tactical environment unless it is clearly an "established" fixed computer facility supporting missions in a Theater of Operations. The standards to be applied to determine applicability in a tactical environment are:
  1. The facility containing the computer room has been in operation more than one year.
  2. The facility is "fixed facility" - a hard building made from normal construction materials (wood, steel, brick, stone, mortar, etc.).


vuln_id: V-245745
stig_id: EC-02.02.01
title: Environmental IA Controls - Emergency Lighting and Exits - Properly Installed
severity: medium
check_text:
  Check that emergency lighting and exits are located in IT areas.

  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations.

  The standards to be considered for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over one year.

  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245746
stig_id: EC-02.03.01
title: Environmental IA Controls - Emergency Lighting and Exits - Documentation and Testing
severity: low
check_text:
  Review Emergency Lighting and Exit documentation and testing. Check to ensure:

  1. There are written procedures for emergency exit.

  2. Evacuation routes are posted within the facility for employee reference.

  3. The plan is rehearsed on a periodic basis.

  4. Emergency lighting is tested on a periodic basis.

  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The considerations to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over one year.
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245747
stig_id: EC-03.03.01
title: Environmental IA Controls - Voltage Control (power)
severity: low
check_text:
  Check there is an IT area voltage control unit and that it is being utilized for all key IT assets.

  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over one year.
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245748
stig_id: EC-03.02.02
title: Environmental IA Controls - Emergency Power
severity: medium
check_text:
  Check that alternate sources of power are available for key IT system assets. Specifically check that both of the following requirements are complied with:

  A short-term uninterruptible power supply is available to facilitate an orderly shutdown of the information system and transition of the information system to longer-term alternate power (if available) in the event of a primary power source loss. (CAT II)

  The need for additional short term or long term alternative power sources such as use of a secondary commercial power supply or use of one or more generators with sufficient capacity to meet the needs of the organization have been considered in the organizations Holistic Risk Assessment; when such alternative sources of power are not available. (CAT III)

  NOTES:

  1. In general rule application will be for major computing centers with raised floor space. The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. It is not necessary for the risk assessment to specifically address the need for long term alternative power if it is actually available at the site.


vuln_id: V-245749
stig_id: EC-04.03.01
title: Environmental IA Controls - Training
severity: low
check_text:
  Check training records to ensure that all required personnel have received their initial and periodic (minimum annually) environmental control training (specifically humidity/temperature).

  Ask personnel how they respond to an environmental alarm.

  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation for more than one year.

  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245750
stig_id: EC-05.03.01
title: Environmental IA Controls - Temperature
severity: low
check_text:
  Check to see if temperature controls have been installed.  Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations. Otherwise it is permissible for alarms to be used when temperatures fluctuate, requiring manual employee intervention.

  NOTES:

  1. In general such an area will be in raised floor space.  The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are:  1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. Use of alarms with manual intervention should be supported by specific assessment within the organizational holistic risk assessment.


vuln_id: V-245751
stig_id: EC-06.03.01
title: Environmental IA Controls - Humidity
severity: low
check_text:
  Check to see if humidity controls have been installed in all IT areas.  Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations.  Otherwise it is permissible for alarms to be used when humidity levels fluctuate, requiring manual employee intervention.

  NOTES:

  1. In general such an area will be in raised floor space.  The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations.  The standards to be applied for applicability in a tactical environment are:  1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. Use of alarms with manual intervention should be supported by specific assessment within the organizational holistic risk assessment.


vuln_id: V-245752
stig_id: EC-07.03.01
title: Environmental IA Controls - Fire Inspections/ Discrepancies
severity: low
check_text:
  Check fire marshal inspection reports and documentation that verifies discrepancies are addressed and corrected.

  Inspections must be conducted on at least an annual basis.

  NOTES:

  1. In general this should be applied to major IT equipment areas (generally computer rooms with raised floor space containing servers and communications equipment). The requirement should not be applied to administrative/office space.

  2. Also, this requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations.  The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  3. Even if there is no finding the reviewer should note in the report the date the last fire marshal or similar inspection was conducted with a summary of results. This information could be useful during subsequent inspections.


vuln_id: V-245753
stig_id: EC-08.03.01
title: Environmental IA Controls - Fire Detection and Suppression
severity: low
check_text:
  1. Check to ensure a fully automatic fire detection and suppression system is installed for information system areas that automatically activates when it detects heat, smoke, or particles.

  2. Check that a servicing fire department receives an automatic notification of any activation of the smoke detection or fire suppression system.

  3. Check for periodic fire detection and suppression test logs.

  4. Check the fire detection and suppression system(s) are supported by an independent or alternate (backup) energy source.

  NOTES: This check applies primarily to facilities containing concentrations of information system resources including, for example, data centers, server rooms, and mainframe computer rooms. Fire suppression and detection devices/systems include, for example, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors.


vuln_id: V-245754
stig_id: EM-01.02.01
title: TEMPEST Countermeasures
severity: medium
check_text:
  1. Determine if TEMPEST countermeasures are required based on the geographical location and classification level processed. TEMPEST considerations apply to all OCONUS locations and select CONUS locations.

  2. If required, ask to see a TEMPEST assessment. Verify the TEMPEST assessment was conducted by a Certified TEMPEST Technical Authority (CTTA).

  3. Determine through inspection and/or interview if any required TEMPEST countermeasures are implemented.

  4. TEMPEST countermeasures may or may not be feasible in a tactical environment. This can only be determined through a proper Risk Assessment, which is coordinated with a supporting CTTA for matters concerning emanations security.

  5. Where required (OCONUS in particular) check to ensure an assessment of TEMPEST risk and applicability of countermeasures is included in a risk assessment and that the supporting CTTA was consulted. This process may be conducted by the Major US Combatant Command for Theater level operations rather than by individual units or location based commands. The key element to determine if this requirement is met is that any possible risk resulting from Emanations is properly considered and documented.

  NOTES: Where TEMPEST must be considered and although there is no finding, the reviewer should note in the report if a CTTA has conducted a TEMPEST review, the date it was completed and countermeasures recommended. Further note in the report if specific consideration for TEMPEST was provided for in the site risk assessment.


vuln_id: V-245755
stig_id: EM-02.02.01
title: TEMPEST - Red/Black separation (Processors)
severity: medium
check_text:
  Check for minimum separation between any RED processor and BLACK equipment IAW the following guidance:

  A separation distance of 1 meter (39 inches) shall be provided between RED equipment and:

  1. BLACK wirelines that connect to RF transmitters; and

  2. BLACK equipment with lines that connect to RF transmitters.

  A separation distance of 30 cm (12 inches) shall be provided between RED Equipment and BLACK wirelines that directly leave the inspectable space.

  NOTES:

  1. This requirement is applicable in a tactical environment.

  2. The supporting Certified TEMPEST Technical Authority (CTTA) should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.


vuln_id: V-245756
stig_id: EM-03.02.01
title: TEMPEST - Red/Black Separation (Cables)
severity: medium
check_text:
  Check that unless separated by a metal distribution system such as conduit or enclosed cable tray, a minimum separation distance of 5 cm (2 inches) or (15 cm (6 inches) for parallel cable lengths over 30 meters (98.4 feet)) is provided between any RED wire line and BLACK wire lines that exit the inspectable space or are connected to an RF transmitter, or BLACK power lines, or a digital switch (such as a computerized telephone switch or network router) that is contained within the inspectable space.

  NOTES:

  1. This requirement is applicable in a tactical environment.

  2. The supporting CTTA should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.


vuln_id: V-245757
stig_id: FN-01.02.01
title: Foreign National System Access - Identification as FN in E-mail Address
severity: medium
check_text:
  When organizations grant foreign national access to U.S. DOD systems check to ensure foreign nationals (including those foreign nationals serving in the US military) granted e-mail privileges on DOD systems are clearly identified as such in their e-mail addresses IAW DoDI 8500.01, SUBJECT: Cybersecurity and CJCSI 6510.01F.

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to U.S. or Coalition Forces Systems.


vuln_id: V-245758
stig_id: FN-01.03.01
title: Foreign National System Access - Local Access Control Procedures
severity: low
check_text:
  1. When organizations grant foreign nationals access to U.S. DOD systems check to ensure there are written procedures to guide system administrators.

  There are numerous categories of foreign military and civilian personnel, which should be addressed, as applicable to the site or organization and include the following:

  - Foreign Liaison Officers (FLO)
  - Foreign Exchange Officers
  - REL Partners
  - Coalition Partners
  - Foreign Nationals/Local Nationals (FN/LN) employed by DOD Organizations Overseas under SOFA
  - Foreign Nationals employed by Government contractors
  - Foreign Nationals or immigrant aliens not affiliated with or representing their Country of citizenship, who may be granted a Limited Access Authorization (LAA) for access to US Classified.

  2. Reviewers must validate that local procedures adequately cover all possible foreign national encounters applicable to the site and ensure guidance is correct and follows regulatory standards.

  3. Reviewers must ensure system access request forms used clearly indicate that the applicant for systems access is a foreign national.

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US or Coalition Forces Systems.


vuln_id: V-245759
stig_id: FN-02.01.01
severity: high
title:
  Foreign National (FN) Systems Access - Local Nationals Overseas System Access -  (SIPRNet or Other Classified System or Classified Network being Reviewed)

check_text:
  Check that all local foreign nationals hired by DOD organizations overseas do not have access to classified systems and information unless:

  1. Permitted by National Disclosure Policy - AND

  2. Allowed under the applicable Status of Forces Agreement (SOFA) - AND

  3. A proper background investigation/personnel vetting/security clearance adjudication for each FN granted access has been successfully completed IAW the SOFA and all other applicable DOD guidance. Security Clearance and access levels MUST be provided ONLY to the minimum necessary for mission accomplishment.

  4. A Delegation of Disclosure Authority Letter (DDL) or similar approved certification method documenting approved access to US Classified information is available for review.

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US or Coalition Forces Systems.


vuln_id: V-245761
stig_id: FN-02.02.01
title: Foreign National (FN) Systems Access - Local Nationals Overseas System Access - (NIPRNet User)
severity: medium
check_text:
  Check that all local foreign nationals hired by DOD organizations overseas, with NIPRNet user access, are employed IAW the applicable Status of Forces Agreement (SOFA) and meet the following requirements:

  1. Access to DOD ISs is authorized only by the DOD Component head in accordance with DOD, Department of State, and ODNI disclosure guidance, as applicable.

  2. Mechanisms are in place to limit access strictly to information that has been cleared for release to the represented foreign nation, coalition, or international organization (e.g., North Atlantic Treaty Organization) in accordance with policy guidance for unclassified information such as IAW DODD 5230.20E and DODI 5230.27.

  3. The Foreign Nationals have the following successfully adjudicated checks:

  a. Host government, law enforcement and security agency checks at the city, state (province), and national level, whenever permissible by the laws of the host government.
  b. Favorable DCII checks
  c. FBI-HQ/ID (Where information exists regarding residence by the foreign national in the U.S. or Territory for one year or more since age 18).

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to Unclassified US or Coalition Forces Systems.


vuln_id: V-245762
stig_id: FN-02.02.02
title: Foreign National (FN) Systems Access - Delegation of Disclosure Authority Letter (DDL)
severity: medium
check_text:
  1. Check that a Delegation of Disclosure Authority Letter (DDL) is on hand for each assigned REL partner or other FN partner granted Limited Access to US Classified.

  NOTE: All disclosures and denials of classified military information are reported in the Foreign Disclosure and Technical Information System (FORDTIS) and it might also be possible for reviewers to request visual access to validate foreign clearance approvals at sites. However, a DDL is required for access to any US Classified information.

  2. The organization's supporting Foreign Disclosure/Contact Officer (FDO) will be the ultimate POC for this.

  TACTICAL ENVIRONMENT: This check is applicable where REL Partners or other FN allies are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245763
stig_id: FN-03.01.01
severity: high
title:
  Foreign National System Access - FN or Immigrant Aliens (not representing a foreign government or entity) System Access - Limited Access Authorization (LAA)

check_text:
  BACKGROUND INFORMATION: Compelling reasons may exist to grant access to classified information to an immigrant alien or a foreign national. Such individuals may be granted a "Limited Access Authorization" (LAA) in those rare circumstances where a non-U.S. citizen - NOT REPRESENTING A FOREIGN GOVERNMENT OR OTHER ENTITY - possesses a unique or unusual skill or expertise that is urgently needed in pursuit of a specific DOD requirement involving access to specified classified information for which a cleared or clearable U.S. citizen is not available. LAAs may be granted only at the SECRET and CONFIDENTIAL level. LAAs for TOP SECRET are prohibited. Interim access is not authorized pending approval of a LAA.

  1. Check to ensure that all non-U.S. citizens fitting the above described situation have had an LAA granted prior to being permitted access to sensitive duties, classified information and/or systems.

  2. Ensure that the information the non-U S. citizen has access to is approved for release to the persons country or countries of citizenship, in accordance with DOD Directive 5230.11.

  3. Ensure the non-U.S. citizen has been the subject of a favorably completed (within the last 5 years) and adjudicated SSBI prior to granting an LAA. If the SSBI cannot provide full investigative coverage, a polygraph examination (if there are no host country legal prohibitions) to resolve the remaining personnel security issues must be favorably completed before granting access.

  4. Ensure that if geographical, political, or medical situations prevent the full completion of the SSBI or
  prevent the polygraph examination to supplement a less than full SSBI, an LAA may be granted only with approval of the DDI(I&S).

  TACTICAL ENVIRONMENT: This check is applicable where any non-U.S. citizens (not representing a foreign Government or entity) are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245764
stig_id: FN-03.01.02
severity: high
title:
  Foreign National (FN) System Access - FN or Immigrant Aliens (not representing a foreign government or entity) with LAA Granted Uncontrolled Access

check_text:
  1. Check to ensure that personnel granted LAAs are not permitted uncontrolled access to areas where classified information is stored or discussed (safes, vaults and secure room in particular). Classified information must be maintained in a location that will be under the continuous control and supervision of an appropriately cleared U.S. citizen.

  2. Check to ensure that access to DOD information systems is properly controlled so that any FN granted an LAA has systems access only to that sensitive (CUI) or classified information to which they are specifically authorized. This check will require close coordination and consultation with a network reviewer or SME.

  TACTICAL ENVIRONMENT: This check is applicable where any non-U.S. citizens (not representing a foreign Government or entity) are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245765
stig_id: FN-04.01.01
severity: high
title:
  Foreign National (FN) Physical Access Control - Areas Containing US Only Information Systems Workstations/Monitor Screens, Equipment, Media or Documents

check_text:
  THIS REQUIREMENT PERTAINS TO CLASSIFIED ENVIRONMENTS such as Secret or higher vaults or classified open storage areas (secure rooms or SCIFs) WHERE FN partners ARE PRESENT with limited or no access to classified information /systems; in particular the SIPRNet. This is important to note, because without the FN presence in such an environment, placement of classified documents and classified removable media in safes when unattended would not normally be necessary/required.

  CHECK #1: Check to ensure all classified and sensitive documents and removable storage media containing US Only information are either under the continuous observation and control of cleared US personnel or placed in an approved GSA container (Safe) when not in use and under proper US control. (CAT I)

  The requirement in check #2 is complementary to the requirement covered in check #1. Unescorted access to areas where US Only classified equipment, documents and media are present must not be granted to any FN (regardless of clearance level) when cleared US personnel are not present to provide oversight.

  CHECK #2: Check to ensure FN access to classified open storage areas (includes vaults, secure rooms, and SCIFs) containing SIPRNet assets is permitted only during normal working hours when US personnel are present to provide oversight. (CAT I)

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed within fixed facilities in a tactical environment with access to US Systems.


vuln_id: V-245766
stig_id: FN-04.03.01
title: Foreign National (FN) Physical Access Control - (Identification Badges)
severity: low
check_text:
  Check to ensure foreign local nationals (LN) hired by DOD organizations overseas IAW the applicable SOFA are issued and wear identification/access badges that clearly distinguish them as foreign national employees. REL Partners and FN Liaison and Exchange personnel in OCONUS and CONUS locations must also be provided and wear identification/access badges that clearly distinguish them as foreign national partners.  If practical they should also be required to wear the military uniform of their host country - although FN out of uniform should not be an automatic finding. The intent is to enable US personnel to clearly distinguish between FN and US personnel.

  Following is an applicable excerpt from CJCSI 6510.01F pertaining to controlled US Only workstation spaces:
  Announce presence. If a foreign national is permitted access to controlled US work station space, the individual must be announced, must wear a badge clearly identifying him or her as a FN, and must be escorted at all times. In addition a warning light must be activated if available and screens must be covered or blanked.

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US Systems.


vuln_id: V-245768
stig_id: FN-05.02.01
title: Foreign National (FN) Administrative Controls - Written Procedures and Employee Training
severity: medium
check_text:
  Check to ensure that US employees clearly understand the differences and limitations between REL Officers, other NATO partners, Non-NATO partners and Coalition Partners. In a mixed US/FN partner environment the US personnel must know exactly what information can be shared and what cannot be shared or how to readily determine this information. For example the restrictions and cautions for partners from Belgium, Germany, France will be significantly greater relative to viewing anything on SIPRNet work stations versus the Australia, Canada, Great Britain partners. This can only be done if there are written local procedures and initial/recurring (at least annual) employee training to ensure familiarization with the rules for sharing classified and sensitive information with our partners.

  It is recommended that employees sign an acknowledgement that they understand their responsibilities for sharing information, but this is not to be required.

  This particular check should be validated by specifically checking for written procedures and training records.

  This subject can be included in the initial and annual site security awareness training but must be clearly detailed as having been properly completed.

  The effectiveness of the program can be validated by conducting random employee interviews concerning their understanding of rules covering sharing classified and sensitive information with FN partners assigned to or visiting their organization/site.

  Any one of the following three items: Lack of written procedures, lack of training, or evidence employees are not familiar with the rules for information sharing will result in a finding.

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to US Systems


vuln_id: V-245769
stig_id: FN-05.02.02
severity: medium
title:
  Foreign National (FN) Administrative Controls - Procedures for Requests to Provide Foreign Nationals System Access

check_text:
  Check to ensure there are local written procedures for when foreign national request access to U.S. systems.

  Validate the standards are correct.

  Ensure Foreign Nationals only hold IT positions authorized by regulation - primarily DOD 8570.01-M, IA Workforce Improvement Program.

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to classified or unclassified US Systems or Coalition Systems.


vuln_id: V-245770
stig_id: FN-05.03.01
title: Foreign National (FN) Administrative Controls - Contact Officer Appointment
severity: low
check_text:
  Check to ensure there is a Foreign Disclosure Officer (FDO) available or minimally that a Foreign Contact Officer has been appointed to control the activities of foreign visitors, REL Officers, FLO, and exchange personnel.

  Check that there is a formal Appointment Letter.

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to US Systems.


vuln_id: V-245771
stig_id: IA-01.03.01
title: Information Assurance - System Security Operating Procedures (SOPs)
severity: low
check_text:
  Check written SOPs covering all systems, supporting infrastructure and physical facilities. Conduct a cursory review of the SOPs and as a minimum ensure the following areas are documented:

  a. Handling of suspected system compromise or spillage
  b. Cyberspace Protection Conditions (CPCON) - formerly Information Operations Condition (INFOCON) - procedures and policies
  c. Procedures for eradication after an attack
  d. Proper password management
  e. Purging of storage media (disks, CDs, DVDs, drives, etc.) prior to turn-in or disposal
  f. Remote diagnostic and maintenance approval and procedure
  g. Out-processing and turn-in of equipment
  h. Use of screensavers/Unattended terminals
  i. Virus detection and scanning
  j. In-processing and vetting of employees for systems access (proper investigation and security clearance)
  NOTE: This requirement for on-hand SOPs should not be applied to a tactical environment, unless it is a fixed computer facility in a Theater of Operations.  The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over 1-year.
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.
  3) Procedures for field/mobile elements are still required and should be available at a supporting headquarters, either in Theater or perhaps even CONUS. These may be requested during pre-trip coordination or obtained after visiting the tactical AO.


vuln_id: V-245772
stig_id: IA-02.02.01
severity: medium
title:
  Information Assurance - COOP Plan and Testing (Not in Place for Information Technology Systems or Not Considered in the organizational Holistic Risk Assessment)

check_text:
  Check there is a written COOP plan for inspected information technology systems:

  1. If a COOP or Disaster Recovery Plan is not in place, ensure the AO has considered and accepted the risk (specifically for lack of COOP) from a Holistic Risk Assessment of the organization.

  2. Check COOP documentation to ensure the plan is tested at least annually.  Also check for discrepancies noted during the tests and if corrective action has been taken.

  3. Conduct a cursory review of the COOP to ensure it is commensurate for COOP of IT systems as detailed within the risk assessment concerning recovery times and testing requirement(s).

  NOTES:

  1. Certain large computing centers like the DISA Computing Services (DECCs) may offer COOP as a fee for service option. Since this is applicable to "customer" applications it should not be a finding attributed to the DECC. If appropriate, COOP or lack thereof if cited as a finding in this instance should be attributed to the specific customer.

  2. This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting operations within a Theater of Operations.  The standards to be applied for applicability in a tactical environment are:  1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245773
stig_id: IA-02.03.01
title: Information Assurance - COOP Plan or Testing (Incomplete)
severity: low
check_text:
  This check is for when a reviewer finds that a COOP process is well established within the inspected organization, but it does not include a minority of systems, requirements, or testing of all systems, for which the risk of having no COOP or testing was not accepted by the Authorizing official (AO) in a holistic risk assessment for the organization.

  NOTES:

  1. This finding/VUL is only applicable when some of the site/organization systems are connected to the DoDIN and do not have a COOP and/or the COOP is not tested and the risk for not having a COOP and/or documented testing is not accepted by the AO in a holistic risk assessment document.

  2. If this finding/VUL is used, IA-02.02.01 is NA.

  3. This VUL is applicable in a tactical environment if it involves a fixed facility as previously described.


vuln_id: V-245774
stig_id: IA-03.02.01
title: Information Assurance - System Security Incidents (Identifying, Reporting, and Handling)
severity: medium
check_text:
  1. Check to ensure there are written procedures for identifying, reporting, and handling systems security incidents.

  2. Check to ensure that procedures for handling system security incidents are included in both initial and annual (refresher) employee training.

  NOTE: Applies in a tactical environment. While procedures for incident handling might not be readily available in a mobile/field location, they should be established and available at a supporting fixed headquarters facility. Field units must still be informed and knowledgeable of their responsibility to report security incidents. This knowledge can be ascertained by asking field organization leadership what they would do in a spillage or similar computer security incident.


vuln_id: V-245775
stig_id: IA-05.02.01
title: Information Assurance - System Access Control Records (DD Form 2875 or equivalent)
severity: medium
check_text:
  1. Check to ensure there are written procedures for personnel who request access to a computer system.

  2. Note in the report finding details which access form is used (locally developed, service-level, or DD Form 2875).

  3. If applicable, ensure the most current version of the DD Form 2875 (System Authorization Access Request [SAAR]) is being used for all new account requests. Note: This is not a mandate to update previously processed account request forms to the most current version.

  4. Note what training is required/conducted before system access is granted.

  5. Review a sample of system access request forms to ensure the forms contain appropriate information for checking compliance with security requirements for privileged, user, Classified, and Unclassified systems access. Information required will include identification of the individual requesting access, signature dates, supervisory approval, ISSM and SM approval, investigation level and security clearance required, investigation and security clearance possessed. Ensure all appropriate Information Assurance (IA) training was completed for the systems personnel are requesting access to.

  6. Check to ensure a separate "User Agreement" also exists for both system "users" and "privileged account holders" (System Administrators). For privileged users, a signed Privileged Access Statement IAW Appendix 4 of DOD 8570.01-M, Information Assurance Workforce Improvement Program, is required.

  7. In a tactical environment, the forms used to control systems access might not be readily accessible in the field. Determine where the forms are maintained and if the location is not within reach, attempt to obtain a sample copy of a completed form via fax, email, etc. Fixed locations with assigned IA staff should have the forms available.


vuln_id: V-245776
stig_id: IA-06.02.01
title: Information Assurance - System Training and Certification/ IA Personnel
severity: medium
check_text:
  1. Check records for required training/certification of (IA) IAM/IAT personnel. In addition to the initial and recurring (annual) training requirements every system user must undergo, the IA staff such as ISSM, ISSO, SA, NSO must be part of an organizational certification program IAW DOD 8570.01-M, Workplace Improvement Program.

  2. Ensure this certification program is in place and that training/certification requirements are documented for each IA staff member, which includes current certification level: IAM (I-III) or IAT (I-III).

  TACTICAL ENVIRONMENT: In a tactical environment records should be maintained at fixed locations where IA and security staff are working. This check is not applicable to units in a mobile/field environment.


vuln_id: V-245777
stig_id: IA-06.02.02
title: Information Assurance/Cybersecurity Training for System Users
severity: medium
check_text:
  Check training records for required initial and recurring (annual) training requirements every system user must undergo in accordance with Chapter 6 of the DOD 8570.01-M, Information Assurance Workforce Improvement Program. Ensure 100 percent of initial training briefings are accomplished and at least 95 percent of employees have completed annual training. Note that while 100 percent completion of annual training is the goal, employees on extended leave, TDY, or other circumstances make this difficult to accomplish.

  All training accomplished must be documented. Anything less will be a finding.

  TACTICAL ENVIRONMENT: In a tactical environment, records should be maintained at fixed locations where IA and security staff are working. This check is not applicable to personnel in units in a mobile/field environment.


vuln_id: V-245778
stig_id: IA-07.02.01
title: Information Assurance - Accreditation Documentation
severity: medium
check_text:
  Check the accreditation package with only a cursory review to ensure the ATO/IATO are current.

  1. Check the SIPRNet/NIPRNet connection approval package. Conduct a cursory review for any traditional security issues.

  2. Ensure the approvals are current. The approvals must come from the DISN Connection Approval Office (CAO).

  TACTICAL ENVIRONMENT: The check is applicable. The ATO and associated documentation should be found in a fixed HQ location where the ISSM/ISSO are located. When possible, documentation should be requested/sought before departing on trips to tactical locations. Copies sent to the reviewer's email (NIPR or SIPR depending on classification of document) can be used to validate compliance.

  Note: If any one of the approvals is missing, this is a finding.


vuln_id: V-245781
stig_id: IA-10.02.01
severity: medium
title:
  Information Assurance - KVM or A/B Switch not listed on the NIAP U.S. Government Approved Protection Products Compliance List (PCL) for Peripheral Sharing Switches

check_text:
  1. Check all KVM or A/B switches that switch from NIPR to SIPR or other low-side to high-side systems being reviewed.

  2. Ensure switches on the most current approved NIAP Product Compliant List (PCL) are used for switching between high-side and low-side devices.

  3. Check to ensure that any unapproved switch boxes in use have specific approval for use in the SIPRNet Approval to Connect (ATC) or (IATC) from the Classified Connection Approval Office (CCAO).

  NOTE: A KVM used for switching between high (SIPRNet) and low (NIPRNet) shared devices must meet one or both of the following basic criteria:
  a. Be on the NIAP PCL AND meet any configuration requirements for the sites' IA environment as a minimum requirement to be used on the DODIN.
  b. Based on the NIAP PCL, the devices listed may be used for switching between peripheral devices across high/low (SIPR/NIPR) domains.

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245782
stig_id: IA-10.02.02
title: Information Assurance - KVM Switch (Port Separation) on CYBEX/Avocent 4 or 8 port
severity: medium
check_text:
  Validate the correct configuration of CYBEX/Avocent 4 or 8 port KVMs IAW NIAP PCL guidance. This includes physical port separation between SIPRNet and NIPRNet (high and low) connections. Because of the internal physical configuration of the CYBEX boxes, only like classification levels may be connected to adjacent ports.

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245783
stig_id: IA-10.02.03
title: Information Assurance - KVM Switch Use of Hot-Keys on SIPRNet Connected Devices
severity: medium
check_text:
  1. Check to ensure users are physically switching between devices on SIPRNet and any devices connected to an unclassified network like NIPRNet, rather than using a Hot-Key feature.

  2. Be suspicious of any KVM that is not easily reachable (within arms distance) by the keyboard operator.

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245785
stig_id: IA-11.01.01
severity: high
title:
  Information Assurance - Classified Portable Electronic Devices (PEDs) Connected to the SIPRNet must be Authorized, Compliant with NSA Guidelines, and be Configured for Data at Rest (DAR) Protection

check_text:
  1. Visually check during the walk-around to ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet).

  NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

  2. Consult with Network Reviewers and Wireless Scanners to ensure they have not detected unauthorized wireless devices.

  3. If Portable Electronic Devices (PEDs) are found connected to the SIPRNet, verify with both site security personnel, Network Reviewers and others as necessary (e.g., site ISSM) that all devices are NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

  4. Verify that SIPRNet connected PEDs comply with all requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

  TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.


vuln_id: V-245786
stig_id: IA-11.02.01
severity: medium
title:
  Information Assurance - Unauthorized Wireless Devices - Portable Electronic Devices (PEDs) Used in Classified Processing Areas without Certified TEMPEST Technical Authority (CTTA) Review and Authorizing Official (AO) Approval.

check_text:
  1. Check to ensure that unauthorized wireless devices (PEDs such as cellphones, BlackBerry devices, laptops, etc.) are not being used in areas where classified systems or machines (SIPRNet) are in use.

  2. If PED usage in classified processing areas is permitted by the site, check to ensure there is specific written AO (formerly DAA) approval and that a CTTA has assessed the environment and that any resulting recommended TEMPEST countermeasures have been implemented.

  TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.


vuln_id: V-245787
stig_id: IA-11.03.01
title: Information Assurance - Unauthorized Wireless Devices - No Formal Policy and/or Warning Signs
severity: low
check_text:
  1. Check to ensure there is a local wireless policy or SOP.

  2. During the walk-around, ensure there is appropriate signage at entrances notifying employees and visitors that wireless devices are not authorized in a classified facility.

  3. Check that wireless policy is included in initial briefings for new employees and reinforced periodically such as during annual security refresher training.

  TACTICAL ENVIRONMENT: The check is applicable to tactical locations where fixed facilities are used for classified processing.  Not applicable to mobile/field environments.


vuln_id: V-245788
stig_id: IA-12.01.01
severity: high
title:
  Information Assurance - Network Connections - Physical Protection of Network Devices such as Routers, Switches and Hubs (Connected to SIPRNet or Other Classified Networks or Systems Being Inspected)

check_text:
  CHECK 1. Check to ensure that network devices on a Classified Network (SIPRNet) such as routers, switches, and hubs are housed within an approved classified storage safe, vault, or approved open storage area (AKA: secure room), or a SCIF. (CAT I)

  Two alternatives exist for check #1 in lieu of storage in a classified (secret or higher) vault, secure room or a SCIF:

  a. Information Processing System (IPS) containers are safes designed to house operational Information Systems (IS) equipment and can be used to meet this requirement. The use of an IPS container is often a good recommendation when a deficiency is found.

  b. A second alternative is to house network equipment in a 24/7 continuously occupied room or area. When using this method of control the equipment must be under the continuous (physical) observation and control of the cleared occupants. If using this alternative the network equipment must be maintained in lockable equipment storage cabinets. This is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections. If the equipment is under continuous observation and control but not in a lockable cabinet or otherwise maintained to ensure that only Network Administrators and other(authorized) personnel have access, then it will be a CAT II finding under check #2 below.

  CHECK 2. Check also to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections, regardless if properly housed in a safe, vault or secure room (AKA: collateral classified open storage area). Lockable equipment storage cabinets may be used to meet this requirement (but only when the storage cabinets housing the network equipment is located within a vault, secure room or SCIF). (CAT II)

  CHECK 3. If other (authorized) personnel (e.g., other than assigned system/network administrators) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience. (CAT II)

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245789
stig_id: IA-12.01.02
severity: high
title:
  Information Assurance - Network Connections - Wall Jack Security on Classified Networks (SIPRNet or other Inspected Classified Network or System) Where Port Authentication Using IEEE 802.1X IS NOT Implemented

check_text:
  At sites where port authentication using 802.1X is not implemented, check during your walk around to see if all SIPRNet wall jacks are secured in the proper manner. The wall jacks can:

  1. Be located within a Secret or higher vault or Secret or higher secure room (open storage area) or a SCIF.

  2. Be under the continuous observation of a cleared individual.

  3. Be secured by a Hoffman or similar lock box with a GSA-approved three-position changeable combination padlock. Currently the ONLY lock meeting this standard is the S&G 8077 changeable combination padlock.

  *Lock boxes must also have hasps attached in such a way that they cannot be removed without force. Using rivets, welds, etc. is acceptable. Also hinges must not be exposed or be peened or welded in such a manner as to preclude removal without using detectable force. Electrical-type boxes with prepunch holes for conduit or cable cannot be used even if the holes are not removed.

  4. Be disabled at the end of each work day. This can ONLY be accomplished by a physical disconnect of the transmission cable at the classified circuit (SIPRNet) Point of Presence (PoP). The PoP must be in an appropriate Secret or higher vault, secure room, or SCIF.

  DETAILED EXPLANATION FOLLOWS:

  1. The primary and most basic requirement (IAW the Network Policy found in the Layer 2 Switch STIG - Cisco) is implementation of IEEE port authentication standard 802.1X (logical software-based port security) - regardless of the physical area or space in which the wall jacks/ports are located. TRADITIONAL SECURITY REVIEWERS MUST FIRST CHECK WITH THE NETWORK REVIEWER to determine if 802.1X has been properly implemented on SIPRNet before evaluating the physical security of SIPRNet wall jacks. * Do this early in your site visit so that wall jack physical security considerations can be properly evaluated during your site tour/walk around.

  2. Not using 802.1X based port authentication on SIPRNet is a CAT I *Network STIG" finding, separate from any traditional security considerations. However, if 802.1X is not implemented there is another software-based alternative, which is the Network STIG requirement to allow for "legacy" port security via MAC address. Several caveats go with this alternative, and this is when the physical security mitigations are required to be implemented:

   a. Use of simple port security rather than 802.1X will result in a CAT III (*Network STIG) finding (on NIPRNet or SIPRNet). While this is not a traditional security check, it is something to be aware of.

   b. If simple port security rather than 802.1X is implemented *on SIPRNet* (OR IF THERE IS ABSOLUTELY NO LOGICAL SOFTWARE-BASED PORT SECURITY), the traditional security considerations and mitigations required IAW the Access Control STIG are as follows:

   (1) If the wall jacks/drops/ports are located within spaces properly established as Secret or TS vaults or Secret or TS Secure Rooms (AKA: Collateral Classified Open Storage Areas) OR within an approved SCIF, then there is no requirement for supplemental physical security measures. Again - No supplemental physical security controls are required for SIPRNet wall jacks in these areas.

   (2) If the wall jacks are not located in Secret or higher secure room/vault/SCIF, the following physical security controls must be in place:

   (a) SIPRNet wall jacks must be secured *when not attended by persons with Secret or higher clearance* by a properly constructed lock box (Hoffman or similar commercial product or locally fabricated). The lock box must be 18-gauge steel or better and have no exposed or removable hinges (internal hinges are ideal). If used, external hinge pins must be peened, welded, etc. so they cannot be removed without evidence of forced removal. Hasp hardware must be riveted to the box or otherwise installed so that removal will require physical breaking of the box or hasp, thereby leaving evidence of actual or attempted entry. No pre-punch (knock-out) holes are allowed in the box. The lock box must be secured with a 3-position high security combination padlock (IAW the CNSSI 7003 standard for PDS "Pull Boxes"). The S&G 8077 combination padlock is the ONLY existing combo padlock meeting this standard. See the DOD Lock Program site for details:

  https://portal.navfac.navy.mil/portal/page/portal/navfac/navfac_ww_pp/navfac_nfesc_pp/locks/CM_LOCKS/CL_PADLOCK/TAB_PADLOCK_PROD

   (b) If lock boxes are not used the alternative is to physically disconnect the hot SIPRNet transmission lines at the SIPRNet Point of Presence (PoP) after normal duty hours. The PoP must be located within a proper Secret or higher secure room or vault or SCIF.

  NOTE 1: To reiterate the basic requirement: If IEEE 802.1X is properly implemented at the switch to authenticate devices *with clients (such as user work stations)* no additional supplemental physical security controls are required for the wall jacks. VERIFICATION FOR 802.1X IMPLEMENTATION MUST BE COORDINATED WITH THE NETWORK REVIEWER.

  NOTE 2: Regardless of Port Authentication using IEEE 802.1X, *clientless devices (such as printers, scanners or multi-functional devices (MFD)* cannot be authenticated - but this should not cause an issue with needing supplemental physical controls (lock box or disconnect at PoP). The reason is because clientless devices like these that are connected to SIPRNet should "normally" be maintained in a Secret/TS secure room or vault or SCIF and therefore would not require supplemental physical security of the wall jacks. Otherwise, MFD wall jacks must be protected by lock boxes or physical disconnect at the PoP after normal duty hours. Additional physical security measures or procedures for protection of classified MFD hard drives, residual images and printed materials will also be required, but these considerations are addressed elsewhere on the checklist.

  NOTE 3: Do not confuse the STIG wall jack lock box requirement with the CNSSI 7003 lock box requirement on the physical end point (Termination Boxes) of a Protected Distribution System (PDS). The reference for PDS is the CNSSI 7003, not the Access Control STIG. The requirements for PDS (pull-boxes, Access Points or Termination Boxes) and wall jack (lock boxes) are totally separate and unique, although it is possible to find the end of a PDS terminating in a lock box - that ALSO fulfills the requirement for protection of a wall jack where 802.1X is not implemented.

  NOTE 4: If there is no "legacy" MAC port security in place there will be a CAT I port security finding written by the Network reviewer. If the traditional security reviewer also finds a CAT I finding for lack of physical security protective measures there is a CCRI scoring over ride that will decrease the OVERALL CCRI score. So where there is absolutely no logical or physical port/wall jack security in place - the result is very severe in terms of the CCRI score. Traditional Security reviewers, Network Reviewers (and Team Leads) need to be aware of this because of its significance to the site being reviewed.

  NOTE 5: TACTICAL ENVIRONMENT APPLICABILITY: The check is applicable for fixed facility tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245790
stig_id: IA-12.02.01
severity: medium
title:
  Information Assurance - Network Connections - Physical Protection of Unclassified (NIPRNet) Network Devices such as Routers, Switches and Hubs

check_text:
  1. Check that ALL network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs are secured in a locked communications closet/room OR secured in a locked equipment cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM). The intent is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections.

  2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.

  3. Ensure the locked room or cabinet cannot be easily accessed without forcible entry. Also ensure that proper key control procedures are used for ALL keys associated with both communication room doors and/or equipment cabinet doors.

  4. ANY discrepancies with the above guidelines will result in a finding.

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245791
stig_id: ID-01.02.01
title: Industrial Security - DD Form 254
severity: medium
check_text:
  1. Check there are DD Forms 254 available for all classified contracts.

  NOTE: These forms may be held by the site contracting officials but should be available to the site security manager and information security manager for review.

  2. Conduct a cursory review of the DD 254 to ensure all security requirements are properly detailed on the form, especially with regard to Information Assurance (i.e., IT Position level designation) in addition to security clearance, training and certification requirements.

  NOTE: Applicable to tactical environments if there are contractor personnel performing classified work. This form will likely only be found at fixed locations rather than field locations. While the DD 254 may not be available on site or even in Theater, the completed document's location should be identified and if possible a scanned and emailed copy requested for review. This will likely only be able to occur via SIPRNet email because some of these forms contain classified information, while all others are only FOUO.


vuln_id: V-245792
stig_id: ID-02.03.01
title: Industrial Security - Contractor Visit Authorization Letters (VALs)
severity: low
check_text:
  1. Check with the security manager or personnel security specialists to ensure there are written procedures for contractors visiting government sites.

  2. Ask to see copies of the site VALs and/or determine site VAL process based on the processing of contractors on your inspection team.

  3. Ensure all government facilities have a VAL on file for all contractors visiting the site, including permanent party contractors.

  NOTES:

  1. DISS should and will likely be used for most short-term "visitor" VALs; however, in addition to DISS the VAL may also be passed via hard copy or electronically using email (mail, fax, email) for "assigned" contractor employees. This is because DISS is by design intended for short-term visits, whereas contractor "employee" VALs should require additional information (such as contract number, COR identification, etc.) that cannot be input or passed via DISS. Lack of a hard-copy VAL alone for assigned contractor employees at a site will not necessarily be cause for a finding if a VAL in DISS is available. Reviewers must use discretion when evaluating if the lack of hard-copy VAL has caused any substantive confusion over the company Facility Clearance Level (FCL), individual contract employee security clearance levels, IT position assignments based on job descriptions (found in applicable Statements of Work [SOW] and/or DD 254), etc. when deciding if a finding is warranted. For instance, an individual employee's DISS access might indicate they have TS clearance - but the FCL for the company is only at the Secret level and/or the contract only allows for up to Secret access. If the site is allowing access to TS for this individual, the lack of a hard-copy VAL could be cited as a finding, in addition to any other related findings for this discovery.

  2. Applies in a tactical environment if contract personnel visit or are assigned.

  3. Reviewers should be sure to note in the findings report if the finding concerns DISS issues for short-term contractor visitors or if it concerns "hard-copy" VALs for assigned contractor employees.


vuln_id: V-245793
stig_id: ID-03.02.01
title: Industrial Security - Contract Guard Vetting
severity: medium
check_text:
  Check to ensure:

  1. Contract guards have a minimum favorable Tier 1 (T1) background investigation (formerly National Agency Check (NAC)) prior to DoD facility assignment or an appropriate level of security clearance if required by the DD 254 and classified duties performed.

  2. If classified work is not required check to ensure security specifications are contained within the contract documentation (Statement of Work (SOW) or other appropriate documentation) for T1/NAC and any other security requirements not involving access to classified.

  3. That contract guards actually have current investigations for the position level of trust and/or security clearance requirements.

  NOTES:

  1. Fully applicable in a tactical environment if contract guards are employed.

  2. This check does not "necessarily" apply to base police/gate guards - only to the guards employed specifically to protect "inspected site" assets. If the host installation employs contract guards to assist or directly protect "inspected site" assets then the requirements of this requirement will apply.


vuln_id: V-245794
stig_id: IS-01.02.01
title: Information Security (INFOSEC) - Safe/Vault/Secure Room Management
severity: medium
check_text:
  Check all safes, vaults and/or secure rooms (*only those containing DoDIN assets) for proper management practices:

  1. Ensure only GSA-approved security containers are being utilized. GSA-approved security containers and vault doors must have a label indicating "General Services Administration Approved Security Container," affixed to the front of the container. Usually this is on the control or the top drawer of safes.

  2. Ensure combinations are changed as required. This is recorded on the applicable SF 700 form and must be done: When placed in service, When someone with knowledge of the combination departs (unless other sufficient controls exist to prevent that individual's access to the lock), When compromise of the combination is suspected, or When taken out of service,  built-in combination locks shall be reset to the standard combination of 50-25-50.

  3. Ensure forms SF 700, Security Container Information are properly completed for each safe, vault and secure room used to store classified DISN assets. The SF 700 is a two-part form consisting of an envelope with a tear-off tab and cover sheet. The cover sheet and face of the envelope (Part 1 of the form) provide space for information about the activity, container, type of lock, and who to contact if the container is left open. Required checks follow. Ensure the SF 700:

    a. Shows the location of the door or container.

    b. Reflects the names, home addresses, and home telephone numbers of the individuals having knowledge of the combination who are to be contacted in the event that the vault, secure room, or container is found open and unattended.

    c. Part 1 of SF 700 is not classified, but contains personally identifiable information (PII) that shall be protected by sealing Part 1 in an opaque envelope (not provided as part of the SF 700) conspicuously marked "Security Container Information" and stored in accordance with SF 700 instructions. NOTE: If the information must be accessed during non-duty hours and a new opaque envelope is not available to replace the opened one, the original envelope should be temporarily resealed, to the extent possible, until Part 1 can be placed in a new envelope the next working day.

    d. After the cover sheet (Part 1) is filled out and sealed in an opaque envelope, attach it to the inside of the control drawer or on the inside face of the vault or secure room door, with either tape or a magnetically-attached holder.

    e. The tear-off tab (Part 2) with the combination record is placed in the envelope provided with the form, sealed, properly marked with the classification level and stored by the security manager in another approved classified container.

  4. Ensure forms SF 702, Security Container Check Sheet are properly completed for each safe, vault and secure room used to store classified DISN assets. Following are required checks for the SF 702 form. Ensure:

    a. It provides a record of the names and times that persons have opened, closed or checked a particular container (safe, vault or secure room) that holds classified information.

    b. It is properly annotated to reflect each opening and closing of the container.

    c. It is properly annotated to reflect (at least) daily checks of ALL containers - whenever an area housing the containers is entered/occupied - EVEN IF THE CONTAINER IS NOT OPENED. If on weekends or holidays the area housing the container is not occupied the SF 702 would not require annotation; however, in the event the area is accessed for even a short period of time, the SF 702 forms for each container in the area should be annotated to reflect the container was checked. Annotation of the SF 702 forms should be conducted IN ADDITION TO the annotation of SF 701 forms reflecting end-of-day checks.

  NOTE: If CC/S/A INFOSEC implementing instructions contain specific guidance in contradiction to the above DoDIN SF 702 requirements/checks then the CC/S/A guidance may be followed. Failure to comply with either the above guidance or CC/S/A documented guidance will result in a finding of non-compliance.

  5. Ensure container repairs are conducted correctly IAW FED-STD-809. Details are at the DoD Lock Program WEB Portal for Drawer head Replacement.

  TACTICAL ENVIRONMENT: This check is applicable where safes, vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245795
stig_id: IS-02.01.01
severity: high
title:
  Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Door Combination Lock  Meeting Federal Specification FF-L-2740

check_text:
  *This check is specifically for vaults and secure rooms or open storage areas containing inspectable SIPRNet assets*:

  Check the primary ingress/egress door to ensure a proper combination lock is installed and is being used. Door must be equipped with a built-in GSA-approved combination lock meeting Federal Specification FF-L-2740, such as the X07, X09, or Kaba Mas X-10 locks.

  NOTE: The use of automated entry control systems (AECS) is encouraged to control access to secure room space during working hours; however, electrically actuated locks (e.g., cypher and magnetic access card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF-L-2740.

  TACTICAL ENVIRONMENT: This check is applicable where vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245796
stig_id: IS-02.01.02
title: Information Security (INFOSEC) - Secure Room Storage Standards - Door Construction
severity: high
check_text:
  Check all secure room doors (*containing inspectable SIPRNet assets) as follows:

  1. The doors to the room (primary and secondary) shall be substantially constructed of wood or metal. (CAT II)

  2. For outswing doors, hinge-side protection shall be provided by making hinge pins nonremovable (i.e. spot welding) or by using hinges with interlocking leaves that prevent removal. There are certain hinge pins made with internal locking pins or locking flanges and are acceptable if they cannot be removed. (CAT I)

  3. Secondary (emergency exit only) doors other than those secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door.  IAW Unified Facilities Criteria (UFC) UFC 4-026-01, 4 Mar 2020, section 5-5.5.  All non-entry doors to the defense layer must present a blank, flush surface to the outside and have internal locking or bolting mechanisms to reduce vulnerability to attack (to the secure room) (CAT I)

  4. Secondary doors (doors other than those secured with locks meeting FF-L-2740) shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door. These deadbolt locks shall be secured when the combination lock on the primary door is spun. (CAT I)

  TACTICAL ENVIRONMENT: This check is applicable where  secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245797
stig_id: IS-02.01.03
severity: high
title:
  Information Security (INFOSEC) - Secure Room Storage Standards  Wall and Ceiling Structural Integrity (AKA: True Floor to True Ceiling Connection)

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet assets) check walls are true floor to true ceiling.  Walls shall be extended to the true ceiling and attached with permanent construction materials.  As an alternative true walls and true ceilings can be connected with steel mesh or 18-gauge expanded steel screen. Likewise, walls below raised floor (computer room) space may be connected to the true floor with steel mesh or 18-gauge expanded steel screen.

  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245798
stig_id: IS-02.01.04
severity: high
title:
  Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Openings in Perimeter Exceeding 96 Square Inches

check_text:
  For vaults, secure rooms or areas (*containing inspectable SIPRNet assets): Utility openings such as ducts and vents and any holes or passages through the secure room perimeter will be kept at less than a man-passable (96 square inches) opening. Openings larger than 96 square inches will be hardened in accordance with Military Handbook 1013/1A.

  TACTICAL ENVIRONMENT:  This check is applicable where secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245799
stig_id: IS-02.01.05
severity: high
title:
  Information Security (INFOSEC) - Secure Room Storage Standards  Windows - Accessible from the Ground Hardened Against Forced Entry and Shielded from Exterior Viewing of Classified Materials Contained within the Area.

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet assets) check windows as follows:

  1. Window placement in secure rooms should be minimal.  Ideally, there should be no large or entirely glass walls; although this will not automatically result in a finding if the glass is hardened to the same degree as the contiguous walls and properly obscured from outside viewing. Where windows are located on the exterior of secure rooms (AKA: collateral classified open storage areas) the vulnerabilities, existing and potential additional countermeasures, and residual risk associated with the windows must be considered in an assessment of risk for the secure room. NOTE that a risk assessment is required for all secure rooms IAW DoD Manual 5200.01, Volume 3, Enclosure 3, paragraph 4.

  2.  Windows that are less than 18 feet above the ground measured from the bottom of the window, or are easily accessible by means of objects directly beneath the windows shall be constructed from or covered with materials that provide protection from forced entry. The protection provided to the windows need be no stronger than the strength of the contiguous walls.  Hurricane rated windows, ballistic proof windows, non-opening double or triple pane windows, etc. should be considered acceptable as equivalent to contiguous walls.  Welded steel bars attached to the structure surrounding the window may also be used for hardening windows that are not as strong as the contiguous walls (e.g. single pane glass).

  3.  As an alternative to hardening windows (that are not as strong as the contiguous walls) with welded steel bars; secure rooms that are located within an access controlled installation or compound may eliminate the requirement for forced entry protection if the following countermeasures are taken:   All windows within 18 feet of ground level, that are capable of being opened from inside the protected space shall make the windows inoperable either by permanently sealing them or equipping them on the inside with a locking mechanism and also protecting them by an IDS, either independently (e.g. glass break sensors) or by motion detection sensors in the space.

  4. Windows will be covered with curtains, screens or otherwise limit visibility into the secure room space when classified equipment, documents or media can be viewed from outside the area.

  TACTICAL ENVIRONMENT:  This check is applicable where secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245800
stig_id: IS-02.01.06
title: Information Security (INFOSEC) - Vault Storage/Construction Standards
severity: high
check_text:
  For vaults containing inspectable SIPRNet assets check with supporting Facility Engineers to ensure it is properly constructed IAW one of the following two specifications:

  1. As a Class A vault (concrete poured-in-place) built to Federal Standard (FED STD) 832 and specifically check/validate the following:

  a. Floor and Walls. Eight inches of reinforced concrete. Walls are to extend to the underside of the roof slab above.

  b. Roof/True Ceiling. Monolithic reinforced-concrete slab of thickness to be determined by structural requirements, but not less than the floors and walls.

  c. "True" vaults must have a Class 5 Vault Door and Frame and be fitted with an FF-L-2740 combination lock. The vault door and frame unit must conform to Federal Specification AA-D-600 Class 5 vault door with lock meeting Federal Specification FF-L-2740. Ensure it is not an armory vault door, which should have a GSA label (silver with red letters) stating that it is a "GSA Approved Armory Vault Door". AN ARMORY DOOR IS NOT APPROVED FOR CLASSIFIED STORAGE - AA&E STORAGE ONLY. The "proper" security vault door label reads "GSA Approved Security Vault Door" (label also silver with red letters). The difference between the two doors is that armory vault doors are fitted with Federal Specification FF-L-2937 mechanical combination locks. Facility Engineer (FE) construction certificates or other documentation should be requested to ensure construction standards are met. Often these certificates are posted on the inside of the vault near the door.

  2. As a Class B vault (GSA-approved modular vault) meeting Federal Specification AA-V-2737, Modular Vault Systems, April 25, 1990, with Amendment 2, October 30, 2006.

  NOTE:
  Here again, normally FE certification documentation will be posted within the vault, but it is OK if such documentation is on file elsewhere at the site.

  The DOD Lock Program Web Portal provides detailed specifications for vaults and ordering instructions for doors. Available through DOD Lock Program at:

  https://exwc.navfac.navy.mil/DoD-Lock-Program/

  TACTICAL ENVIRONMENT: This check is applicable where vaults are used to protect classified materials or systems in a tactical environment.


vuln_id: V-245801
stig_id: IS-02.01.07
title: Information Security (INFOSEC) - Secure Room Storage Standards - Intrusion Detection System (IDS)
severity: high
check_text:
  Background Details:

  Except for storage in a GSA-approved container (AKA: safe) or a vault built to FED STD 832, one of the following supplemental controls is required for secure rooms or areas containing SIPRNet (secret) assets, provided the CC/S/A senior agency official determines in writing that security-in-depth exists:

  (1) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or
  (2) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

  IMPORTANT NOTE:  Random checks not exceeding 4-hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment.

  Prior to the installation of an IDS, the site shall perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures,  the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure room as an alternative to IDS.

  Random checks and risk analysis are each covered as separate checks elsewhere in this checklist.

  This particular check for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency official in writing.

  In summary this check is to validate an IDS is being used AND that it is supported by a valid risk assessment AND  security-in-depth approved by the senior agency official in writing.

  Checks:

  1. Check to ensure that all secure rooms/classified open storage areas that afford access to classified SIPRNet equipment (servers, routers, switches, comm equipment, work stations, DASD, etc...) are protected by an Intrusion Detection System (IDS) *unless continually occupied. (CAT I)

  2. Where IDS is being used check to ensure that its use is supported by both a RISK ASSESSMENT and a SECURITY-IN-DEPTH DETERMINATION * (Security-In-Depth Determination must IN WRITING by the C/S/A senior agency (security) official) that specifically addresses the secure room or open storage space. (CAT II)

  TACTICAL ENVIRONMENT:  This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245802
stig_id: IS-02.01.08
severity: high
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Balanced Magnetic Switch (BMS) on Perimeter Doors

check_text:
  Where an IDS is used in lieu of 4-hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets, each perimeter door (primary and secondary) shall be protected by a balanced magnetic switch (BMS) that meets the standards of UL 634.

  NOTE:  Ensure the alarm contact is an actual BMS, which is defined as a "Triple Biased" alarm contact.  Introduction of a foreign magnet by an intruder in an attempt to defeat the BMS will result in an alarm being sent.

  If used, Simple and Dual Biased contacts are not BMS and will result in a CAT II finding.

  No alarm contacts on all doors is a CAT I finding.

  TACTICAL ENVIRONMENT:  This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245803
stig_id: IS-02.01.09
title: Information Security (INFOSEC) - Secure Room Storage Standards - Interior Motion Detection
severity: high
check_text:
  The following applies where IDS is used in lieu of 4-hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets:

  Checks:
  1.  Check at sites where IDS is being used and:

      -  There is NO RISK ASSESSMENT approved by the Component Authorizing Official (AO) or

      -  The risk assessment does not specifically provide a detailed evaluation of the need for motion sensor employment, including a thorough assessment of the most effective and efficient methods for employment of motion detection and/or

      -  There is NO SECURITY-IN-DEPTH DETERMINATION *IN WRITING by the CC/S/A Senior Agency Official (SAO)(Security/INFOSEC) that considers factors contained in the risk assessment and specifically focuses on the collateral classified secure room/open storage space:

  Check to ensure that secure rooms or areas where classified SIPRNet equipment and/or associated media is stored in the open is protected with interior motion detection sensors; e.g., ultrasonic and passive infrared, during times when the specific area containing the classified material is closed or not under continuous observation and control by a cleared employee.

  Use of dual technology sensors is authorized when one technology transmits an alarm condition independently from the other technology.  A failed detector shall cause an immediate and continuous alarm condition.

  Employment of motion detectors need not cover 100% of the entire secure room space (although that is recommended) but shall minimally (directly) cover any SIPRNet assets (equipment or media) that are accessible (not stored within a GSA approved container (safe)) within the secure room or area.

  2. Where a proper risk assessment signed by the AO, which specifically considers both the number and employment (positioning) of motion sensors in the secure room space and a supporting Security-in-Depth Determination signed by the SAO are both available:

  Check that motion sensors are either employed to directly cover all areas within the secure room containing SIPRNet assets OR that motion sensors are employed in the secure room space as specifically detailed in the risk assessment.

  NOTE:  Unless adequately detailed and justified in the risk assessment, motion detectors placed to cover only doors that are protected with BMS alarm contacts are not sufficient to meet this requirement/check.

  TACTICAL ENVIRONMENT:  This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245804
stig_id: IS-02.01.10
severity: high
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Four (4) Hour Random Checks in Lieu of Using Intrusion Detection System (IDS)

check_text:
  Background:

  This check is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet assets) - instead of IDS.

  Checks:

  Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas - as an alternative to IDS.

  Check #2. The frequency of random checks shall not exceed 4-hours when the secure area space is not attended.

  Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level.

  Check #4.  Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured.  Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter.

  Check #5.  Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded.

  Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks.  Completed checklists should be maintained on-hand for at least 90-days as an audit trail or indefinitely if discrepancies were noted during any checks.

  It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the C/S/A senior security official.  Otherwise this is a finding.

  Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.

  This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used.

  In summary this check must validate that random checks not exceeding 4-hours are being used AND that it is supported by a valid risk assessment along with security-in-depth countermeasures.

  TACTICAL ENVIRONMENT:  This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245805
stig_id: IS-02.01.11
title: Vault/Secure Room Storage Standards - IDS Transmission Line Security
severity: high
check_text:
  Explanation of requirement:

  Transmission lines used to carry IDS sensor alarm signals between secure rooms or areas containing SIPRNet assets and IDS monitoring equipment, shall have line supervision.

  If all portions of an IDS transmission line (protecting SIPRNet assets) are run within secret or higher secure area space or secret or higher controlled access area (CAA) spaces it will not require line supervision.

  Check:

  Check that Class I or Class II line supervision is being used IAW DoD Manual 5200.01, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level.

  In summary, if portions of the transmission line run through spaces or areas where unescorted access is not controlled to at least the Secret level -  it will require line supervision.

  The check and verification of line supervision can be obtained by viewing IDS specifications from the vendor, or by conducting a controlled test of a transmission line/signal.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245806
stig_id: IS-02.01.12
severity: high
title:
  Vault/Secure Room Storage Standards - IDS Access/Secure Control Units Must be Located within the Secure Room Space

check_text:
  Requirement Explanation:

  Alarm sensor control units must be located inside the secure area and should be located near the primary entrance for ease of accessing and securing alarm sensors in the space.

  Only assigned personnel with proper security clearances and need-to-know should initiate changes in access and secure status.

  Check:

  Check to ensure that no capability exists to allow changing the access/secure status of the IDS from a location outside the protected area (secure room or vault).

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245807
stig_id: IS-02.01.13
title: Information Security (IS) - Continuous Operations Facility: Access Control Monitoring Methods
severity: high
check_text:
  Unless otherwise indicated all the paragraph citations preceding each check are from DoD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DoD Information Security Program: Protection of Classified Information.

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #1 is to be used when an Automated Entry Control System (AECS) Card Reader with Biometrics or Personal Identification Number (PIN) is the primary means of access control to the Continuous Operations Facility:

  Method 1/Check #1.  Appendix to Enclosure 3, para 3.a.(2)(a); para 3.a.(2)(b); para 3.a.(3); para 3.a.(4) -- Check to ensure an Automated Entry Control System (AECS) is used that incorporates a coded ID card or badge PLUS either a PIN or Biometrics on both the primary entrance and all secondary doors that may be used for continuous or intermittent access to the secure room space.  (CAT I)

  Method 1/Check #2.  Appendix to Enclosure 3, para 2.d.(6); para 2.f.(2)& para 3.a. -- Check to ensure the AECS is controlled and monitored at a continuously manned central monitoring station. (CAT I)

  Method 1/Check #3.  Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; -- If there is no IDS employed (*which must be based on a documented risk assessment) on doors or other man-passable openings: Check to ensure the 24/7 secure rooms or collateral secret open storage areas (containing SIPRNet equipment) are continuously occupied by at least one properly cleared employee. (CAT I)

  Method 1/Check #4.  Appendix to Enclosure 3, para 2.e(6) -- If there is no Intrusion Detection System (IDS) employed in the Continuous Operations Facility:  Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA).  If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 1/Check #5.  Enclosure 3, para 3.b.(3)(a) & (b)-- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct  continuous observation and control of area occupants (CLEARED EMPLOYEES):  Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  The following set of 6 checks for Continuous Operations Access Control Monitoring Method #2  is to be used Access is Continuously Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors are NOT visible - is the primary means of access control to the Continuous Operations Facility:

  Method 2/Check #1.  Appendix to Enclosure 3, para 2.e(6) - When cleared occupants cannot directly and continuously observe all potential entrances into the room, check to ensure an open door alerting system is used to alert occupants of the 24/7 continuous operations. The alerting system MUST cover all access points that cannot be observed by occupants including the primary entrance and all secondary doors that could be used for continuous or intermittent access. (CAT I)

  Method 2/Check #2.  Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2 -- Check to ensure the 24/7 Continuous Operations Facility is "continuously occupied" by at least one properly cleared employee. (CAT I)

  Method 2/Check #3.  Appendix to Enclosure 3, para 3.a.(2)(a); para 3.a.(2)(b); para 3.a.(3); para 3.a.(4)-- On those doors not visible to cleared occupants: Check to ensure that an Automated Entry Control System (AECS) is used that incorporates both a coded ID card or badge plus either a PIN or Biometrics.  This requirement is for all doors that are not continuously visible including the primary entrance and all secondary doors that may be used for continuous or intermittent access.  (CAT I)

  Method 2/Check #4.  Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible to cleared occupants are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c...  (CAT I)

  Method 2/Check #5.  Appendix to Enclosure 3, para 2.e(6) -- If there is no IDS employed in the Continuous Operations Facility:  Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA).  If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 2/Check #6.  Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct  continuous observation and control of area occupants (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXXX

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #3  is to be used when Access is Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility and all doors are visible - is the primary means of access control to the Continuous Operations Facility:

  Method 3/Check #1. Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a -- Check to ensure that cleared employees who work in the space just inside the Continuous Operations Facility have continuous visual observation of all primary entrance and all secondary doors that may be used for continuous or intermittent access. (CAT I)

  Method 3/Check #2. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; -- -- Check to ensure the 24/7 Continuous Operations Facility is "continuously occupied" by at least one properly cleared employee. (CAT I)

  Method 3/Check #3. Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible to cleared occupants are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c...  (CAT I)

  Method 3/Check #4. Appendix to Enclosure 3, para 2.e(6)-- If there is no IDS employed in the Continuous Operations Facility:  Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA).  If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 3/Check #5. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct  continuous observation and control of area occupants (CLEARED EMPLOYEES):  Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXX

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #4 is to be used when Access is Monitored by Cleared Employees Directly Outside the Continuous Operations Facility - all doors MUST BE visible - is the primary means of access control to the Continuous Operations Facility:

  Method 4/Check #1.  Appendix to Enclosure 3, para 3.a. - Check to ensure that cleared employees who work in the space just outside the Continuous Operations Facility (containing SIPRNet equipment) are providing continuous visual observation of the primary entrance and all secondary doors that may be used for continuous or intermittent access. They must be continuously present with no gaps in coverage. (CAT I)

  Method 4/Check #2. Appendix to Enclosure 3, para 3.a. - Check to ensure that cleared employees working outside the Continuous Operations Facility are located directly adjacent to a particular door or set of doors being monitored and are informed concerning their specific responsibilities for monitoring door security/access control. Written procedures must be available to substantiate this. (CAT II)

  Method 4/Check #3. Appendix to Enclosure 3, para 3.a. & para 3.c.-- Check to ensure doors that are continuously visible and controlled by cleared employees directly outside the Continuous Operations Facility are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 4/Check #4.  Appendix to Enclosure 3, para 2.e(6) - If there is no IDS employed in the Continuous Operations Facility:  Check to ensure that a duress device is available for cleared employees monitoring door access from outside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA).  If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 4/Check #5.  Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of occupants within the facility (CLEARED EMPLOYEES):  Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXX

  The following set of 6 checks for Continuous Operations Access Control Monitoring Method #5 is to be used when Access is Monitored by Closed Circuit Television (CCTV) reporting to a Central Monitoring Station Staffed 24/7 by cleared Guards or Other cleared Security Professionals - all doors MUST HAVE CCTV cameras - is the primary means of access control to the Continuous Operations Facility:

  Method 5/Check #1. Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a.; para 2.d.(6)& para 2.f.(2) - Check to ensure ALL doors (primary and secondary) are actively monitored via CCTV by cleared guards at a central monitoring facility. (CAT I)

  Method 5/Check #2.  Appendix to Enclosure 3, 3.a.(7) - Check to ensure that CCTV activity is recorded and maintained on file for a minimum of 90 days. (CAT II)

  Method 5/Check #3.  Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a. & para 2.f.(2) - Check to ensure that guards are continuously present at the monitoring location and  informed concerning their specific responsibilities for monitoring and responding to potential unauthorized attempts to breach the Continuous Operations Facility. Written procedures must be available.  (CAT I)

  Method 5/Check #4. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; - Check to ensure the 24/7 Continuous Operations Facilities are continuously occupied by at least one properly cleared employee. (CAT I)

  Method 5/Check #5. Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible and controlled by CCTV from directly outside the Continuous Operations Facility are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 5/Check #6. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of occupants within the facility (CLEARED EMPLOYEES):  Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  TACTICAL ENVIRONMENT:  The 5 sets of monitoring methods and associated checks are applicable where Continuous Operations Facilities are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245808
stig_id: IS-02.01.14
severity: high
title:
  Vault/Secure Room Storage Standards - Access Control During Working Hours Using Visual Control OR Automated Entry Control System (AECS) with PIN / Biometrics

check_text:
  Background Information and Requirements Summary:

  1.  The FF-L-2740 combination lock securing the primary access door for vaults and secure rooms (AKA: collateral classified open storage areas) may be opened at the beginning of normal duty hours and left unlocked for frequent employee access only if the entrance is properly monitored and controlled.  The combination lock will be secured at the end of normal duty hours and interior motion alarms (if used) activated.

  2.  Entrances to vaults, secure rooms or collateral classified open storage areas must be under visual control at all times during duty hours to prevent entry by unauthorized personnel.

  3.  An automated access control system (AECS) may be used to monitor and control admittance during working hours instead of visual control, if it consists of a swipe or proximity coded card and reader, supplemented by the use of a Personal Identification Number (PIN) or by use of Biometric readers (fingerprints, retina scanner, etc.).   Additionally, the secure room or classified storage area must be occupied by cleared employees OR under direct visual control from just outside the room or area.  Use of an Automated Entry Control System (AECS) alone may not be used to meet this standard.  Use of an AECS to control and monitor access requires the room or area be occupied by at least one properly cleared person.

  4.  Visual monitoring or control of secure room access points may be accomplished by several methods (e.g., employee work station, guard, "continuously monitored" CCTV).  Employee monitoring may be conducted by cleared employees within the secure room space, who can observe all entrances or employees located just outside the secure room adjacent to an entrance may also "actively" monitor access. If CCTV is used to monitor, the CCTV cameras must cover all potential entrances and send real time images back to a continuously manned monitoring station.

  5.  Regardless of the visual method used to monitor daytime access, a locking system for access control must still be used on the entrance to the secure area.  The use of automated entry control systems,(AECS with coded ID cards or badges) is encouraged.  Supplementing the coded (swipe or proximity) cards or badges with a PIN or biometrics is not required if the entrances are properly monitored by visual means.

  6.  Access to secure areas may also be controlled by electric, mechanical or electro-mechanical access control devices to limit access during duty hours, but only if the entrance is also under continuous visual control.

  7.  IMPORTANT NOTE: Electrically actuated locks (e.g., cypher, proximity card and magnetic strip card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF-L-2740.

  CHECKS:

  *If f visual control methods are the primary means to monitor and control access during duty hours, use the following three checks to evaluate:

  Check #1.  Check to ensure that all possible primary or secondary entrances to vaults or secure rooms are continuously monitored by cleared employees or guards (inside or outside the room or area) or by CCTV, whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.     (CAT I)

  Check #2.  Check to ensure that if CCTV is used it sends real time images to a continuously manned monitoring station.  (CAT I)

  Check #3.  If CCTV is used to visually monitor the secure room or area and / or guards or other personnel are not physically controlling access: Check to ensure that access to a continuously (visually) monitored vault, secure room or collateral classified open storage area is controlled either by an Automated Entry Control System (AECS) using coded cards or badges (biometrics or PIN are not required) or by electric, mechanical or electro-mechanical access control devices to limit access during duty hours.  (CAT I)

  NOTE: Electric, mechanical or electro-mechanical access control devices may not be used to control access when the entrance(s) to the vault, secure room or area are not under continuous visual monitoring either directly by cleared employees at the entrance(s) or via CCTV.  If using CCTV it must also be continuously monitored and recorded at an occupied monitoring station.

  **If an Automated Entry Control System (AECS) is used to control access (without use of any authorized visual control methods), use the following seven checks to evaluate:

  CHECKS:

  Check #1. Check to ensure the vault, secure room or area is continuously occupied by at least one properly cleared employee during working hours (when the FF-L-2740 combination lock is not engaged. (CAT I)

  Check #2. Check to ensure the AECS identifies individuals and authenticates the person's authority to enter the area through the use of a coded identification (ID) badge or card. (CAT I)

  Check #3. Check to ensure that in addition to the swipe or proximity card or badge - that a personal identification number (PIN) is used.  This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II - when an AECS card and reader is used w/o PIN or biometrics)

  Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II -only  when an AECS with card and PIN is used)

  Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III)

  Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN.  (CAT II - when an AECS card and reader is used w/o PIN or biometrics)

  Check #7.  VERY IMPORTANT: Check to ensure that electric, mechanical or electro-mechanical access control devices such as Cipher locks ARE NOT USED to control access to vaults, secure rooms or areas when entrances  are not under continuous visual control during working hours.  Generally these locks do not provide the means for individual access codes and do not report to a central server or system monitor.  Therefore they are permissible ONLY for access control to vault, secure rooms and spaces when the entrance is under continuous visual control.  (CAT I)

  TACTICAL ENVIRONMENT:  These checks are applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245809
stig_id: IS-02.01.15
severity: high
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) and Intrusion Detection System (IDS) Head-End Equipment Protection:  The physical location (room or area) containing AECS and IDS head-end equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be physically protected.

check_text:
  Requirements Summary:

  Protection must be established and maintained for all component devices or equipment that constitute the automated entry control system (AECS) and/or the intrusion detection system (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet assets.

  In particular the physical location (room or area) containing AECS and IDS "head-end" equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be protected.

  CHECKS:

  Check #1. Check to ensure the physical location containing the primary IDS "head-end" equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g., guard monitoring station - for alarms and CCTV).  (CAT I)

  Check #2. Check to ensure the continuously occupied space limits unescorted access to only those employees responsible for monitoring or controlling the IDS and/or AECS.  Automated entry control system card/badge readers or cipher locks may be used to fulfill this requirement.  (CAT II)

  Check #3.  If not co-located with the IDS "head-end" equipment; check to ensure the physical location containing the primary AECS "head-end" equipment is in a continuously occupied location OR protected minimally within a room with a BMS alarm contact on each door, window or opening and with interior motion detection sensors that are activated at the end of each duty day.  (CAT II)

  Check #4.  Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting AECS "head-end" equipment that are not located within a continuously occupied location. (CAT II)

  Check #5.  Check to ensure that alarms from sensors in the room protecting AECS "head-end" equipment are monitored at the primary IDS monitoring location.  (CAT II)

  Check #6.  A secondary or supplemental AECS server/workstation or IDS data/monitoring workstation might not be located in a 24/7 occupied work space.  In instances when AECS or IDS secondary head-end equipment is not continuously attended by employees responsible for monitoring or controlling it - Check to ensure it is protected minimally within a room with a BMS alarm contact on each door, window or opening and interior motion detection sensors are installed and activated at the end of each duty day.  (CAT I)

  Check #7.  Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting secondary IDS or AECS "head-end" equipment that are not located within a continuously occupied location.  (CAT II)

  Check #8.  Check to ensure that alarms from sensors in the room protecting secondary IDS or AECS "head-end" equipment are monitored at the primary IDS monitoring location.  (CAT I)

  Check #9.  If 4-hour checks are used in lieu of IDS for vaults, secure rooms or collateral classified open storage areas; then 4-hour checks of the room or area used to house the (secondary) IDS and/or (primary/secondary) AECS "head-end" equipment may also be used in lieu of an IDS. Check to ensure the use of 4-hour checks in lieu of IDS to protect (secondary) IDS and/or (primary/secondary) AECS "head-end" equipment is based on a documented risk assessment.  (CAT II)

  Check #10.  If used, check to ensure that random checks (not to exceed 4-hours) of the room or area used to house the IDS or AECS "head-end" equipment are documented and maintained on file for a minimum of 90 days.  (CAT II)

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245810
stig_id: IS-02.02.01
title: Information Security (INFOSEC) - Secure Room Storage Standards - Structural Integrity Checks
severity: medium
check_text:
  BACKGROUND: In spite of all physical security defensive devices deployed, the possibility of an intrusion always exists. The highest fence can be scaled, the densest wall can be breached, and the stoutest lock can be compromised. Even highly sophisticated alarm systems can be contravened by a knowledgeable professional. It is therefore necessary to institute a system of checks to physically inspect secure room perimeters to check for signs of attempted intrusions and ensure that structural integrity of the perimeter is maintained.

  This requirement is concerned with ensuring there is periodic visual validation of structural integrity of secure room/collateral classified open storage area perimeters containing SIPRNet assets and associated media. It ensures that any breach or attempted breach of the walls, true floors, and true ceilings of a secure area (portions that are not readily visible) are discovered in a timely manner.

  In Check #1 there are three different situations covered and each requires a different inspection frequency for physical/visual validation of structural integrity.

  Check #1. Check to ensure that structural integrity of secure rooms or spaces containing SIPRNet equipment is validated as follows:

  Situation #1 (No structural integrity checks required): If interior IDS (motion detection) is properly employed (i.e., directly covering all SIPRNet assets) within the secure room or collateral classified open storage space where classified SIPRNet assets are located AND under raised floor spaces (if applicable) AND above suspended ceiling spaces (if applicable), then no physical check for structural integrity is required. This is contingent upon the interior motion sensors being activated when the room is closed or unattended and the sensors working properly as determined by required checks of sensor functionality.

  Situation #2 (Checks required IAW approved written guidance from AO): If motion sensors are properly employed ONLY within the secure room space where classified assets are located, then a visual check of spaces below raised floors, above suspended ceilings, and anywhere else the perimeter of the secure area cannot be readily observed must be conducted IAW AO written guidance. The goal is to visually inspect all walls, true floor, and true ceiling perimeters for signs of breach or attempted breach.

  Situation #3 (Checks required IAW written guidance from AO): When random checks (not exceeding four hours) of secure rooms or open storage spaces are used in lieu of IDS, then the checks specified in situation #2 for above suspended ceilings and below raised floors must be conducted IAW AO written guidance. The increased frequency of checks is due to the significant vulnerability of the SIPRNet assets to undetected attack from portions of the perimeter that cannot be readily observed. NOTE: Physical inspection of the perimeter walls, floor, and ceiling can be greatly expedited and may be conducted without ladders or other equipment where there are no false/suspended ceilings and/or raised floors within or surrounding the secure room or area.

  NOTE: If the entire perimeter of the secure room or area containing SIPRNet assets is surrounded by a secret or top secret (TS) Controlled Access Area (CAA), the frequency of structural integrity checks may be reduced to once every two weeks. This is due to the increased security-in-depth provided by the CAA. A secret or TS CAA is an area where unescorted access is granted only to individuals who have a secret or higher security clearance. All others are escorted by cleared employees. The DOD does not provide specific physical security requirements for a CAA but allows each CC/S/A Senior Agency Official (SAO) for Information Security the authority to establish such standards. All the Services have established standards for CAAs within their Protected Distribution System (PDS) implementing guidelines. Minimally, all require some form of access control methodology (AECS/guards/reception, etc.) be in place to ensure only properly vetted and cleared personnel have unescorted access to a CAA.

  Check #2. Check to ensure there are written procedures developed for the checks and that the checks are documented and maintained on file for a minimum of 90 days. Where discrepancies (holes in perimeter or other signs of successful or attempted access) are noted, these checks will be maintained indefinitely or until an inquiry determines the cause of the discrepancy.

  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short-term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245811
stig_id: IS-02.02.02
title: Vault/Secure Room Storage Standards - IDS Performance Verification
severity: medium
check_text:
  This check is concerned with verification of IDS functionality where IDS is used as a supplemental control for vaults or secure rooms/areas containing SIPRNet assets.

  Following are the required checks:

  Check #1. Checks of ALL individual alarm sensors (BMS, motion, glass break, etc.) will be conducted at least semi-annually.

  Check #2. Valid tests IAW best practices using government or industry standards and tools will be used to conduct the checks.

  Check #3. Written procedures will be developed for tests of each sensor type in use at a site.

  Check #4. Results of testing will be maintained on file for at least 1-year.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245812
stig_id: IS-02.02.03
severity: medium
title:
  Vault/Secure Room Storage Standards - Masking of IDS Sensors Displayed at the Intrusion Detection System (IDS) Monitoring Station

check_text:
  Shunting or masking of any secure room IDS internal zone or sensor must be appropriately logged or recorded in the system archive. A shunted or masked internal zone or sensor must be displayed as such at the monitor station throughout the period the condition exists whenever there is a system (IDS) survey of zones or sensors.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245813
stig_id: IS-02.02.04
severity: medium
title:
  Vault/Secure Room Storage Standards - IDS Alarm Monitoring Indicators, both audible and visual (Alarm Status) must be displayed for each sensor or alarmed zone at the monitoring station.

check_text:
  Check that all alarm activations provide both visual and audible indicators at the primary monitoring station.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245814
stig_id: IS-02.02.05
severity: medium
title:
  Vault/Secure Room Storage Standards - Intrusion Detection System (IDS) / Automated Entry Control System (AECS) Primary and Emergency Power Supply

check_text:
  Primary Power Checks:

  Check #1. Check to ensure primary power for all Intrusion Detection System (IDS) equipment and Automated Entry Control system (AECS) equipment is either commercial AC or DC power.

  Check #2. Check to ensure that in the event of commercial power failure at either the secure room/area or monitor station, the equipment changes power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur.

  Emergency (Backup) Power Checks:

  Check #1. Check to ensure that emergency power consists of a protected independent backup power source that provides a minimum of 8-hours operating battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer's periodic maintenance schedule shall be followed and results documented.

  Check #2.  Power Source and Failure Indication:  Check to ensure that an illuminated indication exists at the Power Control Unit (PCU) of the power source in use (AC or DC).

  Check #3. Check to ensure equipment at the IDS/AECS monitor station indicates a failure in power source, a change in power source, and the location of the failure or change.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245815
stig_id: IS-02.02.06
severity: medium
title:
  Vault/Secure Room Storage Standards - Intrusion Detection System and Automated Entry Control System (IDS/AECS) Component Tamper Protection

check_text:
  Requirements Summary:

  Protection must be established and maintained for all component devices or equipment that constitute the Automated Entry Control System (AECS) and/or the Intrusion Detection System (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet assets.

  If access to a junction box or controller will enable an unauthorized modification, then alarmed tamper protection, which is normally provided by a pressure sensitive switch must be used.

  CHECKS:

  1.  Check to ensure that IDS/AECS components located both outside and inside the secure area have tamper protection resulting in an alarm signal sent to the primary IDS Monitoring Station.  Normally this is provided by a pressure sensitive switch, which automatically sends an alarm signal when the protective enclosure covering component equipment is opened.

  2.  Check to ensure that ALL IDS/AECS ancillary equipment such as card readers, keypads, communication or interface devices for vaults, secure rooms, or collateral classified open storage areas containing SIPRNet assets  have tamper resistant enclosures and are securely fastened to the wall or other permanent structure.  Control panels and AECS devices located within a Secret or TS Controlled Access Area (CAA) need only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245816
stig_id: IS-02.02.07
title: Vault/Secure Room Storage Standards - Primary IDS Monitoring Location Outside the Monitored Space
severity: medium
check_text:
  Check to ensure that primary monitoring of alarms for secure rooms or spaces containing SIPRNet equipment is located outside of the protected space.  It is allowable to monitor alarms within the protected space if this is only used for supplemental/secondary monitoring.  Ideally alarms will be monitored from the same location that police/guards or other response forces are contacted and dispatched, although this is not required if there are procedures and means for the monitoring station personnel to notify security response forces in a timely manner.
                                                       TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245817
stig_id: IS-02.02.08
severity: medium
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Records Maintenance, which includes documented procedures for granting and removal of access.

check_text:
  Requirements Summary:

  A procedure must be established for removal of an individual's authorization to enter the secure room area upon reassignment, transfer, or termination, or when the individual's access is suspended, revoked, or downgraded to a level lower than the former access level.  Records shall also be accurately maintained reflecting active assignment of ID badge/card, PIN, level of access, and similar system-related records. Records concerning personnel removed from the system shall be retained for a minimum of 90 days.

  CHECKS:

  Check #1. Check to ensure that records reflecting active assignment of ID badge/card, PIN, level of access, and similar system-related records are accurately maintained.  (CAT II)

  Check #2. Check to ensure there is a documented procedure for removal of persons from the Automated Entry Control System.  (CAT III)

  Check #3. Check to ensure that records concerning personnel removed from the system are retained for a minimum of 90 days.  (CAT III)

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245818
stig_id: IS-02.02.09
severity: medium
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Transmission Line Security:  
  AECS Transmission lines traversing an uncontrolled area (not within at least a Secret Controlled Access Area (CAA) ) shall use line supervision OR Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours must have all electrical components,  that traverse outside minimally a Secret Controlled Access Area (CAA), secured within conduit.

check_text:
  1. Where Automated Entry Control Systems (AECS)protect SIPRNet assets in Secure Rooms, Vaults, or secret/TS CAAs: Ensure  that transmission lines used to carry access authorizations, personal identification data, or verification data between devices or equipment, which are located outside "minimally" a Secret Controlled Access Area (CAA) have line supervision.

  2. Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours (while under direct continuous visual observation and control of a cleared employee or via CCTV) must have all electrical components, including wiring, or mechanical links (cables, rods, and so on) accessible only from inside the area, or, if they traverse outside a controlled area "minimally" a Secret Controlled Access Area (CAA), they must be physically secured within conduit to preclude surreptitious manipulation of components.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245819
stig_id: IS-02.02.10
severity: medium
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Door Locks: Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade and be configured to fail secure in the event of a total loss of power (primary and backup).

check_text:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Door Lock Standards for Areas Containing SIPRNet Assets.

  Check to ensure the following configuration and control considerations are used according to the types of locking mechanisms being used, as specified in each check:

  Check #1.  Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade.

  Check #2.  Backup batteries and/or emergency power generators should be connected to AECS components; however, the total loss of power (primary and emergency) should also be planned for.

  Check #3. When used on secure rooms, vaults or areas protecting SIPRNet equipment, electric strikes on doors will be set to fail secure in the event of power disruption.

  Check #4. On the primary ingress/egress door to secure rooms (which contains the combination lock) the strike may be set to fail open to facilitate access to the room in emergencies only if the door is under continuous visual observation when the combination lock is not secure.  In this instance the combination lock will be immediately secured and subsequently opened as required to allow access to the room.

  Check #5. As an alternative the strike on the primary access door (only those under continuous visual control) may be set to fail secure and configured to allow for opening of the strike lock with a key.

  Check #6. Keys for locks as discussed in check 5 will be strictly controlled, inventoried periodically and not issued to individuals for personal retention.

  Check #7. KEYS TO SECURE ROOMS WILL NOT BE REMOVED FROM THE SITE.

  Check #8. When Magnetic Locks (Mag locks) are used on primary access doors the total loss of ALL power (primary and backup) will cause the lock to fail open.  Therefore doors with mag locks installed MUST BE UNDER CONTINUOUS VISUAL OBSERVATION WHEN THE COMBINATION LOCK IS OPEN.

  Check #9. Where Mag locks are used on primary access doors and upon a total power failure  - the combination lock will be immediately secured and subsequently opened as required to allow access to the room.

  Check #10. Secondary doors not used for access (emergency egress only) should use standard locking door latches rather than electric strikes or mag locks.

  Check #11. Access hardware on the side of the secondary door that is external to the room must be removed to prevent use of secondary doors for routine ingress.

  Check #12. In the event a mag lock or electric strike is used on a secondary door, the door must be configured to be locked during a power disruption.  This can be accomplished with internal sliding deadbolt locks or lockable door latches.  Electric strikes on secondary doors should be set to fail secure.  Any secondary door secured with Mag Locks must be under CONTINUOUS visual observation when the interior deadbolt locks are not engaged.  Deadbolt locks must not be engaged while the room is occupied - for life safety, but will be secured upon closing the secure room or area.

  TACTICAL ENVIRONMENT:  This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245820
stig_id: IS-02.02.11
severity: medium
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Perimeter Construction using Proper Permanent Construction Materials for True Ceiling, Walls and Floors.

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet assets) check:

  1. That walls, floor, and roof construction of secure rooms are made of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of unauthorized entry into the area. Materials such as plywood must be attached in a manner so as not to enable easy removal of screws or nails to gain ingress and then replace upon egress.

  2. The "True" ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material.

  TACTICAL ENVIRONMENT:  This check is applicable where vaults or secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245821
stig_id: IS-02.03.01
severity: low
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Keypad Device Protection: Keypad devices designed or installed in a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

check_text:
  Requirements Summary:
  Keypad devices (cipher locks or PIN pads for card readers) shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

  CHECKS:
  Check to ensure that all keypad devices are properly shielded and/or that persons using these devices have been advised by site security and are aware of the risk of having someone in the vicinity view their PIN as it is entered and that they are exercising due care to shield entry of their PIN.

  Verification of employee awareness can be obtained by observing SOPs or employee training records reflecting a warning or requirement to shield entry of PINs.

  TACTICAL ENVIRONMENT:  This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245822
stig_id: IS-03.02.01
severity: medium
title:
  Marking Classified - Equipment, Documents or Media:  In a classified operating environment, all unclassified items must be marked in addition to all classified  items.

check_text:
  Check to ensure all equipment/media/documents in the areas housing SIPRNet assets contain proper classification markings.

  In a classified operating environment, all unclassified items must be marked in addition to all classified items. For instance, in areas where any classified equipment such as servers, client workstations, printers, routers, crypto, etc. are being used, all classified equipment, media, and documents must be properly marked with classification levels and handling caveats. All unclassified equipment (servers, client workstations, printers, routers, crypto, etc.), media, and documents must also be properly marked as unclassified and with handling caveats, such as CUI, when appropriate. This total marking of all assets in a classified environment eliminates the assumption that anything not marked is unclassified. Hence, all equipment, media, and documents within SCIFs, Vaults, Secure Rooms and classified Controlled Access Areas (CAAs) must be marked with classification levels and handling caveats.

  SPECIAL NOTE FOR MONITORS:  Monitors connected to SIPRNet/NIPRNet are inert items of equipment in that they do not store or retain classified data. As long as the monitor border displays the classification level alerting personnel using the system of the protection requirements there is no need to place a classification sticker on the monitor.

  If a classification banner is displayed on an active monitor screen then the physical monitor is not required to have a SF-710 (unclassified) or SF-707 (secret) sticker.

  Typically, most monitor screens connected to the DISN do have classification banners displayed, so placement of SF stickers on monitors is not an issue.

  Also, consider that many workstations are using KVM switches to share monitor screens between NIPRNet and SIPRNet. Hence, the single monitor will be unclassified or classified depending on the network it is connected to at a particular moment, making placement of physical classification labels impractical.

  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created or extracted from the SIPRNet. The only exception will be for urgent (short-term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-245823
stig_id: IS-03.03.01
severity: low
title:
  Marking Classified - Local or Enclave Classified Marking Procedures must be developed to ensure employees are familiar with appropriate organization Security Classification Guides (SCG), how to obtain guidance for marking classified documents, media and equipment, and where associated forms, classified cover sheets, labels, stamps, wrapping material for classified shipment, etc. can be obtained.

check_text:
  Check to  ensure the local site/enclave security manager has developed written procedures on proper marking of classified documents / media/ equipment.  These procedures should primarily involve guidance for employees concerning what to mark, how to mark items, where classified labels, stamps and other marking tools and supplies are located, etc.  Reference to DoD or component marking guides should be in the local procedures with information on how/where to obtain copies.

  TACTICAL ENVIRONMENT:  This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-245824
stig_id: IS-04.03.01
severity: low
title:
  Classified Working Papers are properly marked, destroyed when no longer needed, or treated as a finished document after 180 days.

check_text:
  Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.)for compliance with the following guidance:

  Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently.

  Working papers containing classified information shall be:
   - Dated when created
   - Marked Top and Bottom with the highest classification of any information contained in the document
   - Annotated "WORKING PAPER"

  If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents.  If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents".

  TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.


vuln_id: V-245825
stig_id: IS-05.01.01
severity: high
title:
  Storage/Handling of Classified Documents, Media, Equipment - must be under continuous personal protection and control of an authorized (cleared) individual OR guarded or stored in an approved locked security container (safe), vault, secure room, collateral classified open storage area or SCIF.

check_text:
  1. In areas containing SIPRNet assets - Check to ensure that classified documents, information system (IS) equipment and removable media that is not under the direct personal control and observation of an authorized person is guarded or stored in a locked security container (GSA approved safe), vault, secure room, collateral classified open storage area or SCIF with protection equal to or exceeding the highest classification of the material/equipment.  (CAT I)

  2. Check to ensure that site security personnel develop written procedures for response to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III)

  Procedures for response to classified materials discovered that are not in proper storage or under proper control of a cleared person must include the following:

    a.  Site security personnel, security reviewers/inspectors, employees or anyone making discovery of classified material not in secure storage or under continuous observation and control of a cleared employee immediately take control and properly secure the classified materials not under proper control when not in approved storage.  Second they must report the discovery to their supervisory chain and/or site security officials.  (CAT III)

    b.  Site security personnel must initiate a preliminary inquiry if appropriate to determine the cause of the improperly secure material and to determine if any material was lost or compromised (security incident).  (CAT III)

    c.  Site security personnel must conduct remedial training action subsequent to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee to remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage.  (CAT III)

    d.  Site managers/supervisors must discipline employees, as appropriate who do not comply with appropriate requirements to maintain positive control of classified material they have removed from secure storage. (CAT III)

  3. Check to ensure that's site security personnel conduct initial and annual training to indoctrinate and remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage and measures to take upon discovery of classified material not in proper storage or under proper control of a cleared person. (CAT II)

  Suggested methodology for reviewers:
  During the review/walk-around be observant for classified materials (documents media, and equipment) that have been removed from approved storage.  Specifically look to determine if employees are maintaining positive control of the material.  Unless a properly cleared employee is able to clearly see and control the material - this will be a finding.

  The employee(s) must be specifically aware the classified material is in their area AND that they are responsible for ensuring it is controlled/protected.  Just having cleared employee(s) "in the area" of the classified material or assuming other cleared employees in the area are responsible for the classified material is not sufficient control.

  An example of a possible finding is when someone working on a classified system departs their work space (cube environment) for lunch or other type of break and does not ask another cleared employee to take control of their classified equipment, documents or media OR does not place the classified hard drive, classified documents and classified media in approved storage.

  TACTICAL ENVIRONMENT:  This check is applicable in a tactical environment.

  The only exception will be where there is a lack of permanent storage solutions for urgent (short term) tactical operations or other contingency situations.  Primarily this involves field/mobile environments where fixed facilities and equipment are not yet present or incapable of being used.  However, all classified equipment, documents or media not properly stored in a safe, vault or secure room must still be under the continuous observation and control of an appropriately cleared person.


vuln_id: V-245826
stig_id: IS-06.03.01
severity: low
title:
  Non-Disclosure Agreement - Standard Form 312: no person may have access to classified information unless that person has a security clearance in accordance with DODM 5200.02 and has signed a Standard Form (SF) 312, Classified Information Non-Disclosure Agreement (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).

check_text:
  The check is to review a sample of Personnel Security Records (minimum of 10 percent assigned military and civilian employees) to ensure SF 312s have been signed by persons granted access to classified information systems. The now outdated SF 189 or SF 189A, if found, are still valid NDAs. The execution of an NDA should also be annotated in the Defense Information System for Security (DISS). If a paper copy is found but the form is not in DISS OR if it is annotated in DISS and a paper copy is not on hand, this is not a finding.

  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. Anyone with access to classified information must have signed an NDA. Paper copies of the signed NDA will likely not be available in a tactical area of operations; however, system access to DISS should be possible if the theater of operations has been well established.


vuln_id: V-245827
stig_id: IS-07.03.01
severity: low
title:
  Handling of Classified Documents, Media, Equipment - Written Procedures and Training  for when classified material/equipment is removed from a security container and/or secure room.

check_text:
  1. Check there are written procedures for handling classified material/equipment when removed from a security container and/or secure room.  These procedures must thoroughly cover all aspects of protection and storage of classified materials and be made readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III)

  2. Check training logs (initial and annual refresher) that all employees granted access to classified are briefed on proper handling procedures e.g., use of cover sheets, maintaining positive control of the material, marking/labeling, access by vendors, determining clearance and need-to-know before release, reproduction, etc. (CAT III)

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245828
stig_id: IS-07.03.02
title: Handling of Classified - Use of Cover Sheets on Documents Removed from Secure Storage
severity: low
check_text:
  During the review/walk-around be observant for classified documents without cover sheets.  Unless an employee is specifically working on the document - a cover sheet must be placed on it to ensure classified information is not inadvertently exposed.  If the document without a cover sheet is located in a SCIF, Secret or TS vault or secure room - this should not be written as a finding; however, highly recommend use of cover sheets as a best security practice for enforcement of need-to-know.  If the document w/o cover sheet is found in a Secret Controlled Access Area (CAA) or below, this should be made a finding.

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments.  It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245829
stig_id: IS-08.01.01
title: Classified Monitors/Displays (Physical Control of Classified Monitors From Unauthorized Viewing)
severity: high
check_text:
  BACKGROUND NOTE:  This requirement includes both situations where there is primarily a US Classified processing environment (no routine Foreign National (FN) presence) AND also contains guidance to be used for environments where FN are employed or present. It is arranged first by GUIDELINES FOR SITES WITHOUT A FN PRESENCE followed by GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE.

  Following a lengthy discussion of the guidelines and considerations, the specific checks for this requirement are found, along with the default severity level applicable to each check.

  Finally, guidance for applicability to tactical environments is provided.

  GUIDELINES FOR SITES WITHOUT A FN PRESENCE:

  The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable.

  POSSIBLE SOLUTIONS:
  1. The best physical control solution is to locate all US Only classified terminals (open SIPRNet) in areas where only persons with at least a secret (or higher) security clearance have unescorted access. This type of area is commonly known as a secret Controlled Access Area (CAA). Placement of classified terminals in more highly controlled spaces like in secret or top secret (TS) vaults or secure rooms or SCIFs meets the access control requirements of a secret or TS CAA in addition to providing superior physical security of the location. Such additional physical security protection may be appropriate depending on organization mission and need to continually maintain classified information processing equipment within an open storage environment.

  2.  Regardless of the type of environment in which classified work stations/monitors are located, ensuring that uncleared persons or those without need-to-know do not have easy access or inadvertent visibility to the classified monitor screens can be accomplished by placing (grouping together) the classified work stations in the back of such rooms/areas or behind partitions. This ensures uncleared visitors have limited opportunity to walk by a classified monitor and inadvertently be exposed to classified data.

  3.  If isolation (grouping in controlled space) of the terminals is not practical, a privacy filter should be placed on each classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual simply passing by. This is a good idea even if other physical controls of classified work stations are used. The use of the privacy filters is an excellent alternative solution where physical separation or repositioning of monitors in rooms is not possible due to space limitations.

  4. Classified monitor screens should not be placed facing doorways or windows through which public or unrestricted viewing of the monitor is possible. If space limitations do not allow for such placement then ensuring doors are closed or that windows are covered by screens or blinds during classified processing can be used - but only if this procedure is part of documented security procedures and security training.

  5. Finally a solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for use when classified work is being conducted.

  ABSOLUTE REQUIREMENTS:
  While the "possible solutions" cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception:

  1.  When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view.

  2.  All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF.

  GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE:

  Environments where FN are present (may even be embedded as US DoD employees) require even more diligence and additional considerations for protection of US Only classified (SIPRNet) terminal screens/workstation screens and monitors. This is because while sharing of certain specific classified information may be permitted, there is always the possibility that US Only or NOFORN information may also be present within the physical environment or accessible on visible/unprotected workstation screens.

  Foreign Nationals, even if they are embedded partners in US DoD operations, are not afforded access to any and all US classified information. This erroneous assumption is prevalent in many CC/S/A operation centers where FN liaison and exchange personnel are routinely present. Release of US classified information can only be made to FN partners if specifically compliant with National Disclosure Policy, has been determined releasable to the Foreign National's host country and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material.

  *Where FN are present (regardless of their authorized physical and systems access or security clearance) - US Only work stations and network equipment must be under strict US control at all times.

  This process involves a combination of physical control measures AND employee awareness. Reviewers must use a flexible approach with an understanding of the synergistic relationship of physical controls and employee awareness to properly evaluate compliance.

  REGULATORY STANDARD FOR ENVIRONMENTS WITH FN PRESENCE: This relationship of physical protective measures with employee awareness gained through procedures and training is based on the following excerpt from CJCSI 6510-01F:
  In areas where there is the potential for Foreign National Access to U.S.-Only Workstations and Network Equipment, CC/S/As shall:

  1.  Maintain strict U.S. control of U.S.-only workstations and network equipment at all times. This includes network equipment such as printers, copiers, and faxes.

  2.  Group U.S.-only workstations together in a U.S.-controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers).

  3.  If the grouping of U.S.-only workstations at a site is not operationally possible, the following steps shall be taken:

      a. The U.S. command or agency shall authorize an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. NOTE: this exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer.

      b. Develop, publish, and maintain specific site written procedures on security measures to safeguard U.S.-only classified workstations.

      c. Ensure that U.S. personnel are briefed and enforce security measures.

  4.  Announce presence. If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.

  5.  If the foreign national is permitted to view the screen, U.S. personnel must ensure:

      a.  Information is releasable in accordance with CC/S/A guidance and shall be consistent with National Disclosure Policy (NDP)-1; DoDD 5230.11; DoDD 5230.20; DoD Manual 5200.01; and CJCSI 5221.01.

      b.  Check with organization security office to ensure foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved and an official need-to-know.

  POSSIBLE SOLUTIONS:
  The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable:

  1.  The "best physical control solution" is to locate all US Only terminals in areas where the FN do not have easy access or visibility to the monitor screens. This can be accomplished by placing them in the back of rooms/areas or behind partitions. Normally if US Only SIPRNet PCs are placed in the back of a room or within the secure space the REL/FN  work stations would then be placed near the front of the area to reduce the frequency of FN officers passing by US Only SIPRNet (or other US Only classified) work stations. When FN employees need to enter areas where US Only work stations are located there should be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material not releasable to FN to be covered from view.

  2.  If isolation of the terminals is not practical, a privacy filter should be placed on each US Only classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual. This is a good idea even if physical separation of US Only and REL/FN work stations is used. The use of the privacy filters is the best alternative "physical control solution" where physical separation in rooms is not possible due to space limitations and/or the impeding of interaction between US personnel and FN partners.

  3.  Another acceptable physical security alternative solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for when classified work (especially on the US Only cubes) is being performed.

  4. Finally, in addition to any physical separation, obscuration or other control measures in place (or lack thereof) written local policy/procedures and initial/recurring training are absolutely necessary to ensure that all US personnel are:

      a.  Aware of REL/FN Officers presence in common work areas when working on non-releasable applications/sites on the SIPRNet and

      b.  Aware of exactly what classified or sensitive information is not releasable.

  ABSOLUTE REQUIREMENTS:
  While the "possible solutions" cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception:

  1.  When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view.

  2.  All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF.

  3.  Announce presence of Foreign Nationals (FN). If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.

  4. If the foreign national is permitted to view a US Only screen, U.S. personnel must ensure:

      a.  Information is releasable in accordance with CC/S/A guidance and is consistent with National Disclosure Policy (NDP)-1; DoDD 5230.11; DoDD 5230.20; DoD Manual 5200.01; and CJCSI 5221.01.

      b. A check with the organization security office is conducted to ensure the foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved, that an appropriate DDL is on-hand to validate the security clearance and release of US classified information, and that there is an official need-to-know.

  CHECKS FOR *BOTH* US ONLY CLASSIFIED (SIPRNet) ENVIRONMENTS WITHOUT FN PRESENCE AND ENVIRONMENTS WITH FN PRESENCE:

  1.  CHECK all classified monitor locations to ensure that no unauthorized viewing is possible or occurring. This includes viewing by uncleared persons and/or those w/o need-to-know. It also includes REL partners or other FN who may have been granted liberal physical access to areas where US ONLY classified is processed. This check is the primary action for reviewers under this requirement. (CAT I)

  2.  CHECK/validate that classified monitors cannot be observed from outside the secure space (e.g., from common hallways or through doors or windows).  (CAT I)

  3.  CHECK access control procedures and observe actual escort procedures. Ensure there is a process (and that it is actually being used) for announcing unauthorized/uncleared personnel in the area and that uncleared persons and/or those without the need-to-know (to include FN)  are continuously escorted when they are in the immediate vicinity of US classified workstations and components. (CAT I)

  CHECKS *ONLY FOR* CLASSIFIED (SIPRNet) ENVIRONMENTS WITH *FN PRESENCE*:

  4.  CHECK to ensure there are local written procedures AND adequate documented proof of training (annually minimum) covering rules for interaction between US and FN employees.  All US and FN employees must be equally aware of the rules and procedures.  BOTH must be provided with applicable written guidance and training in this area. (CAT II)

  5.  CHECK that U.S.-only workstations are "grouped" together in a U.S.-controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers). (CAT II)

  6.  CHECK that If the grouping of U.S.-only workstations at a site is not operationally possible, the following steps have been taken:

      a. The U.S. command or agency has authorized an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception.  This exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer level.  (CAT II)

      b. Develop, publish, and maintain site specific written procedures on security measures to safeguard U.S.-only classified workstations. (in conjunction with written procedures required for CHECK #4) (CAT II)

      c. Ensure that U.S. personnel are briefed, trained (annually minimum) and enforce security measures.  (in conjunction with training required for CHECK #4) (CAT II)

  NOTE:  CHECK #6 is an allowable alternative to CHECK #5 and one or the other must be conducted.

  7.  CHECK that if a foreign national is permitted to view a US Only screen, U.S. personnel have ensured:

      a.  Information is releasable in accordance with CC/S/A guidance and is consistent with National Disclosure Policy (NDP)-1; DoDD 5230.11; DoDD 5230.20; DoD Manual 5200.01; and CJCSI 5221.01. (CAT I)

      b.  The organization Foreign Disclosure Officer, Foreign Contact Officer, or Security Manager was consulted to  ensure the foreign national has a security clearance granted by his or her government at a level equal to that of the classified information involved, and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material, and that there is an official need-to-know. (CAT I)

  TACTICAL ENVIRONMENT:

  1. This check is applicable for all classified processing environments including a field/mobile environment. Commanders in such environments may use whatever means available or feasible to control unauthorized physical access to classified monitors.

  2.  This check is applicable where REL Partners or other FN allies are employed within fixed facilities located in a theater of operations (tactical environment) with physical access to US Classified or Sensitive Systems.

  3.  Wherever classified systems/with screens/monitors are used, uncleared persons must always be escorted when permitted in the physical processing environment.


