# stig_rules

vuln_id: V-220788
rule_id: SV-220788r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit other Logon/Logoff Events Failures.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Other Logon/Logoff Events" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Logon/Logoff  >> Other Logon/Logoff Events - Failure


vuln_id: V-220789
rule_id: SV-220789r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit Detailed File Share Failures.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Detailed File Share allows the auditing of attempts to access files and folders on a shared folder.

  The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> “Audit Detailed File Share" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a command prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Object Access  >> Detailed File Share - Failure


vuln_id: V-220790
rule_id: SV-220790r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Policy Change  >> MPSSVC Rule-Level Policy Change - Success


vuln_id: V-220791
rule_id: SV-220791r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Policy Change  >> MPSSVC Rule-Level Policy Change - Failure


vuln_id: V-220792
rule_id: SV-220792r958478_rule
severity: CAT II
title: Camera access from the lock screen must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Enabling camera access from the lock screen could allow for unauthorized use.  Requiring logon will ensure the device is only used by authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the device does not have a camera, this is NA.

  Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen camera" to "Enabled".

check_text:
  If the device does not have a camera, this is NA.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\

  Value Name: NoLockScreenCamera

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220793
rule_id: SV-220793r958478_rule
severity: CAT II
title: Windows 10 must cover or disable the built-in or attached camera when not in use.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Failing to disconnect from collaborative computing devices (i.e., cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.

  Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the camera is not disconnected or covered, the following registry entry is required:
   
  Registry Hive: HKEY_LOCAL_MACHINE
  RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam

  Value Name: Value
  Value Data: Deny

check_text:
  If the device or operating system does not have a camera installed, this requirement is not applicable.

  This requirement is not applicable to mobile devices (smartphones and tablets) where the use of the camera is a local AO decision.

  This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.

  For an external camera, if there is not a method for the operator to manually disconnect the camera at the end of collaborative computing sessions, this is a finding.

  For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. 

  If the built-in camera is not protected with a camera cover, or if the built-in camera is not disabled in the bios, this is a finding.

  If the camera is not disconnected or covered, the following registry entry is required:

  Registry Hive: HKEY_LOCAL_MACHINE
  RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam

  Value Name: Value
  Value Data: Deny

  If "Value" is set to a value other than "Deny" and the collaborative computing device has not been authorized for use, this is a finding.


vuln_id: V-220794
rule_id: SV-220794r958478_rule
severity: CAT II
title: The display of slide shows on the lock screen must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen slide show" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\

  Value Name: NoLockScreenSlideshow

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220795
rule_id: SV-220795r991589_rule
severity: CAT II
title: IPv6 source routing must be configured to highest protection.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled".

  This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\

  Value Name: DisableIpSourceRouting

  Value Type: REG_DWORD
  Value: 2


vuln_id: V-220796
rule_id: SV-220796r991589_rule
severity: CAT II
title: The system must be configured to prevent IP source routing.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled".

  This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

  Value Name: DisableIPSourceRouting

  Value Type: REG_DWORD
  Value: 2


vuln_id: V-220797
rule_id: SV-220797r991589_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.

description:
  <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly.   When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled".

  This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

  Value Name: EnableICMPRedirect

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220798
rule_id: SV-220798r958902_rule
severity: CAT III
title: The system must be configured to ignore NetBIOS name release requests except from WINS servers.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled".

  This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\

  Value Name:  NoNameReleaseOnDemand

  Value Type:  REG_DWORD
  Value:  1


vuln_id: V-220799
rule_id: SV-220799r958518_rule
severity: CAT II
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.

description:
  <VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems.

  With User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled".

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package.  "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the system is not a member of a domain, this is NA.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: LocalAccountTokenFilterPolicy

  Value Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220800
rule_id: SV-220800r958478_rule
severity: CAT II
title: WDigest Authentication must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft.  WDigest is disabled by default in Windows 10.  This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled".

  The patch referenced in the policy title is not required for Windows 10.

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package.  "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\

  Value Name: UseLogonCredential

  Type: REG_DWORD
  Value:  0x00000000 (0)


vuln_id: V-220801
rule_id: SV-220801r958478_rule
severity: CAT II
title: Run as different user must be removed from context menus.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The "Run as different user" selection from context menus allows the use of credentials other than the currently logged on user.  Using privileged credentials in a standard user session can expose those credentials to theft.  Removing this option from context menus helps prevent this from occurring.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Remove "Run as Different User" from context menus" to "Enabled".

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package.  "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  If the following registry values do not exist or are not configured as specified, this is a finding.
  The policy configures the same Value Name, Type and Value under four different registry paths.

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Paths:  
  \SOFTWARE\Classes\batfile\shell\runasuser\
  \SOFTWARE\Classes\cmdfile\shell\runasuser\
  \SOFTWARE\Classes\exefile\shell\runasuser\
  \SOFTWARE\Classes\mscfile\shell\runasuser\

  Value Name:  SuppressionPolicy

  Type:  REG_DWORD
  Value:  0x00001000 (4096)


vuln_id: V-220802
rule_id: SV-220802r991589_rule
severity: CAT II
title: Insecure logons to an SMB server must be disabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders.  Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> "Enable insecure guest logons" to "Disabled".

check_text:
  Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\

  Value Name: AllowInsecureGuestAuth

  Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220803
rule_id: SV-220803r958478_rule
severity: CAT II
title: Internet connection sharing must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot.  This exposes the system sharing the connection to others with potentially malicious purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Connections >> "Prohibit use of Internet Connection Sharing on your DNS domain network" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Network Connections\

  Value Name: NC_ShowSharedAccessUI

  Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220805
rule_id: SV-220805r971535_rule
severity: CAT II
title: Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first.  Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings >> "ECC Curve Order" to "Enabled" with "ECC Curve Order:" including the following in the order listed:

  NistP384
  NistP256

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\

  Value Name: EccCurves

  Value Type: REG_MULTI_SZ
  Value: NistP384 NistP256


vuln_id: V-220806
rule_id: SV-220806r991589_rule
severity: CAT II
title: Simultaneous connections to the internet or a Windows domain must be limited.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Multiple network connections can provide additional attack vectors to a system and must be limited. The "Minimize the number of simultaneous connections to the Internet or a Windows Domain" setting prevents systems from automatically establishing multiple connections. When both wired and wireless connections are available, for example, the less-preferred connection (typically wireless) will be disconnected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior for "Minimize the number of simultaneous connections to the Internet or a Windows Domain" is "Enabled".

  If this must be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> "Minimize the number of simultaneous connections to the Internet or a Windows Domain" to "Enabled". 

  Under "Options", set "Minimize Policy Options" to "3 = Prevent Wi-Fi When on Ethernet".

check_text:
  The default behavior for "Minimize the number of simultaneous connections to the Internet or a Windows Domain" is "Enabled".

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "3", this is not a finding.

  If it exists and is configured with a value of "0", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\

  Value Name: fMinimizeConnections

  Value Type: REG_DWORD
  Value: 3 (or if the Value Name does not exist)


vuln_id: V-220807
rule_id: SV-220807r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Connections to non-domain networks when connected to a domain authenticated network must be blocked.

description:
  <VulnDiscussion>Multiple network connections can provide additional attack vectors to a system and should be limited.  When connected to a domain, communication must go through the domain connection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> "Prohibit connection to non-domain networks when connected to domain authenticated network" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\

  Value Name: fBlockNonDomain

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220808
rule_id: SV-220808r991589_rule
severity: CAT II
title: Wi-Fi Sense must be disabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared.  It also allows the sharing of the system's known networks to contacts.  Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> WLAN Service >> WLAN Settings>> "Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services" to "Disabled".   

  v1507 LTSB does not include this group policy setting.  It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.

check_text:
  This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\

  Value Name: AutoConnectAllowedOEM

  Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220809
rule_id: SV-220809r958422_rule
severity: CAT II
title: Command line data must be included in process creation events.
cci: CCI-000135
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log.  This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE 
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\

  Value Name: ProcessCreationIncludeCmdLine_Enabled

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220810
rule_id: SV-220810r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.

description:
  <VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host.  Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials.  Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Remote host allows delegation of non-exportable credentials" to "Enabled".

check_text:
  This is NA for Windows 10 LTSC\B versions 1507 and 1607.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\

  Value Name: AllowProtectedCreds

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220811
rule_id: SV-220811r1016359_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.

description:
  <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity. Secure Boot is the minimum security level with DMA protection providing additional memory protection.  DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  VBS, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Secure Boot" or "Secure Boot and DMA Protection" selected for "Select Platform Security Level:".

  A Microsoft article on Credential Guard system requirements can be found at the following link:
  https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements

check_text:
  Confirm virtualization-based security (VBS) is enabled and running with Secure Boot or Secure Boot and DMA Protection.

  For those devices that support VBS features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding.

  VBS, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Run "PowerShell" with elevated privileges (run as administrator).

  Enter the following:

  "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard"

  If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding.

  If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}").

  If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding.

  Alternately:

  Run "System Information".

  Under "System Summary", verify the following:

  If "Device Guard Virtualization based security" does not display "Running", this is finding.

  If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is finding.

  If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection").

  The policy settings referenced in the Fix section will configure the following registry values. However, due to hardware requirements, the registry values alone do not ensure proper function.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\

  Value Name: EnableVirtualizationBasedSecurity
  Value Type: REG_DWORD
  Value: 1

  Value Name: RequirePlatformSecurityFeatures
  Value Type: REG_DWORD
  Value: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection)

  A Microsoft article on Credential Guard system requirements can be found at the following link:

  https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements


vuln_id: V-220812
rule_id: SV-220812r991589_rule
severity: CAT I
title: Credential Guard must be running on Windows 10 domain-joined systems.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Virtualization based security, including Credential Guard, currently cannot be implemented in VDIs due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is Not Applicable.

  For VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations.

  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration:".

  v1507 LTSB does not include selection options; select "Enable Credential Guard".

  A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:

  https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard

check_text:
  Confirm Credential Guard is running on domain-joined systems.

  For devices that support Credential Guard, this feature must be enabled. Organizations must take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.

  Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDIs) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is Not Applicable.

  Run "PowerShell" with elevated privileges (run as administrator). 

  Enter the following:
  "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard"

  If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding.

  Alternately:

  Run "System Information".

  Under "System Summary", verify the following:

  If "Virtualization-based Security Services Running" does not list "Credential Guard", this is finding.

  The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\

  Value Name: LsaCfgFlags
  Value Type: REG_DWORD
  Value: 0x00000001 (1) (Enabled with UEFI lock)


vuln_id: V-220813
rule_id: SV-220813r991589_rule
severity: CAT II
title: Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce "Good, unknown and bad but critical" (preventing "bad").

  If this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Enabled” with "Good, unknown and bad but critical" selected.

check_text:
  The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad").

  If the registry value name below does not exist, this a finding.

  If it exists and is configured with a value of "7", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\

  Value Name: DriverLoadPolicy

  Value Type: REG_DWORD
  Value: 1, 3, or 8 

  Possible values for this setting are:
  8 - Good only
  1 - Good and unknown
  3 - Good, unknown and bad but critical
  7 - All (which includes "Bad" and would be a finding)


vuln_id: V-220814
rule_id: SV-220814r991589_rule
severity: CAT II
title: Group Policy objects must be reprocessed even if they have not changed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}

  Value Name: NoGPOListChanges

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220815
rule_id: SV-220815r958478_rule
severity: CAT II
title: Downloading print driver packages over HTTP must be prevented.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off downloading of print drivers over HTTP" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\

  Value Name: DisableWebPnPDownload

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220816
rule_id: SV-220816r958478_rule
severity: CAT II
title: Web publishing and online ordering wizards must be prevented from downloading a list of providers.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off Internet download for Web publishing and online ordering wizards" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

  Value Name: NoWebServices

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220817
rule_id: SV-220817r958478_rule
severity: CAT II
title: Printing over HTTP must be prevented.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off printing over HTTP" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\

  Value Name: DisableHTTPPrinting

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220818
rule_id: SV-220818r991589_rule
severity: CAT II
title: Systems must at least attempt device authentication using certificates.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Using certificates to authenticate devices to the domain provides increased security over passwords.  By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices.  This may also be configured to always use certificates for device authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  The default behavior for "Support device authentication using certificate" is "Automatic".

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kerberos >> "Support device authentication using certificate" to "Not Configured or "Enabled" with either option selected in "Device authentication behavior using certificate:".

check_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  The default behavior for "Support device authentication using certificate" is "Automatic".

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "1", this is not a finding.

  If it exists and is configured with a value of "0", this is a finding.

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\

  Value Name:  DevicePKInitEnabled
  Value Type:  REG_DWORD
  Value:  1 (or if the Value Name does not exist)


vuln_id: V-220819
rule_id: SV-220819r958478_rule
severity: CAT II
title: The network selection user interface (UI) must not be displayed on the logon screen.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Do not display network selection UI" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: DontDisplayNetworkSelectionUI

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220820
rule_id: SV-220820r958478_rule
severity: CAT II
title: Local users on domain-joined computers must not be enumerated.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Enumerate local users on domain-joined computers" to "Disabled".

check_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: EnumerateLocalUsers

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220821
rule_id: SV-220821r1051027_rule
severity: CAT II
title: Users must be prompted for a password on resume from sleep (on battery).
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (on battery)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\

  Value Name: DCSettingIndex

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220822
rule_id: SV-220822r1051028_rule
severity: CAT II
title: The user must be prompted for a password on resume from sleep (plugged in).
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (plugged in)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\

  Value Name: ACSettingIndex

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220823
rule_id: SV-220823r1137695_rule
severity: CAT I
title: Solicited Remote Assistance must not be allowed.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user.  Solicited assistance is help that is specifically requested by the local user.  This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> "Configure Solicited Remote Assistance" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: fAllowToGetHelp
   
  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220824
rule_id: SV-220824r971545_rule
severity: CAT II
title: Unauthenticated RPC clients must be restricted from connecting to the RPC server.
cci: CCI-001967
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> "Restrict Unauthenticated RPC clients" to "Enabled" and "Authenticated".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\

  Value Name: RestrictRemoteClients

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220825
rule_id: SV-220825r991589_rule
severity: CAT III
title: The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Control of credentials and the system must be maintained within the enterprise.  Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> "Allow Microsoft accounts to be optional" to "Enabled".

check_text:
  Windows 10 LTSC\B versions do not support the Microsoft Store and modern apps; this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: MSAOptional

  Value Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220826
rule_id: SV-220826r958478_rule
severity: CAT III
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.

description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\

  Value Name: DisableInventory

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220827
rule_id: SV-220827r958804_rule
severity: CAT I
title: Autoplay must be turned off for non-volume devices.
cci: CCI-001764
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\

  Value Name: NoAutoplayfornonVolume

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220828
rule_id: SV-220828r958804_rule
severity: CAT I
title: The default autorun behavior must be configured to prevent autorun commands.
cci: CCI-001764
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing autorun commands to execute may introduce malicious code to a system.  Configuring this setting prevents autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

  Value Name: NoAutorun

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220829
rule_id: SV-220829r958804_rule
severity: CAT I
title: Autoplay must be disabled for all drives.
cci: CCI-001764
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives.  If you enable this policy, you can also disable autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled:All Drives".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\

  Value Name: NoDriveTypeAutoRun

  Value Type: REG_DWORD
  Value: 0x000000ff (255)

  Note: If the value for NoDriveTypeAutorun is entered manually, it must be entered as "ff" when Hexadecimal is selected, or "255" with Decimal selected.  Using the policy value specified in the Fix section will enter it correctly.


vuln_id: V-220830
rule_id: SV-220830r991589_rule
severity: CAT II
title: Enhanced anti-spoofing for facial recognition must be enabled on Window 10.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> "Configure enhanced anti-spoofing" to "Enabled". 

  v1607:
  The policy name is "Use enhanced anti-spoofing when available".

check_text:
  Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures\

  Value Name: EnhancedAntiSpoofing

  Value Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220831
rule_id: SV-220831r958478_rule
severity: CAT III
title: Microsoft consumer experiences must be turned off.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps.  Organizations may control the execution of applications through other means such as whitelisting.  Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> "Turn off Microsoft consumer experiences" to "Enabled".

check_text:
  Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\

  Value Name: DisableWindowsConsumerFeatures

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220832
rule_id: SV-220832r958518_rule
severity: CAT II
title: Administrator accounts must not be enumerated during elevation.
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user.  This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\

  Value Name: EnumerateAdministrators

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220833
rule_id: SV-220833r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.

description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Enhanced" level for telemetry includes additional information beyond "Security" and "Basic" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a "limited enhanced" level to provide information such as health data for devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> "Limit Enhanced diagnostic data to the minimum required by Windows Analytics" to "Enabled" with "Enable Windows Analytics collection" selected in "Options:".

check_text:
  This setting requires v1709 or later of Windows 10; it is NA for prior versions.

  If "Enhanced" level is enabled for telemetry, this must be configured. If "Security" or "Basic" are configured, this is NA. (See V-220834).

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\

  Value Name: LimitEnhancedDiagnosticDataWindowsAnalytics

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220834
rule_id: SV-220834r991589_rule
severity: CAT II
title: Windows Telemetry must not be configured to Full.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services. "Enhanced" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a "limited enhanced" level to provide information such as health data for devices. This requires the configuration of an additional setting available with v1709 and later of Windows 10.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> "Allow Telemetry" to "Enabled" with "0 - Security [Enterprise Only]" or "1 - Basic" selected in "Options:". 

  If an organization is using v1709 or later of Windows 10, this may be configured to "2 - Enhanced" to support Windows Analytics. V-220833 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\

  Value Name: AllowTelemetry

  Type: REG_DWORD
  Value: 0x00000000 (0) (Security)
  0x00000001 (1) (Basic)

  If an organization is using v1709 or later of Windows 10, this may be configured to "Enhanced" to support Windows Analytics. V-220833 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).


vuln_id: V-220835
rule_id: SV-220835r991589_rule
severity: CAT III
title: Windows Update must not obtain updates from other PCs on the internet.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the internet. This is part of the Windows Update trusted process; however, to minimize outside exposure, obtaining updates from or sending to systems on the internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> "Download Mode" to "Enabled" with any option except "Internet" selected.

  Acceptable selections include:
  Bypass (100)
  Group (2)
  HTTP only (0)
  LAN (1)
  Simple (99)

  v1507 (LTSB) does not include this group policy setting locally. For domain-joined systems, configure through domain group policy as "HTTP only (0)" or "Lan (1)". 

  For standalone or nondomain-joined systems, configure using Settings >> Update & Security >> Windows Update >> Advanced Options >> "Choose how updates are delivered" with either "Off" or "PCs on my local network" selected.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\

  Value Name: DODownloadMode

  Value Type: REG_DWORD
  Value: 0x00000000 (0) - No peering (HTTP Only)
  0x00000001 (1) - Peers on same NAT only (LAN)
  0x00000002 (2) - Local Network / Private group peering (Group)
  0x00000063 (99) - Simple download mode, no peering (Simple)
  0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass)

  A value of 0x00000003 (3), Internet, is a finding.

  v1507 LTSB:
  Domain joined systems:
  Verify the registry value above.
  If the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding.

  Standalone or nondomain-joined systems (configured in Settings):
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\

  Value Name: DODownloadMode

  Value Type: REG_DWORD
  Value: 0x00000000 (0) - Off
  0x00000001 (1) - LAN


vuln_id: V-220836
rule_id: SV-220836r958478_rule
severity: CAT II
title: The Windows Defender SmartScreen for Explorer must be enabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows Defender SmartScreen" to "Enabled" with "Warn and prevent bypass" selected. 

  Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.

  v1607 LTSB:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled". (Selection options are not available.)

  v1507 LTSB:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with "Require approval from an administrator before running downloaded unknown software" selected.

check_text:
  This is applicable to unclassified systems, for other systems this is NA.

  If the following registry values do not exist or are not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: EnableSmartScreen

  Value Type: REG_DWORD
  Value: 0x00000001 (1)

  And

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: ShellSmartScreenLevel

  Value Type: REG_SZ
  Value: Block

  v1607 LTSB:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: EnableSmartScreen

  Value Type: REG_DWORD
  Value: 0x00000001 (1)

  v1507 LTSB:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\

  Value Name: EnableSmartScreen

  Value Type: REG_DWORD
  Value: 0x00000002 (2)


vuln_id: V-220837
rule_id: SV-220837r958928_rule
severity: CAT II
title: Explorer Data Execution Prevention must be enabled.
cci: CCI-002824
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing  checks on memory to help prevent malicious code from running.  This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for data execution prevention to be turned on for file explorer.

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off Data Execution Prevention for Explorer" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for data execution prevention to be turned on for file explorer.

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "0", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\

  Value Name: NoDataExecutionPrevention

  Value Type: REG_DWORD
  Value: 0 (or if the Value Name does not exist)


vuln_id: V-220838
rule_id: SV-220838r958902_rule
severity: CAT III
title: Turning off File Explorer heap termination on corruption must be disabled.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt.  Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for File Explorer heap termination on corruption to be enabled.

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for File Explorer heap termination on corruption to be enabled.

  If the registry Value Name below does not exist, this is not a finding.

  If it exists and is configured with a value of "0", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\

  Value Name: NoHeapTerminationOnCorruption

  Value Type: REG_DWORD
  Value: 0x00000000 (0) (or if the Value Name does not exist)


vuln_id: V-220839
rule_id: SV-220839r991589_rule
severity: CAT II
title: File Explorer shell protocol must run in protected mode.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The shell protocol will  limit the set of folders applications can open when run in protected mode.  Restricting files an application can open, to a limited set of folders, increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for shell protected mode to be turned on for file explorer.

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off shell protocol protected mode" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for shell protected mode to be turned on for file explorer.

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "0", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

  Value Name: PreXPSP2ShellProtocolBehavior

  Value Type: REG_DWORD
  Value: 0 (or if the Value Name does not exist)


vuln_id: V-220840
rule_id: SV-220840r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.

description:
  <VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent bypassing Windows Defender SmartScreen prompts for sites" to "Enabled". 

  Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.

check_text:
  This is applicable to unclassified systems, for other systems this is NA.

  Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\

  Value Name: PreventOverride

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220841
rule_id: SV-220841r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.

description:
  <VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent bypassing Windows Defender SmartScreen prompts for files" to "Enabled". 

  Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.

check_text:
  This is applicable to unclassified systems, for other systems this is NA.

  Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\

  Value Name: PreventOverrideAppRepUnknown

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220842
rule_id: SV-220842r991589_rule
severity: CAT II
title: Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent certificate error overrides" to "Enabled".

check_text:
  This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions.

  Windows 10 LTSC\B versions do not include Microsoft Edge; this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings\

  Value Name: PreventCertErrorOverrides

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220843
rule_id: SV-220843r991589_rule
severity: CAT II
title: The password manager function in the Edge browser must be disabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Configure Password Manager" to "Disabled".

check_text:
  Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\

  Value Name: FormSuggest Passwords

  Type: REG_SZ
  Value: no


vuln_id: V-220844
rule_id: SV-220844r991589_rule
severity: CAT II
title: The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Configure Windows Defender SmartScreen" to "Enabled". 

  Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.

check_text:
  This is applicable to unclassified systems, for other systems this is NA.

  Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\

  Value Name: EnabledV9

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220845
rule_id: SV-220845r958478_rule
severity: CAT II
title: Windows 10 must be configured to disable Windows Game Recording and Broadcasting.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> "Enables or disables Windows Game Recording and Broadcasting" to "Disabled".

check_text:
  This is NA for Windows 10 LTSC\B versions 1507 and 1607.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\GameDVR\

  Value Name: AllowGameDVR

  Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220846
rule_id: SV-220846r991589_rule
severity: CAT II
title: The use of a hardware security device with Windows Hello for Business must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security.  Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> "Use a hardware security device" to "Enabled". 

  v1507 LTSB:
  The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work.

check_text:
  Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\

  Value Name: RequireSecurityDevice

  Type: REG_DWORD
  Value: 1


vuln_id: V-220847
rule_id: SV-220847r991589_rule
severity: CAT II
title: Windows 10 must be configured to require a minimum pin length of six characters or greater.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised.  Longer minimum PIN lengths increase the available combinations an attacker would have to attempt.  Shorter minimum length significantly reduces the strength.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> "Minimum PIN length" to "6" or greater. 

  v1607 LTSB:
  The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> Pin Complexity.

  v1507 LTSB:
  The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work >> Pin Complexity.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\

  Value Name:  MinimumPINLength

  Type:  REG_DWORD
  Value:  6 (or greater)


vuln_id: V-220848
rule_id: SV-220848r1051029_rule
severity: CAT II
title: Passwords must not be saved in the Remote Desktop Client.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> "Do not allow passwords to be saved" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: DisablePasswordSaving

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220849
rule_id: SV-220849r1137695_rule
severity: CAT II
title: Local drives must be prevented from sharing with Remote Desktop Session Hosts.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> "Do not allow drive redirection" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: fDisableCdm

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220850
rule_id: SV-220850r1051030_rule
severity: CAT II
title: Remote Desktop Services must always prompt a client for passwords upon connection.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Always prompt for password upon connection" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: fPromptForPassword

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220851
rule_id: SV-220851r991554_rule
severity: CAT II
title: The Remote Desktop Session Host must require secure RPC communications.
cci: CCI-001453
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security "Require secure RPC communication" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: fEncryptRPCTraffic

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220852
rule_id: SV-220852r958408_rule
severity: CAT II
cci: CCI-000068,CCI-002890
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Remote Desktop Services must be configured with the client connection encryption set to the required level.

description:
  <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Set client connection encryption level" to "Enabled" and "High Level".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\

  Value Name: MinEncryptionLevel

  Value Type: REG_DWORD
  Value: 3


vuln_id: V-220853
rule_id: SV-220853r991589_rule
severity: CAT II
title: Attachments must be prevented from being downloaded from RSS feeds.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Attachments from RSS feeds may not be secure.  This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Prevent downloading of enclosures" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\

  Value Name: DisableEnclosureDownload

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220854
rule_id: SV-220854r958478_rule
severity: CAT II
title: Basic authentication for RSS feeds over HTTP must not be used.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Turn on Basic feed authentication over HTTP" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "0", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\

  Value Name: AllowBasicAuthInClear

  Value Type: REG_DWORD
  Value: 0 (or if the Value Name does not exist)


vuln_id: V-220855
rule_id: SV-220855r958478_rule
severity: CAT II
title: Indexing of encrypted files must be turned off.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Indexing of encrypted files may expose sensitive data.  This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> "Allow indexing of encrypted files" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\

  Value Name: AllowIndexingEncryptedStoresOrItems

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220856
rule_id: SV-220856r1051031_rule
severity: CAT II
title: Users must be prevented from changing installation options.
cci: CCI-003980,CCI-001812
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\

  Value Name: EnableUserControl

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220857
rule_id: SV-220857r1051032_rule
severity: CAT I
title: The Windows Installer Always install with elevated privileges must be disabled.
cci: CCI-003980,CCI-001812
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\

  Value Name: AlwaysInstallElevated

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220858
rule_id: SV-220858r991589_rule
severity: CAT II
title: Users must be notified if a web-based program attempts to install software.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Web-based programs may attempt to install malicious software on a system.  Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.

  If the registry value name below does not exist, this is not a finding.

  If it exists and is configured with a value of "0", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\

  Value Name: SafeForScripting

  Value Type: REG_DWORD
  Value: 0 (or if the Value Name does not exist)


vuln_id: V-220859
rule_id: SV-220859r991591_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Automatically signing in the last interactive user after a system-initiated restart must be disabled.

description:
  <VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart.  Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: DisableAutomaticRestartSignOn

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220860
rule_id: SV-220860r958422_rule
severity: CAT II
title: PowerShell script block logging must be enabled on Windows 10.
cci: CCI-000135
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts.  This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE 
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\

  Value Name: EnableScriptBlockLogging

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220862
rule_id: SV-220862r958510_rule
severity: CAT I
title: The Windows Remote Management (WinRM) client must not use Basic authentication.
cci: CCI-000877
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\

  Value Name: AllowBasic

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220863
rule_id: SV-220863r958848_rule
severity: CAT II
title: The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
cci: CCI-002890,CCI-003123
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\

  Value Name: AllowUnencryptedTraffic

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220865
rule_id: SV-220865r958510_rule
severity: CAT I
title: The Windows Remote Management (WinRM) service must not use Basic authentication.
cci: CCI-000877
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".

  Severity Override Guidance: The AO can allow the severity override if they have reviewed the overall protection. This would only be allowed temporarily for implementation as documented and approved. 
  ….
  Allowing Basic authentication to be used for the sole creation of Office 365 DoD tenants.
  ….
  A documented mechanism and or script that can disable Basic authentication once administration completes. 
  ….
  Use of a Privileged Access Workstation (PAW) and adherence to the Clean Source principle for administration.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\

  Value Name: AllowBasic

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220866
rule_id: SV-220866r958848_rule
severity: CAT II
title: The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
cci: CCI-002890,CCI-003123
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\

  Value Name: AllowUnencryptedTraffic

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220867
rule_id: SV-220867r1051033_rule
severity: CAT II
title: The Windows Remote Management (WinRM) service must not store RunAs credentials.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\

  Value Name: DisableRunAs

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220868
rule_id: SV-220868r958510_rule
severity: CAT II
title: The Windows Remote Management (WinRM) client must not use Digest authentication.
cci: CCI-000877
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\

  Value Name: AllowDigest

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220869
rule_id: SV-220869r958400_rule
severity: CAT II
cci: CCI-000056
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.

description:
  <VulnDiscussion>Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice while the system is locked" to "Enabled" with “Default for all Apps:” set to “Force Deny”. 

  The requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice" is configured to "Enabled" with “Default for all Apps:” set to “Force Deny”.

check_text:
  This setting requires v1903 or later of Windows 10; it is NA for prior versions.  The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users.
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\

  Value Name: LetAppsActivateWithVoiceAboveLock

  Type: REG_DWORD
  Value: 0x00000002 (2)

  If the following registry value exists and is configured as specified, requirement is NA. 

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\

  Value Name: LetAppsActivateWithVoice

  Type: REG_DWORD
  Value: 0x00000002 (2)


vuln_id: V-220870
rule_id: SV-220870r958478_rule
severity: CAT II
title: The convenience PIN for Windows 10 must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable the convenience PIN sign-in. 

  If this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> Set "Turn on convenience PIN sign-in" to "Disabled”.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Microsoft\Windows\System

  Value Name: AllowDomainPINLogon
  Value Type: REG_DWORD
  Value data: 0


vuln_id: V-220871
rule_id: SV-220871r958478_rule
severity: CAT II
title: Windows Ink Workspace must be configured to disallow access above the lock.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>This action secures Windows Ink, which contains applications and features oriented toward pen computing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable the convenience PIN sign-in. 

  If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace >> Set "Allow Windows Ink Workspace" to "Enabled” and set Options "On, but disallow access above lock".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Microsoft\WindowsInkWorkspace

  Value Name: AllowWindowsInkWorkspace
  Value Type: REG_DWORD
  Value data: 1


vuln_id: V-220872
rule_id: SV-220872r958478_rule
severity: CAT III
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications.

description:
  <VulnDiscussion>Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> "Do not suggest third-party content in Windows spotlight" to "Enabled

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  If the following registry value does not exist or is not configured as specified, this is a finding: 

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\

  Value Name: DisableThirdPartySuggestions

  Type: REG_DWORD
  Value: 0x00000001 (1)


vuln_id: V-220902
rule_id: SV-220902r1137695_rule
severity: CAT II
title: Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kernel DMA Protection >> "Enumeration policy for external devices incompatible with Kernel DMA Protection" to "Enabled" with "Enumeration Policy" set to "Block All".

check_text:
  This is NA prior to v1803 of Windows 10.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Microsoft\Windows\Kernel DMA Protection

  Value Name: DeviceEnumerationPolicy
  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220903
rule_id: SV-220903r958448_rule
severity: CAT II
title: The DoD Root CA certificates must be installed in the Trusted Root Store.
cci: CCI-000185,CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the DoD Root CA certificates:
  DoD Root CA 3
  DoD Root CA 4
  DoD Root CA 5
  DoD Root CA 6

  The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.

check_text:
  Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities.

  The certificates and thumbprints referenced below apply to unclassified systems; refer to PKE documentation for other networks.

  Run "PowerShell" as an administrator.

  Execute the following command:

  Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter

  If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding.

  Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
  Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB
  NotAfter: 12/30/2029

  Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US
  Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026
  NotAfter: 7/25/2032

  Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US
  Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B
  NotAfter: 6/14/2041

  Subject: CN=DoD Root CA 6, OU=PKI, OU=DoD, O=U.S. Government, C=US 
  Thumbprint : D37ECF61C0B4ED88681EF3630C4E2FC787B37AEF
  NotAfter: 1/24/2053

  Alternately, use the Certificates MMC snap-in:

  Run "MMC".

  Select "File", "Add/Remove Snap-in".

  Select "Certificates", click "Add".

  Select "Computer account", click "Next".

  Select "Local computer: (the computer this console is running on)", click "Finish".

  Click "OK".

  Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates".

  For each of the DoD Root CA certificates noted below:

  Right-click on the certificate and select "Open".

  Select the "Details" tab.

  Scroll to the bottom and select "Thumbprint".

  If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

  DoD Root CA 3
  Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB
  Valid to: Sunday, December 30, 2029

  DoD Root CA 4
  Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026
  Valid to: Sunday, July 25, 2032

  DoD Root CA 5
  Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B
  Valid to: Friday, June 14, 2041

  DoD Root CA 6
  Thumbprint : D37ECF61C0B4ED88681EF3630C4E2FC787B37AEF
   Valid to: Friday, January 24, 2053


vuln_id: V-220904
rule_id: SV-220904r958448_rule
severity: CAT II
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.

description:
  <VulnDiscussion>To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the ECA Root CA certificate on unclassified systems.
  ECA Root CA 4

  The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.

check_text:
  Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.

  Run "PowerShell" as an administrator.

  Execute the following command:

  Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter

  If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. 

  Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
  Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
  NotAfter: 12/30/2029

  Alternately use the Certificates MMC snap-in:

  Run "MMC".

  Select "File", "Add/Remove Snap-in".

  Select "Certificates", click "Add".

  Select "Computer account", click "Next".

  Select "Local computer: (the computer this console is running on)", click "Finish".

  Click "OK".

  Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates".

  For each of the ECA Root CA certificates noted below:

  Right-click on the certificate and select "Open".

  Select the "Details" Tab.

  Scroll to the bottom and select "Thumbprint".

  If the ECA Root CA certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

  ECA Root CA 4
  Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
  Valid to: Sunday, December 30, 2029


vuln_id: V-220905
rule_id: SV-220905r958448_rule
severity: CAT II
cci: CCI-000185,CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.

description:
  <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the DoD Interoperability Root CA cross-certificates on unclassified systems.

  Issued To - Issued By - Thumbprint

  DoD Root CA 3 - DoD Interoperability Root CA 2 - 49CBE933151872E17C8EAE7F0ABA97FB610F6477 
                    
  The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.

check_text:
  Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.

  Run "PowerShell" as an administrator.

  Execute the following command:

  Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter

  If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding.

  Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
  Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
  Thumbprint: 49CBE933151872E17C8EAE7F0ABA97FB610F6477
  NotAfter: 11/16/2024 

  Alternately, use the Certificates MMC snap-in:

  Run "MMC".

  Select "File", "Add/Remove Snap-in".

  Select "Certificates", click "Add".

  Select "Computer account", click "Next".

  Select "Local computer: (the computer this console is running on)", click "Finish".

  Click "OK".

  Expand "Certificates" and navigate to Untrusted Certificates >> Certificates.

  For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By":

  Right-click on the certificate and select "Open".

  Select the "Details" tab.

  Scroll to the bottom and select "Thumbprint".

  If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

  Issued To: DoD Root CA 3
  Issued By: DoD Interoperability Root CA 2
  Thumbprint: 49CBE933151872E17C8EAE7F0ABA97FB610F6477
  Valid to: Wednesday, November 16, 2024


vuln_id: V-220906
rule_id: SV-220906r1081051_rule
severity: CAT II
cci: CCI-000185,CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The US DOD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.

description:
  <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DOD websites due to the system chaining to a root other than DOD Root CAs, the US DOD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the US DOD CCEB Interoperability Root CA cross-certificate on unclassified systems.

  Issued To - Issued By - Thumbprint
  DOD Root CA 3 - US DOD CCEB Interoperability Root CA 2  9B74964506C7ED9138070D08D5F8B969866560C8
  Issued To: DOD Root CA 6
  Issued By: US DOD CCEB Interoperability Root CA 2
  Thumbprint: D471CA32F7A692CE6CBB6196BD3377FE4DBCD106
  NotAfter: 7/18/2026

  The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.

check_text:
  Verify the US DOD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.

  Run "PowerShell" as an administrator.

  Execute the following command:

  Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter

  If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. 

  Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
  NotAfter: 7/18/2025 9:56:22 AM

  Alternately, use the Certificates MMC snap-in:

  Run "MMC".

  Select "File", then click "Add/Remove Snap-in".

  Select "Certificates", then click "Add".

  Select "Computer account", then click "Next".

  Select "Local computer: (the computer this console is running on)", then click "Finish".

  Click "OK".

  Expand "Certificates" and navigate to Untrusted Certificates >> Certificates.

  For each certificate with "US DOD CCEB Interoperability Root CA …" under "Issued By":

  Right-click on the certificate and select "Open".

  Select the "Details" tab.

  Scroll to the bottom and select "Thumbprint".

  If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

  Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
  NotAfter: 7/18/2025 9:56:22 AM                                                          
  Subject: CN=DOD Root CA 6, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
  Thumbprint: D471CA32F7A692CE6CBB6196BD3377FE4DBCD106
  NotAfter: 7/18/2026 9:56:22 AM


vuln_id: V-220907
rule_id: SV-220907r958726_rule
severity: CAT II
title: Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.

  The default permissions of the higher level keys are noted below.

  HKEY_LOCAL_MACHINE\SECURITY
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  SYSTEM - Full Control - This key and subkeys
  Administrators - Special - This key and subkeys

  HKEY_LOCAL_MACHINE\SOFTWARE
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  Users - Read - This key and subkeys
  Administrators - Full Control - This key and subkeys
  SYSTEM - Full Control - This key and subkeys
  CREATOR OWNER - Full Control - This key and subkeys
  ALL APPLICATION PACKAGES - Read - This key and subkeys

  HKEY_LOCAL_MACHINE\SYSTEM
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  Users - Read - This key and subkeys
  Administrators - Full Control - This key and subkeys
  SYSTEM - Full Control - This key and subkeys
  CREATOR OWNER - Full Control - This key and subkeys
  ALL APPLICATION PACKAGES - Read - This key and subkeys

  Microsoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID.

  S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681

check_text:
  Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.

  If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.

  Run "Regedit".
  Right click on the registry areas noted below.
  Select "Permissions..." and the "Advanced" button.

  HKEY_LOCAL_MACHINE\SECURITY
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  SYSTEM - Full Control - This key and subkeys
  Administrators - Special - This key and subkeys

  HKEY_LOCAL_MACHINE\SOFTWARE
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  Users - Read - This key and subkeys
  Administrators - Full Control - This key and subkeys
  SYSTEM - Full Control - This key and subkeys
  CREATOR OWNER - Full Control - This key and subkeys
  ALL APPLICATION PACKAGES - Read - This key and subkeys

  HKEY_LOCAL_MACHINE\SYSTEM
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  Users - Read - This key and subkeys
  Administrators - Full Control - This key and subkeys
  SYSTEM - Full Control - This key and subkeys
  CREATOR OWNER - Full Control - This key and subkeys
  ALL APPLICATION PACKAGES - Read - This key and subkeys

  Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.

  Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.

  S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681

  If the defaults have not been changed, these are not a finding.


vuln_id: V-220908
rule_id: SV-220908r958482_rule
severity: CAT II
title: The built-in administrator account must be disabled.
cci: CCI-000764
deprecated_at: 2026-03-05 13:41:37
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Administrator account status" to "Disabled".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.

  If the value for "Accounts: Administrator account status" is not set to "Disabled", this is a finding.


vuln_id: V-220909
rule_id: SV-220909r958504_rule
severity: CAT II
title: The built-in guest account must be disabled.
cci: CCI-000804
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled.  This account is a known account that exists on all Windows systems and cannot be deleted.  This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.

  If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding.


vuln_id: V-220910
rule_id: SV-220910r991589_rule
severity: CAT II
title: Local accounts with blank passwords must be restricted to prevent access from the network.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required.  Password policies should prevent accounts with blank passwords from existing on a system.  However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: LimitBlankPasswordUse

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220911
rule_id: SV-220911r991589_rule
severity: CAT II
title: The built-in administrator account must be renamed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The built-in administrator account is a well-known account subject to attack.  Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename administrator account" to a name other than "Administrator".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.

  If the value for "Accounts: Rename administrator account" is set to "Administrator", this is a finding.


vuln_id: V-220912
rule_id: SV-220912r991589_rule
severity: CAT II
title: The built-in guest account must be renamed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password.  This can allow access to system resources by unauthorized users.  Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.

  If the value for "Accounts: Rename guest account" is set to "Guest", this is a finding.


vuln_id: V-220913
rule_id: SV-220913r958442_rule
severity: CAT II
title: Audit policy using subcategories must be enabled.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.  This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: SCENoApplyLegacyAuditPolicy

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220914
rule_id: SV-220914r958908_rule
severity: CAT II
title: Outgoing secure channel traffic must be encrypted or signed.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: RequireSignOrSeal

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220915
rule_id: SV-220915r958908_rule
severity: CAT II
title: Outgoing secure channel traffic must be encrypted when possible.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: SealSecureChannel

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220916
rule_id: SV-220916r958908_rule
severity: CAT II
title: Outgoing secure channel traffic must be signed when possible.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked.  If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: SignSecureChannel

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220917
rule_id: SV-220917r991589_rule
severity: CAT III
title: The computer account password must not be prevented from being reset.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Computer account passwords are changed automatically on a regular basis.  Disabling automatic password changes can make the system more vulnerable to malicious access.  Frequent password changes can be a significant safeguard for your system.  A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: DisablePasswordChange

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220918
rule_id: SV-220918r991589_rule
severity: CAT III
title: The maximum age for machine account passwords must be configured to 30 days or less.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Computer account passwords are changed automatically on a regular basis.  This setting controls the maximum password age that a machine account may have.  This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This is the default configuration for this setting (30 days).

  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding 0 which is unacceptable).

check_text:
  This is the default configuration for this setting (30 days).

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: MaximumPasswordAge

  Value Type: REG_DWORD
  Value: 0x0000001e (30)  (or less, excluding 0)


vuln_id: V-220919
rule_id: SV-220919r958908_rule
severity: CAT II
title: The system must be configured to require a strong session key.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel.  Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\

  Value Name: RequireStrongKey

  Value Type: REG_DWORD
  Value: 1
   
  Warning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.


vuln_id: V-220920
rule_id: SV-220920r958402_rule
severity: CAT II
title: The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
cci: CCI-000057
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended.  The screen saver should be set at a maximum of 15 minutes and be password protected.  This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: InactivityTimeoutSecs

  Value Type: REG_DWORD
  Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)


vuln_id: V-220921
rule_id: SV-220921r958390_rule
severity: CAT II
title: The required legal notice must be configured to display before console logon.
cci: CCI-000048,CCI-000050,CCI-001384,CCI-001385,CCI-001386,CCI-001387,CCI-001388
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Message text for users attempting to log on" to the following.

  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

  By using this IS (which includes any device attached to this IS), you consent to the following conditions:

  -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

  -At any time, the USG may inspect and seize data stored on this IS.

  -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

  -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

  -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: LegalNoticeText

  Value Type: REG_SZ
  Value: 
  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

  By using this IS (which includes any device attached to this IS), you consent to the following conditions:

  -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

  -At any time, the USG may inspect and seize data stored on this IS.

  -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

  -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

  -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.


vuln_id: V-220922
rule_id: SV-220922r958390_rule
severity: CAT III
title: The Windows dialog box title for the legal banner must be configured.
cci: CCI-000048,CCI-001384,CCI-001385,CCI-001386,CCI-001387,CCI-001388
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent.

  If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: LegalNoticeCaption

  Value Type: REG_SZ
  Value: See message title above

  "DoD Notice and Consent Banner", "US Department of Defense Warning Statement" or a site-defined equivalent, this is a finding.

  If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.


vuln_id: V-220923
rule_id: SV-220923r991589_rule
severity: CAT III
title: Caching of logon credentials must be limited.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system.  This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable.  Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This is the default configuration for this setting (10 logons to cache).

  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Number of previous logons to cache (in case domain controller is not available)" to "10" logons or less.

  This setting only applies to domain-joined systems, however, it is configured by default on all systems.

check_text:
  This is the default configuration for this setting (10 logons to cache).

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE 
  Registry Path:  \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

  Value Name:  CachedLogonsCount

  Value Type:  REG_SZ
  Value:  10 (or less)

  This setting only applies to domain-joined systems, however, it is configured by default on all systems.


vuln_id: V-220924
rule_id: SV-220924r991589_rule
severity: CAT II
title: The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked.  Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Smart card removal behavior" to  "Lock Workstation" or "Force Logoff".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

  Value Name:  SCRemoveOption

  Value Type:  REG_SZ
  Value:  1 (Lock Workstation) or 2 (Force Logoff)

  This can be left not configured or set to "No action" on workstations with the following conditions.  This must be documented with the ISSO.
  -The setting cannot be configured due to mission needs, or because it interferes with applications.
  -Policy must be in place that users manually lock workstations when leaving them unattended.
  -The screen saver is properly configured to lock as required.


vuln_id: V-220925
rule_id: SV-220925r958908_rule
severity: CAT II
title: The Windows SMB client must be configured to always perform SMB packet signing.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\

  Value Name: RequireSecuritySignature

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220926
rule_id: SV-220926r987796_rule
severity: CAT II
title: Unencrypted passwords must not be sent to third-party SMB Servers.
cci: CCI-000197
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication.  Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment.  Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Send unencrypted password to third-party SMB servers" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\

  Value Name:  EnablePlainTextPassword

  Value Type:  REG_DWORD
  Value:  0


vuln_id: V-220927
rule_id: SV-220927r958908_rule
severity: CAT II
title: The Windows SMB server must be configured to always perform SMB packet signing.
cci: CCI-002418,CCI-002421
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (always)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\

  Value Name: RequireSecuritySignature

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220928
rule_id: SV-220928r991589_rule
severity: CAT I
title: Anonymous SID/Name translation must not be allowed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system.  Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.

  If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.


vuln_id: V-220929
rule_id: SV-220929r991589_rule
severity: CAT I
title: Anonymous enumeration of SAM accounts must not be allowed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: RestrictAnonymousSAM

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220930
rule_id: SV-220930r1137695_rule
severity: CAT I
title: Anonymous enumeration of shares must be restricted.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: RestrictAnonymous

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220931
rule_id: SV-220931r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The system must be configured to prevent anonymous users from having the same rights as the Everyone group.

description:
  <VulnDiscussion>Access by anonymous users must be restricted.  If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group.  Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Let Everyone permissions apply to anonymous users" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: EveryoneIncludesAnonymous

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220932
rule_id: SV-220932r1137695_rule
severity: CAT I
title: Anonymous access to Named Pipes and Shares must be restricted.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access.  This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously",  both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\

  Value Name: RestrictNullSessAccess

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220933
rule_id: SV-220933r1081053_rule
severity: CAT II
title: Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The Windows SAM stores users' passwords. Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict clients allowed to make remote calls to SAM".

  Select "Edit Security" to configure the "Security descriptor:".

  Add "Administrators" in "Group or user names:" if it is not already listed (this is the default).

  Select "Administrators" in "Group or user names:".

  Select "Allow" for "Remote Access" in "Permissions for "Administrators".

  Click "OK".

  The "Security descriptor:" must be populated with "O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.

check_text:
  Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: RestrictRemoteSAM

  Value Type: REG_SZ
  Value: O:BAG:BAD:(A;;RC;;;BA)                                                   

  If a domain application account such as for a management tool requires this user right, this is not a finding.
  Vendor documentation must support the requirement for having the user right.
  The requirement must be documented with the ISSO.


vuln_id: V-220934
rule_id: SV-220934r991589_rule
severity: CAT II
title: NTLM must be prevented from falling back to a Null session.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\

  Value Name: allownullsessionfallback

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220935
rule_id: SV-220935r991589_rule
severity: CAT II
title: PKU2U authentication using online identities must be prevented.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol.   This setting prevents online identities from authenticating to domain-joined systems.  Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\

  Value Name: AllowOnlineID

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220936
rule_id: SV-220936r971535_rule
severity: CAT II
title: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Certain encryption types are no longer considered secure.  This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected:

  AES128_HMAC_SHA1
  AES256_HMAC_SHA1
  Future encryption types

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\

  Value Name: SupportedEncryptionTypes

  Value Type: REG_DWORD
  Value: 0x7ffffff8 (2147483640)


vuln_id: V-220937
rule_id: SV-220937r1051034_rule
severity: CAT I
title: The system must be configured to prevent the storage of the LAN Manager hash of passwords.
cci: CCI-004062,CCI-000196
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: NoLMHash

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220938
rule_id: SV-220938r991589_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.

description:
  <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts.  NTLM, which is less secure, is retained in later Windows versions  for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it.  It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\

  Value Name: LmCompatibilityLevel

  Value Type: REG_DWORD
  Value: 5


vuln_id: V-220939
rule_id: SV-220939r991589_rule
severity: CAT II
title: The system must be configured to the required LDAP client signing level.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>This setting controls the signing requirements for LDAP clients.  This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\

  Value Name: LDAPClientIntegrity

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220940
rule_id: SV-220940r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.

description:
  <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\

  Value Name: NTLMMinClientSec

  Value Type: REG_DWORD
  Value: 0x20080000 (537395200)


vuln_id: V-220941
rule_id: SV-220941r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.

description:
  <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\

  Value Name: NTLMMinServerSec

  Value Type: REG_DWORD
  Value: 0x20080000 (537395200)


vuln_id: V-220942
rule_id: SV-220942r1137699_rule
severity: CAT II
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.

description:
  <VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing.  FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\

  Value Name: Enabled

  Value Type: REG_DWORD
  Value: 1
   
  Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.


vuln_id: V-220943
rule_id: SV-220943r991589_rule
severity: CAT III
title: The default permissions of global system objects must be increased.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\

  Value Name: ProtectionMode

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220944
rule_id: SV-220944r1051035_rule
severity: CAT II
title: User Account Control approval mode for the built-in Administrator must be enabled.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: FilterAdministratorToken

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220945
rule_id: SV-220945r958518_rule
severity: CAT II
title: User Account Control must, at minimum, prompt administrators for consent on the secure desktop.
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: ConsentPromptBehaviorAdmin

  Value Type: REG_DWORD
  Value: 2 (Prompt for consent on the secure desktop)


vuln_id: V-220946
rule_id: SV-220946r1153410_rule
severity: CAT II
cci: CCI-000765
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.

description:
  <VulnDiscussion>Without the use of multifactor authentication, the ease of access to privileged and nonprivileged functions is greatly increased. 

  All domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. 

  Multifactor authentication requires using two or more factors to achieve authentication.

  Factors include: 

  1) Something a user knows (e.g., password/PIN);
  2) Something a user has (e.g., cryptographic identification device, token); and
  3) Something a user is (e.g., biometric).

  A privileged account is defined as an information system account with authorizations of a privileged user.

  Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).

  Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.

  The DOD CAC with DOD-approved PKI is an example of multifactor authentication.

  Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For nondomain-joined systems, configuring Windows Hello for sign-on options is suggested based on the organization's needs and capabilities.

check_text:
  If the system is not a member of a domain, this is Not Applicable.

  If all of the following settings exist and are populated, this is not a finding.

  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers
  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards


vuln_id: V-220947
rule_id: SV-220947r1051036_rule
severity: CAT II
title: User Account Control must automatically deny elevation requests for standard users.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges. This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: ConsentPromptBehaviorUser

  Value Type: REG_DWORD
  Value: 0


vuln_id: V-220948
rule_id: SV-220948r958518_rule
severity: CAT II
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  User Account Control must be configured to detect application installations and prompt for elevation.

description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: EnableInstallerDetection

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220949
rule_id: SV-220949r958518_rule
severity: CAT II
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  User Account Control must only elevate UIAccess applications that are installed in secure locations.

description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: EnableSecureUIAPaths

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220950
rule_id: SV-220950r1051037_rule
severity: CAT II
title: User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
cci: CCI-002038
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: EnableLUA

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220951
rule_id: SV-220951r958518_rule
severity: CAT II
title: User Account Control must virtualize file and registry write failures to per-user locations.
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

  Value Name: EnableVirtualization

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220952
rule_id: SV-220952r1051038_rule
severity: CAT II
title: Passwords for enabled local Administrator accounts must be changed at least every 60 days.
cci: CCI-004066,CCI-000199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password may not be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.

  Windows LAPS must be used to change the built-in Administrator account password.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Change the enabled local Administrator account password at least every 60 days. Windows LAPS must be used to change the built-in Administrator account password. Domain-joined systems can configure this to occur more frequently. LAPS will change the password every 30 days by default. 

  More information is available at:
  https://techcommunity.microsoft.com/t5/windows-it-pro-blog/by-popular-demand-windows-laps-available-now/ba-p/3788747
  https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#windows-laps-supported-platforms-and-azure-ad-laps-preview-status

check_text:
  If there are no enabled local Administrator accounts, this is Not Applicable.

  Review the password last set date for the enabled local Administrator account.

  On the standalone or domain-joined workstation:

  Open "PowerShell".

  Enter "Get-LocalUser -Name * | Select-Object *".

  If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding.

  Verify LAPS is configured and operational. 

  Navigate to Local Computer Policy >> Computer Configuration >> Administrative Templates >> System >> LAPS >> Password Settings >> Set to enabled. Password Complexity, large letters + small letters + numbers + special, Password Length 14, Password Age 60. If not configured as shown, this is a finding. 

  Verify LAPS Operational logs >> Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> LAPS >> Operational. Verify LAPS policy process is completing. If it is not, this is a finding.


vuln_id: V-220954
rule_id: SV-220954r958478_rule
severity: CAT III
title: Toast notifications to the lock screen must be turned off.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> "Turn off toast notifications on the lock screen" to "Enabled".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\

  Value Name: NoToastApplicationNotificationOnLockScreen

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-220955
rule_id: SV-220955r991589_rule
severity: CAT II
title: Zone information must be preserved when saving attachments.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The default behavior is for Windows to mark file attachments with their zone information.

  If this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".

check_text:
  The default behavior is for Windows to mark file attachments with their zone information.

  If the registry Value Name below does not exist, this is not a finding.

  If it exists and is configured with a value of "2", this is not a finding.

  If it exists and is configured with a value of "1", this is a finding.

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\

  Value Name: SaveZoneInformation

  Value Type: REG_DWORD
  Value: 0x00000002 (2) (or if the Value Name does not exist)


vuln_id: V-220956
rule_id: SV-220956r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts are granted the "Access Credential Manager as a trusted caller" user right, this is a finding.


vuln_id: V-220957
rule_id: SV-220957r1137691_rule
severity: CAT II
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Access this computer from the network" user right may access resources on the system, and must be limited to those that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to only include the following groups or accounts:

  Administrators   
  Remote Desktop Users

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Access this computer from the network" user right, this is a finding:

  Administrators
  Remote Desktop Users

  If a domain application account such as for a management tool requires this user right, this would not be a finding.

  Vendor documentation must support the requirement for having the user right.

  The requirement must be documented with the ISSO.

  The application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.


vuln_id: V-220958
rule_id: SV-220958r958726_rule
severity: CAT I
title: The Act as part of the operating system user right must not be assigned to any groups or accounts.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access.  Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding.


vuln_id: V-220959
rule_id: SV-220959r1137691_rule
severity: CAT II
title: The Allow log on locally user right must only be assigned to the Administrators and Users groups.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to only include the following groups or accounts:

  Administrators
  Users

check_text:
  Verify the effective setting in Local Group Policy Editor.

  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Allow log on locally" user right, this is a finding:

  Administrators
  Users


vuln_id: V-220960
rule_id: SV-220960r958726_rule
severity: CAT II
title: The Back up files and directories user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data."</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Back up files and directories" user right, this is a finding:

  Administrators


vuln_id: V-220961
rule_id: SV-220961r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\autotimesvc.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Change the system time" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries.

  The NT SERVICE\autotimesvc is added in v1909 cumulative update. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Change the system time" to only include the following groups or accounts:

  Administrators
  LOCAL SERVICE
  NT SERVICE\autotimesvc is added in v1909 cumulative update.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Change the system time" user right, this is a finding:

  Administrators
  LOCAL SERVICE
  NT SERVICE\autotimesvc is added in v1909 cumulative update.


vuln_id: V-220962
rule_id: SV-220962r958726_rule
severity: CAT II
title: The Create a pagefile user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Create a pagefile" user right, this is a finding:

  Administrators


vuln_id: V-220963
rule_id: SV-220963r958726_rule
severity: CAT I
title: The Create a token object user right must not be assigned to any groups or accounts.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts are granted the "Create a token object" user right, this is a finding.


vuln_id: V-220964
rule_id: SV-220964r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to only include the following groups or accounts:

  Administrators
  LOCAL SERVICE
  NETWORK SERVICE
  SERVICE

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Create global objects" user right, this is a finding:

  Administrators
  LOCAL SERVICE
  NETWORK SERVICE
  SERVICE


vuln_id: V-220965
rule_id: SV-220965r958726_rule
severity: CAT II
title: The Create permanent shared objects user right must not be assigned to any groups or accounts.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts are granted the "Create permanent shared objects" user right, this is a finding.


vuln_id: V-220966
rule_id: SV-220966r958726_rule
severity: CAT II
title: The Create symbolic links user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Create symbolic links" user right, this is a finding:

  Administrators

  If the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, "NT VIRTUAL MACHINES\VIRTUAL MACHINE" may be assigned this user right and is not a finding.


vuln_id: V-220967
rule_id: SV-220967r958726_rule
severity: CAT I
title: The Debug programs user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Debug Programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components.  This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Debug Programs" user right, this is a finding:

  Administrators


vuln_id: V-220968
rule_id: SV-220968r1137691_rule
severity: CAT II
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  The "Deny access to this computer from the network" right defines the accounts that are prevented from logging on from the network.

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.

  Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.

  The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following.

  Domain Systems Only:
  Enterprise Admins group
  Domain Admins group
  Local account (see Note below)

  All Systems:
  Guests group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.

check_text:
  Verify the effective setting in Local Group Policy Editor.

  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If the following groups or accounts are not defined for the "Deny access to this computer from the network" right, this is a finding:

  Domain Systems Only:
  Enterprise Admins group
  Domain Admins group
  Local account (see Note below)

  All Systems:
  Guests group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.


vuln_id: V-220969
rule_id: SV-220969r1137691_rule
severity: CAT II
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The "Deny log on as a batch job" user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  The "Deny log on as a batch job" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks that could lead to the compromise of an entire domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following:

  Domain Systems Only:
  Enterprise Admin Group
  Domain Admin Group

check_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If the following groups or accounts are not defined for the "Deny log on as a batch job" right, this is a finding.

  Domain Systems Only:
  Enterprise Admin Group
  Domain Admin Group


vuln_id: V-220970
rule_id: SV-220970r1137691_rule
severity: CAT II
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  The "Deny log on as a service" right defines accounts that are denied log on as a service.

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.

  Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include the following:

  Domain Systems Only:
  Enterprise Admins Group
  Domain Admins Group

check_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If the following groups or accounts are not defined for the "Deny log on as a service" right , this is a finding.

  Domain Systems Only:
  Enterprise Admins Group
  Domain Admins Group


vuln_id: V-220971
rule_id: SV-220971r1137691_rule
severity: CAT II
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  The "Deny log on locally" right defines accounts that are prevented from logging on interactively.

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.

  The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following.

  Domain Systems Only:
  Enterprise Admins Group
  Domain Admins Group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  All Systems:
  Guests Group

check_text:
  Verify the effective setting in Local Group Policy Editor.

  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If the following groups or accounts are not defined for the "Deny log on locally" right, this is a finding.

  Domain Systems Only:
  Enterprise Admins Group
  Domain Admins Group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  All Systems:
  Guests Group


vuln_id: V-220972
rule_id: SV-220972r1137691_rule
severity: CAT II
cci: CCI-000213,CCI-002314
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  The "Deny log on through Remote Desktop Services" right defines the accounts that are prevented from logging on using Remote Desktop Services.

  If Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access.

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.

  Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.

  The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following.

  If Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access.

  Domain Systems Only:
  Enterprise Admins group
  Domain Admins group
  Local account (see Note below)

  All Systems:
  Guests group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.

check_text:
  Verify the effective setting in Local Group Policy Editor.

  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If the following groups or accounts are not defined for the "Deny log on through Remote Desktop Services" right, this is a finding:

  If Remote Desktop Services is not used by the organization, the "Everyone" group can replace all of the groups listed below.

  Domain Systems Only:
  Enterprise Admins group
  Domain Admins group
  Local account (see Note below)

  All Systems:
  Guests group

  Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)

  Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.


vuln_id: V-220973
rule_id: SV-220973r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding.


vuln_id: V-220974
rule_id: SV-220974r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Force shutdown from a remote system user right must only be assigned to the Administrators group.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Force shutdown from a remote system" user right, this is a finding:

  Administrators


vuln_id: V-220975
rule_id: SV-220975r1138519_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

  The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to only include the following groups or accounts:

  Administrators
  LOCAL SERVICE
  NETWORK SERVICE
  SERVICE

check_text:
  Verify the effective setting in Local Group Policy Editor.

  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Impersonate a client after authentication" user right, this is a finding:

  Administrators
  LOCAL SERVICE
  NETWORK SERVICE
  SERVICE


vuln_id: V-220976
rule_id: SV-220976r958726_rule
severity: CAT II
title: The Load and unload device drivers user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Load and unload device drivers" user right, this is a finding:

  Administrators


vuln_id: V-220977
rule_id: SV-220977r958726_rule
severity: CAT II
title: The Lock pages in memory user right must not be assigned to any groups or accounts.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts are granted the "Lock pages in memory" user right, this is a finding.


vuln_id: V-220978
rule_id: SV-220978r958434_rule
severity: CAT II
title: The Manage auditing and security log user right must only be assigned to the Administrators group.
cci: CCI-000162,CCI-000163,CCI-000164,CCI-000171,CCI-001914
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Manage auditing and security log" user right, this is a finding:

  Administrators

  If the organization has an "Auditors" group the assignment of this group to the user right would not be a finding.


vuln_id: V-220979
rule_id: SV-220979r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Modify firmware environment values user right must only be assigned to the Administrators group.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Modify firmware environment values" user right, this is a finding:

  Administrators


vuln_id: V-220980
rule_id: SV-220980r958726_rule
severity: CAT II
title: The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding:

  Administrators


vuln_id: V-220981
rule_id: SV-220981r958726_rule
severity: CAT II
title: The Profile single process user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Profile single process" user right, this is a finding:

  Administrators


vuln_id: V-220982
rule_id: SV-220982r958726_rule
severity: CAT II
title: The Restore files and directories user right must only be assigned to the Administrators group.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Restore files and directories" user right, this is a finding:

  Administrators


vuln_id: V-220983
rule_id: SV-220983r958726_rule
severity: CAT II
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The Take ownership of files or other objects user right must only be assigned to the Administrators group.

description:
  <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

  Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to only include the following groups or accounts:

  Administrators

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  If any groups or accounts other than the following are granted the "Take ownership of files or other objects" user right, this is a finding:

  Administrators


vuln_id: V-250319
rule_id: SV-250319r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.

description:
  <VulnDiscussion>Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> "Hardened UNC Paths" to "Enabled" with at least the following configured in "Hardened UNC Paths:" (click the "Show" button to display).

  Value Name: \\*\SYSVOL
  Value: RequireMutualAuthentication=1, RequireIntegrity=1

  Value Name: \\*\NETLOGON
  Value: RequireMutualAuthentication=1, RequireIntegrity=1

check_text:
  This requirement is applicable to domain-joined systems. For standalone or nondomain-joined systems, this is NA.

  If the following registry values do not exist or are not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\

  Value Name: \\*\NETLOGON
  Value Type: REG_SZ
  Value: RequireMutualAuthentication=1, RequireIntegrity=1

  Value Name: \\*\SYSVOL
  Value Type: REG_SZ
  Value: RequireMutualAuthentication=1, RequireIntegrity=1

  Additional entries would not be a finding.


vuln_id: V-252896
rule_id: SV-252896r958420_rule
severity: CAT II
title: PowerShell Transcription must be enabled on Windows 10.
cci: CCI-000132,CCI-000134
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Enabling PowerShell Transcription will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Transcription" to "Enabled".

  Specify the Transcript output directory to point to a Central Log Server or another secure location to prevent user access.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\

  Value Name: EnableTranscripting

  Value Type: REG_DWORD
  Value: 1


vuln_id: V-252903
rule_id: SV-252903r991589_rule
severity: CAT III
title: Virtualization-based protection of code integrity must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Virtualization-based protection of code integrity enforces kernel mode memory protections and protects Code Integrity validation paths. This isolates the processes from the rest of the operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Virtualization-based security currently cannot be implemented in VDIs due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" or "Enabled without lock" selected for "Virtualization Based Protection of Code Integrity:".

  "Enabled with UEFI lock" is preferred as more secure; however, it cannot be turned off remotely through a group policy change if there is an issue.

  "Enabled without lock" will allow this to be turned off remotely while testing for issues.

check_text:
  Confirm virtualization-based protection of code integrity.

  For devices that support the virtualization based security (VBS) feature for protection of code integrity, this must be enabled. If the system meets the hardware, firmware, and compatible device driver dependencies for enabling virtualization-based protection of code integrity but it is not enabled, this is a CAT II finding.

  Virtualization based security currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Run "PowerShell" with elevated privileges (run as administrator).
  Enter the following:
  "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard"

  If "SecurityServicesRunning" does not include a value of "2" (e.g., "{1, 2}"), this is a finding.

  Alternately:

  Run "System Information".

  Under "System Summary", verify the following:
  If "Virtualization-based Security Services Running" does not list "Hypervisor enforced Code Integrity", this is finding.

  The policy settings referenced in the Fix section will configure the following registry value. However due to hardware requirements, the registry value alone does not ensure proper function.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\

  Value Name: HypervisorEnforcedCodeIntegrity
  Value Type: REG_DWORD
  Value: 0x00000001 (1) (Enabled with UEFI lock), or 0x00000002 (2) (Enabled without lock)


vuln_id: V-256894
rule_id: SV-256894r958552_rule
severity: CAT II
title: Internet Explorer must be disabled for Windows 10.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Internet Explorer 11 (IE11) is no longer supported on Windows 10 semi-annual channel. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For Windows 10 semi-annual channel, remove or disable the IE11 application. 

  To disable IE11 as a standalone browser:

  Set the policy value for "Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Disable Internet Explorer 11 as a standalone browser" to "Enabled" with the option value set to "Never".

check_text:
  Determine if IE11 is installed or enabled on Windows 10 semi-annual channel.

  If IE11 is installed or not disabled on Windows 10 semi-annual channel, this is a finding.

  If IE11 is installed on a unsupported operating system and is enabled or installed, this is a finding.

  For more information, visit: https://learn.microsoft.com/en-us/lifecycle/faq/internet-explorer-microsoft-edge#what-is-the-lifecycle-policy-for-internet-explorer-


vuln_id: V-257589
rule_id: SV-257589r958412_rule
severity: CAT II
title: Windows 10 must have command line process auditing events enabled for failures.
cci: CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.

  These audit events can assist in understanding how a computer is being used and tracking user activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Go to Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation is set to "failure".

check_text:
  Ensure Audit Process Creation auditing has been enabled: 

  Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation". 

  If "Audit Process Creation" is not set to "Failure", this is a finding.


vuln_id: V-257593
rule_id: SV-257593r991589_rule
severity: CAT II
title: Windows 10 must not have portproxy enabled or in use.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Having portproxy enabled or configured in Windows 10 could allow a man-in-the-middle attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Contact the Administrator to run "netsh interface portproxy delete" with elevation. Remove any enabled portproxies that may be configured.

check_text:
  Check the registry key for existence of proxied ports:
  HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\. 

  If the key contains v4tov4\tcp\ or is populated v4tov4\tcp\, this is a finding. 

  Run "netsh interface portproxy show all". 

  If the command displays any results, this is a finding.


vuln_id: V-268315
rule_id: SV-268315r1135269_rule
severity: CAT II
title: Copilot must be disabled for Windows 10.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open PowerShell as an administrator. Run the following command:

  Get-AppxPackage -AllUsers *CoPilot* | Remove-AppxPackage -AllUsers

check_text:
  Run the following PowerShell command as an administrator:

  Get-AppxPackage -AllUsers | Where-Object { $_.Name -like "*Copilot*" }

  If Microsoft.Copilot displays, this is a finding.


vuln_id: V-268319
rule_id: SV-268319r1135263_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance.

description:
  <VulnDiscussion>Without Windows 10 systems being managed, devices could be rogue and become targets of an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Windows 10 system to use either Group Policy or an approved MDM product to enforce STIG compliance.

check_text:
  Verify the Windows 10 system is receiving policy from either Group Policy or an MDM with the following steps:

  From a command line or PowerShell:

  gpresult /R
  OS Configuration: Member Workstation

  If the system is not being managed by GPO, ask the administrator to indicate which MDM is managing the device.

  From PowerShell: Get-Service -Name "IntuneManagementExtension"

  If the Windows 10 system is not receiving policy from either Group Policy or an MDM, this is a finding.

  This is NA for standalone, nondomain-joined systems.


vuln_id: V-245722
rule_id: SV-245722r1138389_rule
severity: CAT I
title: COMSEC Account Management - Equipment and Key Storage
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Improper handling and storage of COMSEC material can result in the loss or compromise of classified cryptologic devices or classified key or unclassified COMSEC Controlled Items (CCI). 

  REFERENCES: 
  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Enclosure 3, para 12.c.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information:
  Paragraph 1.b. (1)
  Enclosure 2, para 8. & 12.
  Enclosure 3 and Appendix to Encl 3 
  Enclosure 4, para 1.a.
  Enclosure 7, para 7.b. & c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: SC-12, SC-13

  NSA/CSS Policy Manual 3-16, Sections III, VI, X and XI 

  CNSS Policy No. 1, NATIONAL POLICY FOR SAFEGUARDING AND CONTROL OF COMSEC MATERIALS

  CNSS Policy No. 10, NATIONAL POLICY GOVERNING USE OF APPROVED SECURITY CONTAINERS IN INFORMATION SECURITY APPLICATIONS

  DOD Instruction 8523.01, Communications Security (COMSEC), April 22, 2008</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  COMSEC material must be stored in a GSA approved container such as safe, vault, or secure room IAW (NSA/CSS Policy Manual 3-16, Section XI, paragraph 89). Specific standards are: 
  1. Keyed crypto equipment must be housed within a proper GSA safe, vault or secure room. 
  2. If crypto equipment is not housed within a proper GSA safe, vault or secure room the Crypto Encryption Key must be removed and stored in a GSA approved safe or in a separate room from the crypto equipment when the equipment is not under the continuous observation and control of a properly cleared person. 
  3. Information Processing System (IPS) containers (safes) may be used to securely store and operate keyed equipment. 
  4. If unclassified crypto equipment is not operated in a safe, vault or secure room it must minimally be maintained within an approved Secret or higher Controlled Access Area (CAA) and further secured in a locked room (equipment closet) or equipment rack suitable for control of sensitive equipment to ensure only system administrator and COMSEC personnel have access to the equipment. 
  5. NOTES: This requirement applies to a tactical environment. Unless under continuous observation and control, Crypto Equipment Key must be removed and maintained separately from the encryption device - unless it is operated in a proper safe, vault or secure room. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC items not used with DODIN assets should not be inspected. Specifically, only COMSEC items associated with the CCSDs being inspected are to be included in this check.

check_text:
  Ask the COMSEC Custodian, COMSEC Responsible Officer (CRO), Security Manager or ISSM how COMSEC equipment and materials are transported, handled and stored. Physically check that crypto equipment, keys, and keyed crypto are handled and stored properly. Reviewers must annotate specific types of crypto devices observed in the finding details or comments, (e.g., TACLANE, KIV 7, etc.)


vuln_id: V-245723
rule_id: SV-245723r1138390_rule
severity: CAT III
title: COMSEC Account Management - Appointment of Responsible Person
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of formal designation of an individual to be responsible for COMSEC items could result in mismanagement, loss or even compromise of COMSEC materials. Additionally, lack of formal vetting for a specific individual to be appointed for management of COMSEC material could result in a person (such as a non-US Citizen) having unauthorized access.

  REFERENCES: 

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 3, paragraph 6.e. (3).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), paragraphs 6.5.d., 7.16. e. & f. and 8.2.b. (3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: IA-1, PL-1, PS-1, PS-2, and SC-1

  NSA/CSS Policy Manual 3-16, Sections III, VI, X and XI 

  CNSS Policy No.1, NATIONAL POLICY FOR SAFEGUARDING AND CONTROL OF COMSEC MATERIALS</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A person must be identified and appointed in writing to be either the COMSEC custodian or a COMSEC Hand Receipt Holder. Alternates must also be appointed in writing.

check_text:
  Check there is a current COMSEC Custodian appointment letter or verify there is a Hand Receipt Holder for COMSEC key material received from a supporting account. NOTE: Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.


vuln_id: V-245724
rule_id: SV-245724r1138391_rule
severity: CAT III
title: COMSEC Account Management - Program Management and Standards Compliance
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Recipients of NSA or Service COMSEC accounts are responsible to properly maintain the accounts. Procedures covering security, transport, handling, etc., of COMSEC must be developed to supplement regulatory guidelines. NSA or sponsoring Services of the COMSEC accounts maintain oversight by conducting required inspections. If COMSEC accounts are not properly maintained and findings are noted during an inspection, they must be addressed properly and promptly. If this is not done, the integrity of COMSEC items may be adversely impacted, resulting in the loss or compromise of COMSEC equipment or key material. 

  REFERENCES:

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 3, paragraph 6.e. (3).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AU-1, CA-1, CA-2, CA-2(1), CA-2(2), CA-2(3), CA-5, CM-3(6), PL-1, PL-2(3), PL-7, SC-1, SC-12, SC-12(1), and SC-13

  NSA/CSS Policy Manual 3-16, Sections III, VI, X and XI
   
  CNSS Policy No.1, NATIONAL POLICY FOR SAFEGUARDING AND CONTROL OF COMSEC MATERIALS

  DOD Instruction 8523.01, Communications Security (COMSEC), January 6, 2021

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The site must have local procedures covering maintenance of COMSEC equipment and key material. Further, any inspection findings from NSA or Services issuing the account or the account sponsor (for Hand Receipt holders) must be corrected or provide evidence there is a plan of action in place and underway to correct noted deficiencies.

check_text:
  Ask how the COMSEC account is managed. Check for written procedures and inspection reports.

  NOTES:

  1. Applies in a tactical environment if the crypto equipment and key material being observed is at a location where supporting staff (IAM, SM, COMSEC Custodian) would logically be located. If it is a mobile tactical organization, responsibility for program management might simply be the identification of an individual responsible for keeping track of and maintaining COMSEC materials, but supporting documentation may not be immediately available and should not be written as a finding; however, observations and comments may still be documented. 

  2. Note in the report the COMSEC Account type e.g., NSA, Navy, Army, etc. 

  3. Note in the report the last COMSEC Inspection Date based on observed documentation. (Summarize the overall results and if the site is taking action to address/correct findings.) 

  4. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.

  5. This check is not intended to be an inspection of the COMSEC Program, rather it is a verification that a viable program is in place with NSA or oversight. The idea is to ensure that NSA or Service oversight inspection findings/deficiencies are being corrected in a timely manner by the site.


vuln_id: V-245725
rule_id: SV-245725r1138485_rule
severity: CAT II
title: COMSEC Training - COMSEC Custodian or Hand Receipt Holder
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of appropriate training for managers of COMSEC accounts could result in the mismanagement of COMSEC records and inadequate physical protection and ultimately lead to the loss or compromise of COMSEC keying material. 

  REFERENCES:

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-3, AT-4, and SC-1

  NSA/CSS Policy Manual 3-16, Section III, paragraph 16

  CNSS Policy No.1, NATIONAL POLICY FOR SAFEGUARDING AND CONTROL OF COMSEC MATERIALS

  DOD Instruction 8523.01, Communications Security (COMSEC), January 6, 2021

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Documented proof of required COMSEC Custodian or hand receipt holder training must be available. Formal training of primary COMSEC account holders is required within 6-months of being appointed as COMSEC Custodian or alternate. Sub-Account or hand receipt holders may be trained by the sponsoring primary account COMSEC Custodian.

check_text:
  Check for documented proof of COMSEC Custodian or hand receipt holder training.

  NOTES:

  1. Formal training for primary COMSEC account holders must be completed within six months of being designated as COMSEC Custodian.

  2. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.


vuln_id: V-245726
rule_id: SV-245726r1138393_rule
severity: CAT II
title: COMSEC Training - COMSEC User
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to properly brief COMSEC users could result in the loss of cryptologic devices or key, or the compromise of classified information.

  REFERENCES: 

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 7, Para 7.b.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-3, AT-4, and SC-1

  NSA/CSS Policy Manual 3-16, Section IX, Paragraph 77.

  CNSS Policy No. 1, NATIONAL POLICY FOR SAFEGUARDING AND CONTROL OF COMSEC MATERIALS

  DOD Instruction 8523.01, Communications Security (COMSEC), January 6, 2021

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Train all COMSEC users on proper procedures for operation of COMSEC equipment and on proper protection of both classified COMSEC materials as well as COMSEC Controlled Information (CCI). Documented proof of initial user training must be on-hand and updated at least annually.

check_text:
  Check proof of user training. 

  NOTES:

  1. Applies in a tactical environment if the crypto equipment and key material being observed is at a location where supporting staff (IAM, SM, COMSEC Custodian/COMSEC Responsible Officer (CRO) AKA: Hand Receipt Holder) would logically be located. If it is a mobile tactical organization, COMSEC users should previously have received proper training; however, since the documentation will likely not be available in a field environment this check will be NA. 

  2. Observations and comments may be entered for the record, even if there is no finding. 

  3. Ensure that any COMSEC account, materials or equipment being inspected is used for encryption of DODIN assets. COMSEC accounts or items not used with DODIN assets should not be inspected.


vuln_id: V-245727
rule_id: SV-245727r1138394_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Classified Transmission - Electronic Means using Cryptographic System Authorized by the Director, NSA

description:
  <VulnDiscussion>Failure to properly encrypt classified data in transit can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information:
  Encl 4, para 1.a. 
  Encl 4, para 3.b. and 4.a.
  Encl 4, para 8.
  Encl 7, para 13.e.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-17(2) and SC-8

  NSA/CSS Policy Manual 3-16, Sections III, VI, X and XI 

  DOD Instruction 8523.01, Communications Security (COMSEC), April 22, 2008, paragraph 6.1.

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.

  CNSSI No.7003, September 2015, Protected Distribution Systems (PDS), SECTION IV - POLICY, paragraphs 6, 7 and 8.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  When classified (particularly SIPRNet) voice, data, message (both organizational and email), and facsimile transmissions transit an area not access controlled to at least the Secret level a cryptographic system designed and installed IAW NSA approved guidelines must be used to protect the data in transit. This check is NA if the transmission line/cable is installed in a proper Protected Distribution System (PDS).

check_text:
  GENERAL REQUIREMENT: Classified information shall be transmitted by electronic means over an approved secure communications system authorized by the Director, NSA, or a Protected Distribution System (PDS) designed and installed to meet the requirements of Committee on National Security Systems Instruction (CNSSI) 7003. This applies to voice, data, message (both organizational and email), and facsimile transmissions. 

  CHECK: Where classified (SIPRNet) transmissions are outside of an area approved for unprotected transmission check that the cryptographic system is designed and installed IAW NSA approved guidelines. Generally an area not approved for unprotected SIPRNet transmissions will be any transmission through an area that is not a SCIF, Secret or higher Vault or Secure Room or Secret or higher Controlled Access Area (CAA).

  NOTES:

  1. This check is applicable in a tactical environment regardless if the unprotected SIPRNet transmission line is located within a fixed facility, or field/mobile environment.

  2. This check is NA if the unencrypted signal is installed in a proper Protected Distribution System (PDS).


vuln_id: V-245728
rule_id: SV-245728r1138395_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Protected Distribution System (PDS) Construction - Point of Presence (PoP) and Terminal Equipment Protection. This requirement concerns security of both the starting and ending points for PDS within proper physically protected and access controlled environments.

description:
  <VulnDiscussion>A PDS that is not constructed and physically protected as required could result in the covert or undetected interception of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8
   
  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 7., Section VIII, paragraphs 22, 25, 26 & paragraph 27.b. & c. and Section X, paragraph 30.a.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This fix concerns security requirements for the physical locations of both the starting and ending points for Protected Distribution Systems (PDS) within a physical enclave. 

  All of the following requirements must be met:

  1. The PDS must originate within the room or area containing the SIPRNet Point of Presence (PoP) for the facility or area, which must be in a Secret or above Secure Room, Vault, SCIF or alternatively in an Information Processing Systems (IPS) Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (e.g., printer, copier, fax)). An IPS container is a specially designed safe for secured operation of classified network and end user equipment.
   
  2. PDS terminal equipment (wall jacks/ports) must be located in a Secret or higher Controlled Access Area (CAA), Secret or higher vault, Secret or higher Secure Room or in a SCIF.

  3. PDS terminating in areas not a Secret or higher CAA (SCAA) may alternatively terminate in an IPS Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (printer, copier, and fax)).
   
  4. If an IPS container is used to secure equipment at a PDS termination point, it must be located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  5. In exceptional situations, when the PDS termination area cannot be access controlled to the level of the data carried by the PDS (e.g., in a multi-use conference room), the PDS termination point (wall jack/port) must be secured with a lock box. Access Controlled to the level of the data carried by the PDS for SIPRNet connections means the PDS termination area must minimally be a secret CAA (SCAA). The lock box must meet the same construction requirements as a pull box for the PDS carrier type. *Specifications for pull boxes and termination lock boxes are covered in rule: Protected Distribution System (PDS) Construction - Accessible Pull Box Security, STIG ID: CS-04.01.03, Rule ID: SV-41000r3_rule Vuln ID: V-245730. A finding for deficient pull box or termination lock box construction should be cited under STIG ID: CS-04.01.03.

  6. If a lock box is used to secure a PDS termination/end point (wall jack/port), it must be located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  7. PDS lock boxes located within a LAA must be physically disconnected (cables pulled) from equipment and the lock boxes secured with an approved PDS lock when the lock box is not under the continuous observation and control of a properly cleared person (secret security clearance for SIPRNet). 

  NOTES: 

  Access to all PDS points with breakouts must be restricted to personnel cleared at the highest level of the breakout and therefore, the PDS terminal equipment (end point) must either be locked or continuously safeguarded by cleared persons to prevent tampering.

  The S&G 8077 changeable combination padlock is the DOD standard/required PDS lock for user termination lock boxes that are opened/closed on a routine or frequent basis. Tamper evident locks (keyed padlocks with seals) are not permitted to be used within the DOD, per guidance from USD (I) Policy.

check_text:
  This check concerns security requirements for the physical locations of both the starting and ending points for Protected Distribution Systems (PDS) within a physical enclave. 

  Check to ensure: 
  1. The PDS originates within the room or area containing the SIPRNet Point of Presence (PoP) for the facility or area, which must be in a Secret or above Secure Room, Vault, SCIF or alternatively in an Information Processing Systems (IPS) Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (e.g., printer, copier, fax)). An IPS container is a specially designed safe for secured operation of classified network and end user equipment. 

  2. PDS terminal equipment (wall jacks/ports) are located in a Secret or higher Controlled Access Area (CAA), Secret or higher vault, Secret or higher Secure Room or in a SCIF.

  3. PDS terminating in areas not a Secret or higher CAA may alternatively terminate in an IPS Container with SIPRNet connected equipment (router/switch/PC/laptop/multi-function device (printer, copier, and fax)). 

  4. If an IPS container is used to secure equipment at a PDS termination point, ensure it is located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  5. In exceptional situations, when the PDS termination area cannot be access controlled to the level of the data carried by the PDS (e.g., in a multi-use conference room), ensure the PDS termination point (wall jack/port) is secured with a lock box. Access Controlled to the level of the data carried by the PDS for SIPRNet connections means the PDS termination area must minimally be a secret CAA. The lock box must meet the same construction requirements as a pull box for the PDS carrier type. *Specifications for pull boxes and termination lock boxes are covered in rule: Protected Distribution System (PDS) Construction - Accessible Pull Box Security, STIG ID: CS-04.01.03, Rule ID: SV-41000r3_rule Vuln ID: V-245730. A finding for deficient pull box or termination lock box construction should be cited under STIG ID: CS-04.01.03.

  6. If a lock box is used to secure a PDS termination/end point (wall jack/port), ensure it is located within at least a Limited Access Area (LAA). *It cannot ever be located in an Uncontrolled Access Area (UAA).

  7. PDS lock boxes located within a LAA are physically disconnected (cables pulled) from equipment and the lock boxes secured with an approved PDS lock when the lock box is not under the continuous observation and control of a properly cleared person (secret security clearance for SIPRNet).
   
  NOTES: 

  Access to all PDS points with breakouts must be restricted to personnel cleared at the highest level of the breakout and therefore, the PDS terminal equipment (end point) must either be locked or continuously safeguarded by cleared persons to prevent tampering.

  The S&G 8077 changeable combination padlock is the DOD standard/required PDS lock for user termination lock boxes that are opened/closed on a routine or frequent basis. Tamper evident locks (keyed padlocks with seals) are not permitted to be used within the DOD, per guidance from USD(I) Policy.


vuln_id: V-245729
rule_id: SV-245729r1138396_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Hardened Carrier
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and configured as required could result in the undetected interception of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, Paragraph 7 and Section X, paragraph 30.a.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Data cables must be installed in a carrier configured as a "Hardened Carrier" IAW CNSSI 7003. The carrier must be constructed of ferrous, electrical metallic tubing (EMT); ferrous pipe conduit; or ferrous rigid sheet metal ducting. Flexible conduit and armored cables must not be used as a hardened carrier. The carrier must not open to expose data cables (e.g., removable covers), except at approved pull boxes and termination boxes. The carrier must utilize elbows, couplings, nipples, and connectors of the same materials. All joints and connections must be sealed.

  NOTE: A vendor product (AKA: Modular PDS) may be used if constructed of solid metal components and sealed - as described above.

  2. The PDS must not be located within an Uncontrolled Access Area (UAA).

check_text:
  1. A Hardened Carrier IAW CNSSI 7003 must be constructed of ferrous, electrical metallic tubing (EMT); ferrous pipe conduit; or ferrous rigid sheet metal ducting. Flexible conduit and armored cables must not be used as a hardened carrier. The carrier must not open to expose data cables (e.g., removable covers), except at approved pull boxes and termination boxes. The carrier must utilize elbows, couplings, nipples, and connectors of the same materials. All joints and connections must be sealed.

  NOTE: A vendor product (AKA: Modular PDS) may be used if constructed of solid metal components and sealed - as described above.

  2. The PDS is not within an Uncontrolled Access Area (UAA).


vuln_id: V-245730
rule_id: SV-245730r1138397_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Pull Box Security
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and configured as required could result in the undetected interception of classified information.

  REFERENCES: 
          
  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section VIII, paragraph 25 and Section VI - DEFINITIONS - PDS Lock.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If pull box covers are capable of being opened and used for accessing the transmission cable, the following 6 requirements apply: 

  1. Box covers must not have removable hinge pins. The hinge must be hidden or mechanically blocked to prevent removal.
   
  2. If the pull box will be accessed after installation, the pull box cover must be secured with an approved PDS lock. Multiple locks may be required for larger pull-boxes.
   
  NOTE 1: The ONLY approved PDS Lock within the DOD is the General Services Administration (GSA) approved changeable combination padlock and has historically been the lock used for securing accessible pull boxes and PDS termination boxes. The only padlock currently meeting this standard is the S&G 8077, changeable combination padlock.

  NOTE 2: A newer alternative PDS lock listed by the CNSSI 7003 is the tamper indicative padlock with a wire loop seal. This is a "keyed" padlock with an attached seal that is issued exclusively by the lock proponent, which is the National Security Agency (NSA) Information Assurance Division (IAD) Lock and Seal Office. The USD(I) has determined this lock will not be used for protecting PDS Pull Boxes within the DOD. 
   
  NOTE 3: The new CNSSI 7003 under the PDS Lock definition identified the wrong federal specification for the changeable combination padlock. The lock identified under FF-L-2740B is designed for safes and will not fit properly on a small PDS lock box. The correct lock (S&G 8077 changeable combination padlock) is under the FF-P-110J federal specification. That is what the CNSSI 7003 proponent "intended" and the DOD TEMPEST Advisory Group (TAG) and NSA Protective Technologies Group are taking action to coordinate correction of this oversight.

  3. Hasps (used with PDS locks) to secure the cover on the pull box must be permanently and securely attached to the box (e.g., tack welded or with rivets) in such a way as it cannot be removed without breaking the hasp or its connection.
   
  4. Boxes with prepunched knockouts must not be used.

  5. Ensure that for medium threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 14 gauge and must have a cover that can be locked. However, the material need not be thicker than the PDS carrier or the thickness needed for box rigidity.

  6. Ensure that for low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  If pull box covers are NOT capable of being opened or used for accessing the transmission cable, the following 4 requirements apply:
   
  7. Covers must be secured to the pull boxes by welding or epoxy after installation as follows: 
   - If welded, at least one weld must be applied on each side of the box and cover. 
   - If epoxy is used, it must be applied between all mating surfaces continuously around the cover. 
   - Painted surfaces must be treated to form a mechanically strong epoxy bond.

  8. Hinge-pins for pull-box covers must be non-removable. The hinge must be hidden or mechanically blocked to prevent removal.
   
  9. Boxes with pre-punched knockouts must not be used under any circumstances.
   
  10. For low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  NOTE: Pull boxes located in medium threat areas must have a lockable cover and are therefore addressed in requirement #5 above under pull box covers capable of being opened and used for accessing the transmission cable.

check_text:
  If pull box covers are capable of being opened and used for accessing the transmission cable, the following 6 checks apply:

  Check 1. Box covers do not have removable hinge pins. The hinge must be hidden or mechanically blocked to prevent removal.

  Check 2. If the pull box will be accessed after installation, the pull box cover must be secured with an approved PDS lock. Multiple locks may be required for larger pull-boxes. 
   
  NOTE 1: The ONLY approved PDS Lock within the DOD is the General Services Administration (GSA) approved changeable combination padlock and has historically been the lock used for securing accessible pull boxes and PDS termination boxes. The only padlock currently meeting this standard is the S&G 8077, changeable combination padlock.

  NOTE 2: A newer alternative PDS lock listed by the CNSSI 7003 is the tamper indicative padlock with a wire loop seal. This is a "keyed" padlock with an attached seal that is issued exclusively by the lock proponent, which is the National Security Agency (NSA) Information Assurance Division (IAD) Lock and Seal Office. The USD(I) has determined this lock will not be used for protecting PDS Pull Boxes within the DOD.
   
  NOTE 3: The new CNSSI 7003 under the PDS Lock definition identified the wrong federal specification for the changeable combination padlock. The lock identified under FF-L-2740B is designed for safes and will not fit properly on a small PDS lock box. The correct lock (S&G 8077 changeable combination padlock) is under the FF-P-110J federal specification. That is what the CNSSI 7003 proponent "intended" and the DOD TEMPEST Advisory Group (TAG) and NSA Protective Technologies Group are taking action to coordinate correction of this oversight.

  Check 3. Hasps (used with PDS locks) to secure the cover on the pull box are permanently and securely attached to the box (e.g., tack welded or with rivets) in such a way as it cannot be removed without breaking the hasp or its connection.
   
  Check 4. Ensure boxes with prepunched knockouts are not used.

  Check 5. Ensure that for medium threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 14 gauge and must have a cover that can be locked. However, the material need not be thicker than the PDS carrier or the thickness needed for box rigidity.

  Check 6. Ensure that for low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  If pull box covers are NOT capable of being opened or used for accessing the transmission cable, the following 4 checks apply:
   
  Check 7. Ensure covers are secured to the pull boxes by welding or epoxy after installation as follows: 
   - If welded, at least one weld must be applied on each side of the box and cover. 
   - If epoxy is used, it must be applied between all mating surfaces continuously around the cover. 
   - Painted surfaces must be treated to form a mechanically strong epoxy bond.

  Check 8. Ensure hinge-pins for pull-box covers are non-removable. The hinge must be hidden or mechanically blocked to prevent removal.
   
  Check 9. Boxes with pre-punched knockouts are not used under any circumstances.
   
  Check 10. For low threat areas (as defined in the CNSSI 7003), pull boxes are constructed of a ferrous metal with a minimum thickness of 16 gauge.

  NOTE: Pull boxes located in medium threat areas must have a lockable cover per the CNSSI 7003 and are therefore addressed in check #5 above under pull box covers capable of being opened and used for accessing the transmission cable.


vuln_id: V-245731
rule_id: SV-245731r1138398_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Buried PDS Carrier
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Buried carriers are normally used to extend a PDS between CAAs that are located in different buildings. As with other Category 2 PDS the unencrypted data cables must be installed in a carrier. A PDS that is not constructed, configured and physically secured as required could result in the undetected interception of classified information. This is especially true for unencrypted cables running through an outdoor environment where physical barriers protecting the environment are often easily breeched. 

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  DOD 5220.22-M (NISPOM), Chapter 5, paragraphs 5-402. (c) and 5-403.(a).

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 7 and Section X, paragraph 30.b.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  The following requirements must be applied to Exterior PDS:

  1. Ensure the buried carrier is constructed of conduit consisting of EMT, rigid pipe, PVC, or a similar type of plastic electrical conduit.
   
  2. Ensure all connections are permanently sealed completely around all mating surfaces (e.g., welding, epoxy, fusion, or PVC glue).
   
  3. Ensure the PDS is buried a minimum of 1 meter (39 inches) below the surface and on the property (in a LOW Threat area within CONUS) owned or leased by the U.S. Government or the contractor having control of the PDS.

  NOTE: As an alternative, if the carrier cannot be buried to a one-meter depth due to soil conditions or blocked passage, a lesser depth may be used within a low threat area with prior approval of the Authorizing Official (AO) if the carrier is encased within the center of mass of approximately 20 centimeters (8 inches) of concrete.
   
  4. Ensure the buried carrier departs and enters a building through the building's concrete slab or basement wall.

  NOTE: As an alternative, all portions of the PDS above the 1 meter (39 inches) depth and not within a CAA (e.g., a PDS rising to a pull box on the side of a building) must meet the requirements of a Category 2 hardened carrier.
   
  5. Ensure that manholes or any other access (e.g., hand hole) to the buried PDS are secured with a PDS lock or an alarm. The PDS lock must be visible for daily inspection. If a PDS lock cannot be used due to the physical construction of the manhole, then a standard locking manhole cover and micro-switch alarm should be used.

  NOTE: As an alternative to a PDS lock or approved micro-switch alarms, manhole covers may be completely welded around the opening surface to impede opening and provide for clear evidence of penetration. Spot-welding is not acceptable. If operational security needs dictate exceeding the STIG requirements, the site is always free to expand upon and increase their security posture by welding manhole covers. However, prior to this alternative method being instituted, the site must conduct and document an in-depth THREAT Assessment for their AOR and the assessment requires Senior Agency Official approval. This approval will be maintained on file. Also, daily visual inspections are still required per CNSSI 7003, Section X, para b. 3. (CAT I finding).

  NOTE: The USD(I) Policy has determined the PDS Locks referred to in the CNSSI 7003 as Tamper Indicative Padlock with a wire loop seal and Tamper Evident Seal ARE NOT permitted for use in the DOD. This is because neither product was properly vetted and listed by the DOD Lock Program. ONLY the SG 8077 Changeable Combination Padlock is to be used for securing Buried PDS manhole covers protecting SIPRNet within the DOD.

  6. If the carrier is buried in a MEDIUM threat location, ensure it is buried a minimum of 1 meter (39 inches) below the surface AND be encased within the center of mass of approximately 20 centimeters (8 inches) of concrete. NOTE: A concrete and steel container of sufficient size (to preclude surreptitious penetration in a period less than two hours as confirmed by laboratory tests) may be used in lieu of the 20 centimeters (8 inches) of concrete.

  7. Ensure the PDS is not located within an Uncontrolled Access Area (UAA).

check_text:
  Check Content for exterior PDS.

  If the Category 2 hardened carrier is buried:

  1. Check to ensure the buried carrier is constructed of conduit consisting of EMT, rigid pipe, PVC, or a similar type of plastic electrical conduit. (CAT I finding)

  2. Check that all connections are permanently sealed completely around all mating surfaces (e.g., welding, epoxy, fusion, or PVC glue). (CAT I finding)

  3. Check to ensure it is buried a minimum of 1 meter (39 inches) below the surface and on the property (in a LOW Threat area within CONUS) owned or leased by the U.S. Government or the contractor having control of the PDS. NOTE: As an alternative, if the carrier cannot be buried to a one-meter depth due to soil conditions or blocked passage, a lesser depth may be used within a low threat area with prior approval of the Authorizing Official (AO) if the carrier is encased within the center of mass of approximately 20 centimeters (8 inches) of concrete. (CAT I finding)

  4. Check that the buried carrier departs and enters a building through the building's concrete slab or basement wall. NOTE: As an alternative all portions of the PDS above the one-meter (39 inches) depth and not within a CAA (e.g., a PDS rising to a pull box on the side of a building) must meet the requirements of a Category 2 hardened carrier. (CAT I finding)
   
  5. Check that manholes or any other access (e.g., hand hole) to the buried PDS are secured with a PDS lock or an alarm. The PDS lock must be visible for daily inspection. If a PDS lock cannot be used due to the physical construction of the manhole, then a standard locking manhole cover and micro-switch alarm should be used. NOTE: As an alternative to a PDS lock or approved micro-switch alarms, manhole covers may be completely welded around the opening surface to impede opening and provide for clear evidence of penetration. Spot-welding is not acceptable. If operational security needs dictate exceeding the STIG requirements, the site is always free to expand upon and increase their security posture by welding manhole covers. However, prior to this alternative method being instituted, the site must conduct and document an in-depth THREAT Assessment for their AOR and the assessment requires Senior Agency Official approval. This approval will be maintained on file. Also, daily visual inspections are still required per CNSSI 7003, Section X, para b. 3. (CAT I finding)

  NOTE: The USD(I) Policy has determined the PDS Locks referred to in the CNSSI 7003 as Tamper Indicative Padlock with a wire loop seal and Tamper Evident Seal ARE NOT permitted for use in the DOD. This is because neither product was properly vetted and listed by the DOD Lock Program. ONLY the SG 8077 Changeable Combination Padlock is to be used for securing Buried PDS manhole covers protecting SIPRNet within the DOD.

  6. If the carrier is buried in a MEDIUM threat location, check to ensure it is buried a minimum of 1 meter (39 inches) below the surface AND be encased within the center of mass of approximately 20 centimeters (8 inches) of concrete. NOTE: A concrete and steel container of sufficient size (to preclude surreptitious penetration in a period less than two hours as confirmed by laboratory tests) may be used in lieu of the 20 centimeters (8 inches) of concrete. (CAT I finding)

  NOTE for Reviewers: If portions of the buried carrier cannot be checked due to being physically inaccessible, conduct whatever physical review is possible and attempt to validate PDS construction by reviewing contract/build documents, engineering drawings or certification documents from installation engineers that contain information about the physical makeup of the buried carrier.

  7. Check the PDS is not within an Uncontrolled Access Area (UAA). (CAT I finding)


vuln_id: V-245732
rule_id: SV-245732r1138399_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - External Suspended PDS
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Suspended carriers (Exterior PDS) are a Category 2 PDS option used to extend a PDS between Controlled Access Areas (CAAs) that are located in different buildings. Suspended carriers may be used for short runs when it is not practical to bury the PDS between buildings (e.g., between the 3rd floors of adjacent buildings). Unlike other Category 2 PDS the unencrypted data cables are not required to be installed in a carrier. Proper elevation and ease of visibility as well as minimum daily visual inspections of suspended carriers is of paramount importance. A PDS that is not configured, physically secured and inspected as required could result in the undetected interception of classified information. This is especially true for unencrypted cables running through an outdoor environment where physical barriers protecting the environment are often easily breeched. 

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  DOD 5220.22-M (NISPOM), Chapter 5, paragraphs 5-402. (c) and 5-403. (a).

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 7 and Section X, paragraph 30.c.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Suspended carriers may only be used for short runs when it is not practical to bury the PDS between buildings (e.g., between the 3rd floors of adjacent buildings). 
  Ensure that:

  1. Suspended carriers between buildings are permissible if they terminate in a CAA on each end or immediately enter a hardened PDS at the building boundary. 

  2. The suspended carrier must be hung directly between buildings. 

  3. The suspended carrier must be elevated a minimum of 5 meters (16 feet 4 inches) and 

  4. The suspended carrier must only be used if the property traversed is owned or leased by the USG or by a USG contractor or vendor that controls the PDS. 

  5. Suspended carriers must be installed to provide unimpeded inspection and be clear of any obstruction or device which encroaches upon the system to facilitate tampering.
   
  6. The area containing the suspended carrier must be illuminated at night.

  7. The PDS must not be located within an Uncontrolled Access Area (UAA).

check_text:
  Suspended carriers (Exterior PDS) may be used for short runs when it is not practical to bury the PDS between buildings (e.g., between the 3rd floors of adjacent buildings).
   
  Check to ensure:

  1. Suspended carriers between buildings terminate in a Secret or higher Controlled Access Area (CAA) on each end OR immediately enter a hardened PDS at the building boundary. (CAT I)

  2. Suspended carriers are hung directly between buildings. (CAT I)

  3. Suspended carriers are elevated a minimum of 5 meters (16 feet 4 inches). (CAT I)

  4. Suspended carriers are on property owned or leased by the USG or by a USG contractor or vendor that controls the PDS. (CAT I)

  5. Suspended carriers are installed to provide unimpeded visual inspection and be clear of any obstruction or device which encroaches upon the system to facilitate tampering. (CAT I)

  6. The areas containing suspended carriers are illuminated at night. (CAT I)

  7. The PDS is not located within an Uncontrolled Access Area (UAA). (CAT I)


vuln_id: V-245733
rule_id: SV-245733r1138400_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Continuously Viewed Carrier
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and configured as required could result in the undetected interception of classified information. A continuously viewed PDS may not be in a physically hardened carrier and the primary means of protection is continuous observation and control of the unencrypted transmission line. If not maintained under continuous observation an attacker (insider or external) could have an opportunity to tap and intercept unencrypted communications on the exposed cable.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 7. and Section X, paragraph 30.e.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Interior or Exterior PDS: Continuously viewed Carrier. This is one of five types of Category 2 PDS allowed IAW the CNSSI 7003. 

  There are four requirements that must be met for this type of distribution system:
   
  1. The transmission line must be under continuous observation, 24 hours per day (including when non-operational).

  2. The transmission line must be separated from all non-continuously viewed circuits ensuring an open field of view.

  3. There must be an SOP for those responsible for observation of the carrier that includes the requirement to investigate any attempt to disturb the PDS. The requirement must include that appropriate security personnel investigate the area of attempted penetration within 15 minutes of discovery.

  4. The PDS must not be located within an Uncontrolled Access Area (UAA).

check_text:
  Interior or Exterior PDS: Continuously viewed Carrier. This is one of five types of Category 2 PDS allowed IAW the CNSSI 7003. 

  Check to ensure:
   
  1. The transmission line is under continuous observation, 24 hours per day, including when non-operational. (CAT I finding)
   
  2. It is separated from all non-continuously viewed circuits ensuring an open field of view. (CAT III finding)

  3. The carrier has an SOP that includes the requirement to investigate any attempt to disturb the PDS. The requirement must include that appropriate security personnel investigate the area of attempted penetration within 15 minutes of discovery. (CAT II finding)

  4. The PDS is not located within an Uncontrolled Access Area (UAA). (CAT I)


vuln_id: V-245734
rule_id: SV-245734r1138401_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Tactical Environment Application
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and configured as required could result in the undetected interception of classified information. Within mobile tactical situations a hardened carrier is not possible and therefore the unencrypted SIPRNet cable must be maintained within the confines of the tactical encampment with the cable under continuous observation and control to prevent exploitation by enemy forces. In theaters of operation where fixed facilities are well established, standard PDS applications must be employed unless a risk assessment is conducted to determine the vulnerabilities and risks associated with using unencrypted cable that is not in a hardened carrier.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  Former guidance was in the legacy/superseded NSTISSI 7003, Protected Distribution Systems, Annex B, paragraph 1.a.(7)

  NOTE: There is no longer specific guidance in the updated CNSSI 7003 but the guidance for Continuously Viewed Carriers is the most applicable for Tactical Environments with PDS:
  CNSSI No.7003, September 2015, Protected Distribution Systems (PDS), Section X, paragraph 30.e.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  PDS in a tactical environment:
   
  1. The PDS must be located within the limits of the installation and command post, or in an area directly under the commander's physical control.
   
  2. Continuously viewed Carriers must be used in tactical environments with mobile systems employing inter-shelter cabling.
   
  3. Continuously viewed Carriers may also be used in tactical environments with "fixed facilities" ONLY if it is determined through a documented Risk Assessment that the cost or feasibility to install a Category 2 (Hardened or Alarmed Carrier) is not warranted. If applicable based on the risk assessment STIG ID VULS CS-04.01.01 through CS-04.01.06 may be used for fixed facilities in a theater of operations.
   
  4. ALL PDS in a tactical environment must be included in a well-documented Risk Assessment, for which residual risk has been acknowledged and accepted by the PDS Approval Authority.

check_text:
  PDS in a tactical environment. Check to ensure:
   
  1. The PDS is located within the limits of the installation and command post, or in an area directly under the commander's physical control.
   
  2. Continuously viewed Carriers must be used in tactical environments with mobile systems employing inter-shelter cabling. 
   
  3. Continuously viewed Carriers may also be used in tactical environments with "fixed facilities" ONLY if it is determined through a documented Risk Assessment that the cost or feasibility to install a Category 2 PDS (Hardened or Alarmed Carrier) is not warranted. If applicable based on the risk assessment STIG ID VULS CS-04.01.01 through CS-04.01.06 may be used for fixed facilities in a theater of operations.
   
  4. ALL PDS in a tactical environment must be included in a well-documented Risk Assessment, for which residual risk has been acknowledged and accepted by the PDS Approval Authority.


vuln_id: V-245735
rule_id: SV-245735r1138402_rule
severity: CAT I
title: Protected Distribution System (PDS) Construction - Alarmed Carrier
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and configured as required could result in the covert or undetected interception of classified information. An Alarmed Carrier is one of five types of Category 2 PDS. It is the most suitable alternative to Hardened and Continuously Viewed PDS (internal facility PDS options), when the unencrypted data transmission line is concealed above suspended ceilings, below raised floors, between walls or in any situation where the line is not visible for inspection. In lieu of daily visual inspections the functionality of the PDS alarm must be tested at least weekly - as based on guidance in the CNSSI 7003.

  REFERENCES:
         
  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information: 
  Encl 4, para 3.b. and 4.a.; Appendix to Encl 3, para 2 & 2.f.(2); 

  DOD Manual 5200.02 Procedures for the DOD Personnel Security Program (PSP), 3 April 2017 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, PE-6(1), (2) & (3), SC-7, and SC-8

  CNSSI No.7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 7. and Section X, paragraph 30.d.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  An Alarmed PDS is one of five types of Category 2 PDS IAW the CNSSI 7003. It is a suitable alternative for the two types of interior PDS, which are Hardened Carrier or Continuously Viewed Carrier. It should be used when the unencrypted data transmission line is concealed above suspended ceilings, below raised floors, between walls or in any situation where the line is not visible for inspection. In lieu of daily visual inspections the functionality of the PDS alarm must be tested at least weekly - or as based on guidance in the CNSSI 7003.

  Ensure unencrypted SIPRNet data cables are installed in a carrier properly configured as an "Alarmed Carrier" IAW the following guidelines: 

  1. Ideally the carrier will be constructed of solid electrical metallic tubing (EMT), ferrous conduit or pipe, or rigid-sheet steel ducting, utilizing elbows, couplings, nipples, and connectors of the same material. Connectors need not be permanently sealed in an alarmed carrier. As a minimum the carrier may consist of any material equal to or better than standards for a "Simple PDS" (e.g., wood, PVT, EMT, ferrous conduit. The key to determining the appropriateness of a PDS carrier is its suitability for supporting the functionality of the approved alarm sensor, which provides a means to detect tampering and/or breach of the actual PDS carrier - *not a breach of the space surrounding the carrier. An IDS sensor capable of detecting changes in carrier air pressure is an example of an acceptable detection methodology.

  2. As an alternative to an alarmed carrier, the space surrounding the entire carrier may be covered by an area or volumetric (e.g., infrared, motion detection) alarm system.
   
  3. The carrier and/or volumetric alarm system sensor employed must be approved by the cognizant physical security authorities. Documentation must exist to support this approval.
   
  4. The alarm system and signal transmission must be part of an Intrusion Detection System (IDS) meeting the requirements of the Appendix to Enclosure 3 of DOD Manual 5200.01, V3 (INFOSEC - Protection of Classified Information). For instance: The alarm must provide protection from tampering and be able to register malfunctions. The alarm system must also transmit a line fault message to the annunciator panel if the system fails.
   
  5. The alarm signal must be sent to a 24/7 monitor station that is supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination according to DOD Manual 5200.02 Procedures for the DOD Personnel Security Program (PSP).
   
  6. The monitor station must be capable of notifying security forces that can respond within 15 minutes.
   
  7. PDS alarm functionality and performance must be verified on at least a weekly basis IAW Table 5 of the CNSSI 7003.
   
  8. A Standard Operating Procedure (SOP) must be available, which is approved by the facility security officer or security manager and commander/director, and the PDS approval authority. 
   
  This SOP must include procedures to:

  a. Verify the alarm functionality and performance on at least a weekly basis IAW Table 5 of the CNSSI 7003.
   
  b. Ensure response by security personnel in the area of possible attempted penetration, within 15 minutes of discovery; 
   
  c. Provide for inspection of the PDS to determine the cause of the alarm;

  d. Define action to be taken regarding the termination of transmission;

  e. Initiate investigation of actual intrusion attempt, etc.

  9. The PDS must not be located within an Uncontrolled Access Area (UAA) and National Manager (NSA) approved encryption solutions must be employed.

check_text:
  An Alarmed PDS is one of five types of Category 2 PDS IAW the CNSSI 7003. It is a suitable alternative for the two types of interior PDS, which are Hardened Carrier or Continuously Viewed Carrier. It should be used when the unencrypted data transmission line is concealed above suspended ceilings, below raised floors, between walls or in any situation where the line is not visible for inspection. In lieu of daily visual inspections the functionality of the PDS alarm must be tested at least weekly - or as based on guidance in the CNSSI 7003.

  Use this set of checks where the unencrypted SIPRNet cable must be installed in a PDS and the site indicates it is an alarmed PDS.

  Check to ensure SIPRNet data cables are installed in a carrier properly configured as an "Alarmed Carrier" IAW the following guidelines:
   
  1. Ideally the carrier will be constructed of solid electrical metallic tubing (EMT), ferrous conduit or pipe, or rigid-sheet steel ducting, utilizing elbows, couplings, nipples, and connectors of the same material. Connectors need not be permanently sealed in an alarmed carrier. As a minimum the carrier may consist of any material equal to or better than standards for a "Simple PDS" (e.g., wood, PVT, EMT, ferrous conduit. The key to determining the appropriateness of a PDS carrier is its suitability for supporting the functionality of the approved alarm sensor, which provides a means to detect tampering and/or breach of the actual PDS carrier - *not a breach of the space surrounding the carrier. An alarmed carrier must be protected by an alarm system that detects attempted penetration of the carrier. An IDS sensor capable of detecting changes in carrier air pressure is an example of an acceptable detection methodology. (CAT I)

  2. As an alternative to an alarmed carrier, the space surrounding the entire carrier may be covered by an area or volumetric (e.g., infrared, motion detection) alarm system. (CAT I)

  3. The carrier and/or volumetric alarm system sensor employed must be approved by the cognizant physical security authorities. Documentation must exist to support this approval. (CAT II)

  4. The alarm system and signal transmission must be part of an Intrusion Detection System (IDS) meeting the requirements of the Appendix to Enclosure 3 of DOD Manual 5200.01,V3 (INFOSEC - Protection of Classified Information). For instance: The alarm must provide protection from tampering and be able to register malfunctions. The alarm system must also transmit a line fault message to the annunciator panel if the system fails. (CAT I)

  5. The alarm signal must be sent to a 24/7 monitor station that is supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination according to DOD Manual 5200.02 Procedures for the DOD Personnel Security Program (PSP). (CAT I)

  6. The monitor station must be capable of notifying security forces that can respond within 15 minutes. (CAT I)

  *NOTE: May be reduced to a CAT II severity level finding if the monitor station is capable of notifying security forces but the security forces are not capable of responding within 15 minutes.

  7. PDS alarm functionality and performance must be verified on at least a weekly basis IAW Table 5 of the CNSSI 7003. (CAT I)
   
  *NOTE: Alarm functionality tests performed less than weekly, but at least once every 3-months can be reduced to a CAT II severity level finding.

  8. A Standard Operating Procedure (SOP) must be available, which is approved by the facility security officer or security manager and commander/director, and the PDS approval authority. (CAT III)
   
  This SOP must include procedures to:

  a. Verify the alarm functionality and performance on at least a weekly basis IAW Table 5 of the CNSSI 7003.
   
  b. Ensure response by security personnel in the area of possible attempted penetration, within 15 minutes of discovery; 
   
  c. Provide for inspection of the PDS to determine the cause of the alarm;

  d. Define action to be taken regarding the termination of transmission;

  e. Initiate investigation of actual intrusion attempt, etc.

  9. The PDS is not located within an Uncontrolled Access Area (UAA) and National Manager (NSA) approved encryption solutions must be employed. (CAT I)


vuln_id: V-245736
rule_id: SV-245736r1138403_rule
severity: CAT II
title: Protected Distribution System (PDS) Construction - Visible for Inspection and Marked
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not completely visible for inspection and easily identified cannot be properly inspected and monitored as required, which could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, SC-8, and RA-6

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section VIII, paragraphs 23.c. and 24.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. The PDS must be visible for inspection. The Category 2 (Hardened) carrier should be installed in plain view to meet both Visual and Technical inspection requirements.
   
  2. The PDS should not be installed above a false ceiling, below a false floor, or inside a wall unless it is clear that all portions within the wall, above the ceiling or below the floor are inspectable by means identified in the PDS approval request.
   
  NOTE: If the PDS cannot be installed in plain view, or is rendered un-inspectable, then the PDS must be an alarmed carrier.

  3. The PDS must be marked to make it easily identifiable to the inspector. The markings should be placed at sufficient intervals to facilitate inspections, however, intervals shall not exceed 3 meters (approximately 10 feet).
   
  4. The PDS markings must consist of tape, paint, cable tags, or any other suitable method that does not obscure or impair inspection.
   
  5. The PDS must not be labeled as a PDS, or labeled with text that would indicate that it carries National Security Information (NSI).
   
  6. The markings must not be red, since this color is often used to identify fire sprinkler systems, fire alarm wires, and NSI.
   
  7. The PDS must not be painted unless using a distribution system that has a factory painted coating.

check_text:
  Check to ensure: 

  1. The PDS is visible for inspection. The Category 2 (Hardened) carrier should be installed in plain view to meet both Visual and Technical inspection requirements. 

  2. The PDS is not installed above a false ceiling, below a false floor, or inside a wall unless it is clear that all portions within the wall, above the ceiling or below the floor are inspectable by means identified in the PDS approval request.
   
  NOTE: If the PDS cannot be installed in plain view, or is rendered un-inspectable, then the PDS must be an alarmed carrier.

  3. The PDS is marked to make it easily identifiable to the inspector. The markings should be placed at sufficient intervals to facilitate inspections, however, intervals shall not exceed 3 meters (approximately 10 feet).
   
  4. The PDS markings consist of tape, paint, cable tags, or any other suitable method that does not obscure or impair inspection.
   
  5. The PDS is not labeled as a PDS, or labeled with text that would indicate that it carries National Security Information (NSI).
   
  6. The markings are not red, since this color is often used to identify fire sprinkler systems, fire alarm wires, and NSI.
   
  7. The PDS is not painted unless using a distribution system that has a factory painted coating.


vuln_id: V-245737
rule_id: SV-245737r1138404_rule
severity: CAT II
title: Protected Distribution System (PDS) Construction - Sealed Joints
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not constructed and sealed as required could result in the undetected interception of classified information. Sealing of joints is necessary to ensure that daily visual inspections of the PDS for signs of attempted or actual intrusion can be accurately and thoroughly conducted. 

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1  

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section VIII, paragraph 26. and Section X, paragraph 30.a & b.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All PDS seams and connectors must be permanently sealed completely around all surfaces (e.g., welding (continuous or track), epoxy, fusion). 

  2. When a connection consists of more than one seam (e.g., a compression couple), then all seams must be sealed. 

  3. The seal must provide a mechanical bond between the components of the carrier and are visible for inspection.
   
  4. Epoxy seals must use a thick, opaque material.
   
  5. Couplers that are secured with a "set screw" must not be used.

  6. If pull boxes are used during installation, the pull-box covers must be secured/sealed to the pull boxes by welding or epoxy after installation.

  7. If welded, at least one weld must be applied on each side of the box and cover.

  8. If epoxy is used, it must be applied between all mating surfaces continuously around the cover. 

  9. Painted surfaces must be treated to form a mechanically strong epoxy bond.

  10. Boxes with pre-punched knockouts must not be used under any circumstances.

  NOTE: If a pre-fabricated (Modular types such as Holocom or Wiremold) PDS is used it is also required to have all joints sealed as specified above.

check_text:
  Check to ensure:
   
  1. All PDS seams and connectors are permanently sealed completely around all surfaces (e.g., welding (continuous or track), epoxy, fusion).
   
  2. When a connection consists of more than one seam (e.g., a compression couple), then all seams must be sealed.
   
  3. The seal provides a mechanical bond between the components of the carrier and are visible for inspection. 

  4. Epoxy seals use a thick, opaque material.
   
  5. Couplers that are secured with a "set screw" are not used.

  6. If pull boxes are used during installation, check that the pull-box covers are secured/sealed to the pull boxes by welding or epoxy after installation.

  7. If welded, at least one weld must be applied on each side of the box and cover.

  8. If epoxy is used, it is applied between all mating surfaces continuously around the cover.
   
  9. Painted surfaces are treated to form a mechanically strong epoxy bond.

  10. Boxes with pre-punched knockouts are not used under any circumstances.

  NOTE: If a pre-fabricated (Modular types such as Holocom or Wiremold) PDS is used it is also required to have all joints sealed as specified above.


vuln_id: V-245738
rule_id: SV-245738r1138405_rule
severity: CAT III
title: Protected Distribution System (PDS) Documentation - Signed Approval
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not approved could cause an Information System Security Manager (ISSM), Authorizing Official (AO) and other concerned managerial personnel to not be fully aware of all vulnerabilities and residual risk of IA systems under their purview.

  REFERENCES:  

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section I, paragraph 1., Section III, paragraph 5., Section 4, paragraph 11., Section V, paragraph 14., Section VIII, paragraphs 23.c. and 27.a., Section X, paragraphs 30.a & b., Section XI, paragraph 34.b.2) and Annex A.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. The approval authority must be the system Authorizing Official (AO), cognizant security office for contractors or other Department or Agency designee having Approval Authority for the for the installation and operation of the PDS and 

  2. A documented approval of the PDS must be signed and dated by the current approval authority.
   
  NOTE: In tactical environments mobile systems employing inter-shelter cabling need not be re-approved for each relocation if the relocation provides security comparable to that of the original approval. Otherwise, new approval must be obtained.

check_text:
  Validate that: 

  1. The approval authority is the system Authorizing Official (AO), cognizant security office for contractors or other Department or Agency designee having Approval Authority for the installation and operation of the PDS and
   
  2. A documented approval of the PDS is signed and dated by the current approval authority.
   
  NOTE: In tactical environments mobile systems employing inter-shelter cabling need not be re-approved for each relocation if the relocation provides security comparable to that of the original approval. Otherwise, new approval must be obtained.


vuln_id: V-245739
rule_id: SV-245739r1138406_rule
severity: CAT III
title: Protected Distribution System (PDS) Documentation - Request for Approval Documentation
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not approved could cause an Information System Security Manager (ISSM), Authorizing Official (AO) and other concerned managerial personnel to not be fully aware of all vulnerabilities and residual risk of IA systems under their purview.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1  

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, and SC-8

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section I, paragraph 1., Section V, paragraph 14., Section VIII, paragraphs 23.c., Section X, paragraphs 30.a., and Annex A.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Documentation must exist for the initial request for PDS approval and any modification requests.

  PDS must be recertified when modified or when the threat level or security posture changes.

  A standard operating procedure (SOP) to ensure proper installation, maintenance, operation and inspection of the PDS must be developed by the PDS owner, approved by the AO, and approved by the cognizant security authority. *The SOP must be submitted as a part of the PDS approval documentation.

  PDS approval documentation and all updates should be kept for the lifetime of the physical structure of the PDS.

  If the initial documentation or modification requests were not prepared or documentation cannot be located the fix is to prepare a request for PDS approval IAW the CNSSI 7003 template at Annex A and submit to the approving authority for approval.

check_text:
  This check concerns the documentation prepared and submitted to the PDS approval authority. Any subsequent requests for modification of the PDS should also be available for review. Check to ensure:
   
  1. The PDS documentation is complete and current. Review a copy of the initial Request for Approval of PDS, which must contain the information IAW Annex A, CNSSI 7003.
   
  2. Any requests for modification of the PDS approval are also available for review and contain the appropriate information.

  3. PDS are recertified when modified or when the threat level or security posture changes.
   
  4. PDS approval documentation and all updates are kept for the lifetime of the physical structure of the PDS.

  5. That a standard operating procedure (SOP) to ensure proper installation, maintenance, operation and inspection of the PDS is developed by the PDS owner, approved by the AO, and approved by the cognizant security authority. *The SOP must be submitted as a part of the PDS approval documentation.

  NOTES: Applies in a tactical environment but will likely not be available in mobile field locations. Such documentation should be available for inspection at a location where supporting headquarters staff (ISSM, SM) would logically be located. Observations and comments may be entered, even if there is no finding.


vuln_id: V-24540
rule_id: CS-06.02.01_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Protected Distribution System (PDS) Monitoring                                          Daily (Visual) Checks

description:
  Check Content: A PDS carrying SIPRNet cable is subject to periodic visual inspections IAW (Table 3. Visual Inspection Schedule, of CNSSI 7003). Check to ensure: 1. At least one daily inspection of the PDS line is conducted or more frequently if required by Table 3. 2. A log is maintained of the PDS inspections. The log must contain the date of the inspection, the time of the inspection, the inspector’s name, and the inspector’s title. The log must be kept on record for a minimum of one year. 3. Person(s) are formally appointed (in writing) to conduct the visual inspections. 4. The person(s) appointed to accomplish the visual inspection are trained sufficiently to recognize physical changes in PDS including attempts at penetration and tampering. 5. That visual PDS inspections as detailed in Table 3 are conducted 365 days a year.

check_text:
  Check Content: A PDS carrying SIPRNet cable is subject to periodic visual inspections IAW (Table 3. Visual Inspection Schedule, of CNSSI 7003). Check to ensure: 1. At least one daily inspection of the PDS line is conducted or more frequently if required by Table 3. 2. A log is maintained of the PDS inspections. The log must contain the date of the inspection, the time of the inspection, the inspector’s name, and the inspector’s title. The log must be kept on record for a minimum of one year. 3. Person(s) are formally appointed (in writing) to conduct the visual inspections. 4. The person(s) appointed to accomplish the visual inspection are trained sufficiently to recognize physical changes in PDS including attempts at penetration and tampering. 5. That visual PDS inspections as detailed in Table 3 are conducted 365 days a year.


vuln_id: V-245741
rule_id: SV-245741r1138408_rule
severity: CAT II
title: Protected Distribution System (PDS) Monitoring - Reporting Incidents
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, SC-8, IR-4, IR-6, and PE-19

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section XI, paragraph 32.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A procedure must be written that covers how to handle all possible types of potential PDS incidents.
   
  2. ALL incidents of suspected or actual tampering, penetration, or unauthorized interception must be reported immediately to the PDS Approving Authority and the local security/law enforcement authority.

  3. Subject to law enforcement procedures, which take precedence, the PDS must not be used until the incident is assessed and its security status determined.
   
  4. If discontinued use of the PDS is or was not practical, all users of impacted PDS must be notified of the possible breach in security and instructed that use of systems running on the PDS be limited to the greatest extent possible.
   
  5. All discoveries must be documented and such documentation retained indefinitely -for as long as the PDS remains functional.

check_text:
  1. Check to ensure there are procedures written that cover how to handle all possible types of potential PDS incidents.
   
  2. Check daily and technical inspection results (logs) for evidence of discovered PDS anomalies.
   
  3. Ensure any incidents of tampering, penetration, or unauthorized interception were reported immediately to the PDS Approving Authority and the local security/law enforcement authority. 

  4. Subject to law enforcement procedures, which take precedence, check to ensure the PDS was not used until the incident was assessed and its security status determined.
   
  5. If discontinued use of the PDS is or was not practical, check to ensure users of all impacted PDS were notified of the possible breach in security, and instructed that use of systems running on the PDS be limited to the greatest extent possible.
   
  6. Discovery of an anomaly in the PDS that is not properly reported and resolved is a finding. All discoveries must be documented and such documentation retained indefinitely -for as long as the PDS remains functional.
   
  NOTES:

  1. This check is applicable to tactical environments. Incidents of possible tampering must be reported to the PDS approving authority in as expeditious a manner as possible.

  2. Even if there is no finding, in the reviewer notes provide a brief note of any reported incidents or anomalies previously noted by the site, including the date it was initially noted.


vuln_id: V-245742
rule_id: SV-245742r1138409_rule
severity: CAT III
title: Protected Distribution System (PDS) Monitoring - Technical Inspections
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, SC-8, IR-4, IR-6, and PE-19

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section XI, paragraph 34. and Table 4. PDS Technical Inspection Schedule.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Correction of this finding can only be made by complete compliance with all the following CNSSI 7003 requirements:

  1. Technical inspections of PDS must be conducted at least one or more times annually IAW Table 4. PDS Technical Inspection Schedule, of the CNSSI 7003.
   
  2. Checks and results must be documented and retained on file for a minimum of one year - or longer if required by the AO.
   
  3. The person selected to accomplish the technical system inspection must be trained to recognize changes in the technical aspects of PDS, e.g., by-pass circuitry, attachment or removal of devices or components, inappropriate or suspicious signal levels, and mechanical, TEMPEST, and RED/BLACK integrity of the PDS. If conducted by the CTTA this meets the requirement; otherwise, sufficient documented proof of training must be provided for the person conducting the inspection.
   
  NOTE: This check is applicable within a tactical environment in a fixed facility but not applicable in a mobile field environment.

check_text:
  Check to ensure:
   
  1. Technical inspections of PDS are conducted at least one or more times annually IAW Table 4. PDS Technical Inspection Schedule of the CNSSI 7003.
   
  2. Checks and results must be documented and retained on file for a minimum of one year - or longer if required by the AO.

  3. The person selected to accomplish the technical system inspection is trained to recognize changes in the technical aspects of PDS, e.g., by-pass circuitry, attachment or removal of devices or components, inappropriate or suspicious signal levels, and mechanical, TEMPEST, and RED/BLACK integrity of the PDS. If conducted by the CTTA this meets the requirement; otherwise, sufficient documented proof of training must be provided for the person conducting the inspection.
   
  NOTE: This check is applicable within a tactical environment in a fixed facility but not applicable in a mobile field environment.


vuln_id: V-245743
rule_id: SV-245743r1138410_rule
severity: CAT III
title: Protected Distribution System (PDS) Monitoring - Initial Inspection
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1
    
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, SC-8, IR-4, IR-6, and PE-19

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 10, and Section XI, paragraph 34.b. 2) a)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Following is a reiteration of the requirement:
   
  1. The PDS must be inspected prior to initial operation. Documentation of the inspection and results must be available for review. This meets the following requirement from the CNSSI 7003: "The Approval Authority (AO) shall ensure PDS are inspected in accordance with SECTION XI and certified prior to initial operation."

  2. The initial inspection must be a technical inspection performed by a trained CTTA prior to approval of the PDS by the AO.

  3. The initial inspection must document the path of the PDS, the locations for all pull boxes, and the locations for all conduit joints at intervals less than the length of conduit segments (typically 10 feet).
   
  NOTES:

  1. The PDS may be documented using detailed "as-built" installation drawings or photographs. *Subsequent technical inspections can then verify the path of the PDS and the location of pull boxes and joints.

  2. When test equipment is locally available and resident expertise allows, the initial inspection should measure and record the electrical characteristics of the PDS lines to obtain a baseline electrical profile of the PDS.
   
  3. Such measurements may consist of signal levels, voltage levels, time domain reflectometer (TDR) recorded readings, and any other electrical measurements that may be recorded and retained. * Subsequent technical inspections may then record and compare measurements taken to the previously recorded baseline measurements to identify possible tampering attempts.

  4. This check is applicable in a tactical environment if the PDS is located within a fixed facility. It is not applicable to field/mobile PDS.
   
  5. In the reviewer notes be sure to provide the date of the initial inspection, name of inspector and general description of results.

  6. Obviously an initial inspection cannot ever be conducted once it is not completed. Therefore the fix for this finding is to send a written request to the PDS approval authority asking for an "initial" inspection of the PDS by an individual appointed by the approval authority. If the approval authority concurs to conduct the inspection then this finding can be closed once the inspection is actually completed and any results form that inspection are closed. If the reply from the approval authority indicates they will not complete their "required" inspection then then finding can be closed and the reply from the approval authority should be maintained for future reference.

check_text:
  Check to ensure:

  1. The PDS was inspected prior to initial operation. Documentation of the inspection and results should be available for review. This meets the following requirement from the CNSSI 7003: "The Approval Authority (AO) must ensure PDS are inspected in accordance with SECTION XI and certified prior to initial operation."

  2. The initial inspection was a technical inspection performed by a trained CTTA prior to approval of the PDS by the AO.

  3. The initial inspection documented the path of the PDS, the locations for all pull boxes, and the locations for all conduit joints at intervals less than the length of conduit segments (typically 10 feet).

  NOTES: 

  1. The PDS may be documented using detailed "as-built" installation drawings or photographs. *Subsequent technical inspections can then verify the path of the PDS and the location of pull boxes and joints.

  2. When test equipment is locally available and resident expertise allows, the initial inspection should measure and record the electrical characteristics of the PDS lines to obtain a baseline electrical profile of the PDS.
   
  3. Such measurements may consist of signal levels, voltage levels, time domain reflectometer (TDR) recorded readings, and any other electrical measurements that may be recorded and retained. * Subsequent technical inspections may then record and compare measurements taken to the previously recorded baseline measurements to identify possible tampering attempts.

  4. This check is applicable in a tactical environment if the PDS is located within a fixed facility. It is not applicable to field/mobile PDS.
   
  5. In the reviewer notes be sure to provide the date of the initial inspection, name of inspector and general description of results.


vuln_id: V-245744
rule_id: SV-245744r1138411_rule
severity: CAT II
title: Environmental IA Controls - Emergency Power Shut-Off (EPO)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A lack of an emergency shut-off switch or a master power switch for electricity to IT equipment could cause damage to the equipment or injury to personnel during an emergency.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
    
  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-10 and PE-10(1)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100 Information Security Handbook: A Guide for Managers

  NFPA 79 & OSHA Emergency Stop Requirement</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A master power switch or emergency cut-off switch for the IT equipment must be located inside the IT area near the main entrance.
   
  2. The emergency switch must be properly labeled.
   
  3. The emergency switch must be protected by a cover to prevent accidental shut-off of the power.

  NOTE: Per NFPA 76 and OSHA Emergency Stop Requirements the EPO shall be bright yellow with red button, an emergency push button, "e-stop" or emergency stop/disconnection is required where there is a risk of an emergency or potential unsafe condition for equipment or for the operator. The switch shall be continually operable, readily accessible, and initiated via a single human action via a mechanical latching mechanism.

check_text:
  Check an emergency power cut-off (EPO) switch is located inside the IT room or area near the main entrance/exit. It must be clearly labeled and have a protective cover. Per NFPA 76 and OSHA Emergency Stop Requirements the EPO shall be bright yellow with red button, an emergency push button, "e-stop" or emergency stop/disconnection is required where there is a risk of an emergency or potential unsafe condition for equipment or for the operator. The switch shall be continually operable, readily accessible, and initiated via a single human action via a mechanical latching mechanism. This requirement is only for computer centers with large server rooms and/or supporting infrastructure rooms hosting large amounts of network equipment and/or equipment such as chillers, battery backup, transformers, etc. 

  NOTES: In general, a server/computer room will have raised floor space and air conditioning and host multiple servers. The requirement should not be applied to purely administrative/office space. Also, this requirement should not be applied to a tactical environment unless it is clearly an "established" fixed computer facility supporting missions in a Theater of Operations. The standards to be applied to determine applicability in a tactical environment are: 
  1. The facility containing the computer room has been in operation more than one year. 
  2. The facility is "fixed facility" - a hard building made from normal construction materials (wood, steel, brick, stone, mortar, etc.).


vuln_id: V-245745
rule_id: SV-245745r1138412_rule
severity: CAT II
title: Environmental IA Controls - Emergency Lighting and Exits - Properly Installed
fix_text: Emergency lighting and exit signage must be installed in areas containing information systems.
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of automatic emergency lighting and exits can cause injury and/or death to employees and emergency responders. Lack of automatic emergency lighting can also cause a disruption in service.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
        
  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-12 and PE-12(1)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100 Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Check that emergency lighting and exits are located in IT areas. 

  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations.

  The standards to be considered for applicability in a tactical environment are: 

  1) The facility containing the computer room has been in operation over one year. 

  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


