V-222627
Application Security and Development Security Technical Implementation Guide
Title
The ISSO must ensure if a DoD STIG or NSA guide is not available, a third-party product will be configured by following available guidance.
Description
<VulnDiscussion>Not all COTS products are covered by a STIG. Those products not covered by a STIG, should follow commercially accepted best practices, independent testing results and vendors lock down guides and recommendations if they are available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools...
Fix Text (Documentation Requirement)
Configure the application according to the product STIG or when a STIG is not available, utilize: - commercially accepted practices, - independent testing results, or - vendor literature and lock down guides.