V-204808
SV-204808r981695_rule
CAT II
The application server must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.
From: Application Server Security Requirements Guide (V4R4)
Description
<VulnDiscussion>Access may be denied to legitimate users if FICAM-approved third-party credentials are not accepted.
This requirement typically applies to organizational information systems that are accessible to non-federal government agencies and other partners. This allows federal government relying parties to trust such credentials at their approved assurance levels.
Third-party credentials are those credentials issued by nonfederal government entities approved by the FICAM Trust Framework Solutions initiative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
Review the application server documentation and configuration to determine if the application server accepts FICAM-approved third-party credentials.
If the application server does not accept FICAM-approved third-party credentials, this is a finding.
Fix Text
Configure the application server to accept FICAM-approved third-party credentials.
CCI Reference
CCI-004083- Created
- 2026-04-07 20:08:11
- Last Updated
- 2026-04-07 20:08:11