Skip to main content
CUI

STIG Rule - V-204808

V-204808

SV-204808r981695_rule

CAT II

The application server must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.

From: Application Server Security Requirements Guide (V4R4)

Description

<VulnDiscussion>Access may be denied to legitimate users if FICAM-approved third-party credentials are not accepted. This requirement typically applies to organizational information systems that are accessible to non-federal government agencies and other partners. This allows federal government relying parties to trust such credentials at their approved assurance levels. Third-party credentials are those credentials issued by nonfederal government entities approved by the FICAM Trust Framework Solutions initiative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

Check Procedure

Review the application server documentation and configuration to determine if the application server accepts FICAM-approved third-party credentials. If the application server does not accept FICAM-approved third-party credentials, this is a finding.

Fix Text

Configure the application server to accept FICAM-approved third-party credentials.

CCI Reference

CCI-004083
Created
2026-04-07 20:08:11
Last Updated
2026-04-07 20:08:11
CUI