CUI

USNS MONTFORD POINT - Findings

Back to Ship Export CSV Download POA&M

Showing 3 of 3 findings (filtered) View Documentation Status (90 tracked)

Vuln ID	Severity	Asset	STIG	Title	Status	Doc Status	Assigned To	Actions
V-218749	CAT II	MONT-MB-002	Microsoft IIS 10.0 Site Security Technic...	A private IIS 10.0 website authentication mechanis...		Documented Pending Review
Check Text Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable. Note: If the server being reviewed is hosting SharePoint, this is not applicable. Note: If the server being reviewed is hosting WSUS, this is not applicable. Note: If certificate handling is performed at the Proxy/Load Balancer, this is not applicable. Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable. Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable. Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. If the "Clients Certificate Required" check box is not selected, this is a finding. Fix Text Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. Select "Apply" from the "Actions" pane. Finding Details Evaluate-STIG 1.2507.5 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 10/23/2025 Site: Default Web Site ResultHash: C9147AB75E3FE047BDF3394C860E38FD3A03A4FC ~~~~~ Client Certificates is NOT set to 'Require' Confirm if this this is a public server. If so, mark this finding as Not Applicable. Source: _Reviewed/MONT-MB-002/Checklist/MONT-MB-002_IIS10Site_Default_Web_Site_V2R12_20251023-152518.ckl Scan Date: 2026-01-14T12:57:33.098574 Technology Area: Web Review
V-218749	CAT II	MONT-MB-002	Microsoft IIS 10.0 Site Security Technic...	A private IIS 10.0 website authentication mechanis...		Documented Pending Review
Check Text Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable. Note: If the server being reviewed is hosting SharePoint, this is not applicable. Note: If the server being reviewed is hosting WSUS, this is not applicable. Note: If certificate handling is performed at the Proxy/Load Balancer, this is not applicable. Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable. Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable. Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. If the "Clients Certificate Required" check box is not selected, this is a finding. Fix Text Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. Select "Apply" from the "Actions" pane. Finding Details Evaluate-STIG 1.2507.5 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 10/23/2025 Site: Exchange Back End ResultHash: C9147AB75E3FE047BDF3394C860E38FD3A03A4FC ~~~~~ Client Certificates is NOT set to 'Require' Confirm if this this is a public server. If so, mark this finding as Not Applicable. Source: _Reviewed/MONT-MB-002/Checklist/MONT-MB-002_IIS10Site_Exchange_Back_End_V2R12_20251023-152602.ckl Scan Date: 2026-01-14T12:57:33.300070 Technology Area: Web Review
V-218749	CAT II	MONT-DP-001	Microsoft IIS 10.0 Site Security Technic...	A private IIS 10.0 website authentication mechanis...		Documented Pending Review
Check Text Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable. Note: If the server being reviewed is hosting SharePoint, this is not applicable. Note: If the server being reviewed is hosting WSUS, this is not applicable. Note: If certificate handling is performed at the Proxy/Load Balancer, this is not applicable. Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable. Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable. Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. If the "Clients Certificate Required" check box is not selected, this is a finding. Fix Text Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. Select "Apply" from the "Actions" pane. Finding Details Evaluate-STIG 1.2507.5 (Scan-IIS10_0_Site_Checks) found this to be OPEN on 10/23/2025 Site: Default Web Site ResultHash: C9147AB75E3FE047BDF3394C860E38FD3A03A4FC ~~~~~ Client Certificates is NOT set to 'Require' Confirm if this this is a public server. If so, mark this finding as Not Applicable. Comments If the server is hosting WSUS, this is Not Applicable. Source: _Reviewed/MONT-DP-001/Checklist/MONT-DP-001_IIS10Site_Default_Web_Site_V2R12_20251023-143912.ckl Scan Date: 2026-01-14T12:57:35.375369 Technology Area: Web Review

CUI