What changed in CA API Gateway ALG STIG V1R3V1R3 changes

CA API Gateway ALG STIG V1R3 (2024-07-24) replaced V1R2 (2017-04-28): 82 checks added, 81 removed. It has 82 checks, against 81 in V1R2.

V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare

  • 82 added
  • 81 removed
  • 0 updated

Added in V1R3 (82)

  • V-237342CAT IIThe CA API Gateway must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.
  • V-237343CAT IIThe CA API Gateway must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
  • V-237344CAT IIThe CA API Gateway must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
  • V-237345CAT IIThe CA API Gateway providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
  • V-237346CAT IIThe CA API Gateway providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
  • V-237347CAT IIThe CA API Gateway providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
  • V-237348CAT IIThe CA API Gateway providing user access control intermediary services must limit users to two concurrent sessions.
  • V-237349CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
  • V-237350CAT IIThe CA API Gateway that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.
  • V-237351CAT IIThe CA API Gateway that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
  • V-237352CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
  • V-237353CAT IIThe CA API Gateway must produce audit records containing information to establish the source of the events.
  • V-237354CAT IIThe CA API Gateway must produce audit records containing information to establish the outcome of the events.
  • V-237355CAT IIThe CA API Gateway must generate audit records containing information to establish the identity of any individual or process associated with the event.
  • V-237356CAT IIThe CA API Gateway must protect audit information from unauthorized read access.
  • V-237357CAT IIThe CA API Gateway must protect audit information from unauthorized deletion.
  • V-237358CAT IIThe CA API Gateway must protect audit tools from unauthorized access.
  • V-237359CAT IIThe CA API Gateway must not have unnecessary services and functions enabled.
  • V-237360CAT IIThe CA API Gateway must be configured to remove or disable unrelated or unneeded application proxy services.
  • V-237361CAT IIThe CA API Gateway must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
  • V-237362CAT IIThe CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-237363CAT IIThe CA API Gateway providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) that validate user account access authorizations and privileges.
  • V-237364CAT IIThe CA API Gateway providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
  • V-237365CAT IIThe ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.
  • V-237366CAT IIThe CA API Gateway providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
  • V-237367CAT IIThe CA API Gateway providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
  • V-237368CAT IIThe CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
  • V-237369CAT IIThe CA API Gateway providing content filtering must block outbound traffic containing known and unknown Denial of Service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
  • V-237370CAT IIThe CA API Gateway must terminate all network connections associated with a Policy Manager session at the end of the session or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity within the Policy Manager, and for user sessions simply viewing the contents of Policy Manager or viewing Audit Logs for tracking purposes (non-privileged session), the session must be terminated after 15 minutes of inactivity.
  • V-237371CAT IIThe CA API Gateway must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.
  • V-237372CAT IIThe CA API Gateway must protect the authenticity of communications sessions.
  • V-237373CAT IIThe CA API Gateway must invalidate session identifiers upon user logout or other session termination.
  • V-237374CAT IIThe CA API Gateway must generate unique session identifiers using a FIPS 140-2 approved random number generator.
  • V-237375CAT IIThe CA API Gateway providing content filtering must integrate with an ICAP-enabled Intrusion Detection System that updates malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-237376CAT IIThe CA API Gateway providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.
  • V-237377CAT IIThe CA API Gateway providing content filtering must block malicious code upon detection.
  • V-237378CAT IIThe CA API Gateway providing content filtering must delete or quarantine malicious code in response to malicious code detection.
  • V-237379CAT IIThe CA API Gateway providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
  • V-237380CAT IIThe CA API Gateway providing content filtering must automatically update malicious code protection mechanisms.
  • V-237381CAT IIThe CA API Gateway must generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.
  • V-237382CAT IIThe CA API Gateway providing content filtering must block or restrict detected prohibited mobile code.
  • V-237383CAT IIThe CA API Gateway providing content filtering must prevent the download of prohibited mobile code.
  • V-237384CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must control remote access methods.
  • V-237385CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237386CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-237387CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237388CAT IITo protect against data mining, the CA API Gateway providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-237389CAT IITo protect against data mining, the CA API Gateway providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-237390CAT IITo protect against data mining, the CA API Gateway providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-237391CAT IIThe CA API Gateway must off-load audit records onto a centralized log server.
  • V-237392CAT IIThe CA API Gateway providing user authentication intermediary services must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
  • V-237393CAT IIThe CA API Gateway providing user authentication intermediary services must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-237394CAT IIThe CA API Gateway providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-237395CAT IIThe CA API Gateway must prohibit the use of cached authenticators after an organization-defined time period.
  • V-237396CAT IIThe CA API Gateway providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
  • V-237397CAT IIThe CA API Gateway providing user authentication intermediary services must conform to Federal Identity, Credential, and Access Management (FICAM) issued profiles.
  • V-237398CAT IIThe CA API Gateway providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
  • V-237399CAT IIThe CA API Gateway providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
  • V-237400CAT IIThe CA API Gateway must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
  • V-237401CAT IIThe CA API Gateway must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
  • V-237402CAT IIThe CA API Gateway must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
  • V-237403CAT IIThe CA API Gateway providing content filtering must be configured to integrate with a system-wide intrusion detection system.
  • V-237404CAT IIThe CA API Gateway providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
  • V-237405CAT IIThe CA API Gateway providing content filtering must generate a notification on the console when root-level intrusion events that attempt to provide unauthorized privileged access are detected.
  • V-237406CAT IIIThe CA API Gateway providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when user-level intrusions that provide non-privileged access are detected.
  • V-237407CAT IIIThe CA API Gateway providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when Denial of Service (DoS) incidents are detected.
  • V-237408CAT IIThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.
  • V-237409CAT IIThe CA API Gateway providing user authentication intermediary services must transmit only encrypted representations of passwords.
  • V-237410CAT IIThe CA API Gateway must check the validity of all data inputs except those specifically identified by the organization.
  • V-237411CAT IIThe CA API Gateway must reveal error messages only to the ISSO, ISSM, and SCA.
  • V-237412CAT IIThe CA API Gateway providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.
  • V-237413CAT IIThe CA API Gateway providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.
  • V-237414CAT IIThe CA API Gateway providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
  • V-237415CAT IIThe CA API Gateway providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
  • V-237416CAT IIThe CA API Gateway providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
  • V-237417CAT IIThe CA API Gateway must off-load audit records onto a centralized log server in real time.
  • V-237418CAT IIThe CA API Gateway that provides intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.
  • V-237419CAT IIThe CA API Gateway that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
  • V-237420CAT IIThe CA API Gateway providing user access control intermediary services must automatically terminate a user session when organization-defined conditions or trigger events that require a session disconnect occur.
  • V-237421CAT IIThe CA API Gateway providing user access control intermediary services must provide a logoff capability for user-initiated communications sessions.
  • V-237422CAT IIThe CA API Gateway providing user access control intermediary services must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.
  • V-264434CAT IThe CA API ALG must be using a version supported by the vendor.

Removed since V1R2 (81)

  • V-71283CAT IIThe CA API Gateway must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.
  • V-71285CAT IIThe CA API Gateway must enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
  • V-71287CAT IIThe CA API Gateway must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic.
  • V-71289CAT IIThe CA API Gateway providing user access control intermediary services must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
  • V-71291CAT IIThe CA API Gateway providing user access control intermediary services must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
  • V-71293CAT IIThe CA API Gateway providing user access control intermediary services for publicly accessible applications must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
  • V-71295CAT IIThe CA API Gateway providing user access control intermediary services must limit users to two concurrent sessions.
  • V-71299CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
  • V-71307CAT IIThe CA API Gateway that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.
  • V-71315CAT IIThe CA API Gateway that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.
  • V-71325CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
  • V-71329CAT IIThe CA API Gateway must produce audit records containing information to establish the source of the events.
  • V-71333CAT IIThe CA API Gateway must produce audit records containing information to establish the outcome of the events.
  • V-71335CAT IIThe CA API Gateway must generate audit records containing information to establish the identity of any individual or process associated with the event.
  • V-71337CAT IIThe CA API Gateway must protect audit information from unauthorized read access.
  • V-71339CAT IIThe CA API Gateway must protect audit information from unauthorized deletion.
  • V-71341CAT IIThe CA API Gateway must protect audit tools from unauthorized access.
  • V-71343CAT IIThe CA API Gateway must not have unnecessary services and functions enabled.
  • V-71345CAT IIThe CA API Gateway must be configured to remove or disable unrelated or unneeded application proxy services.
  • V-71347CAT IIThe CA API Gateway must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.
  • V-71349CAT IIThe CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-71351CAT IIThe CA API Gateway providing user access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) that validate user account access authorizations and privileges.
  • V-71353CAT IIThe CA API Gateway providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s).
  • V-71355CAT IIThe ALG providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts.
  • V-71357CAT IIThe CA API Gateway providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
  • V-71359CAT IIThe CA API Gateway providing PKI-based user authentication intermediary services must map authenticated identities to the user account.
  • V-71361CAT IIThe CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
  • V-71363CAT IIThe CA API Gateway providing content filtering must block outbound traffic containing known and unknown Denial of Service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.
  • V-71365CAT IIThe CA API Gateway must terminate all network connections associated with a Policy Manager session at the end of the session or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity within the Policy Manager, and for user sessions simply viewing the contents of Policy Manager or viewing Audit Logs for tracking purposes (non-privileged session), the session must be terminated after 15 minutes of inactivity.
  • V-71367CAT IIThe CA API Gateway must detect, at a minimum, mobile code that is unsigned or exhibiting unusual behavior, has not undergone a risk assessment, or is prohibited for use based on a risk assessment.
  • V-71369CAT IIThe CA API Gateway must protect the authenticity of communications sessions.
  • V-71371CAT IIThe CA API Gateway must invalidate session identifiers upon user logout or other session termination.
  • V-71373CAT IIThe CA API Gateway must generate unique session identifiers using a FIPS 140-2 approved random number generator.
  • V-71375CAT IIThe CA API Gateway providing content filtering must integrate with an ICAP-enabled Intrusion Detection System that updates malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
  • V-71377CAT IIThe CA API Gateway providing content filtering must be configured to perform real-time scans of files from external sources at network entry/exit points as they are downloaded and prior to being opened or executed.
  • V-71379CAT IIThe CA API Gateway providing content filtering must block malicious code upon detection.
  • V-71381CAT IIThe CA API Gateway providing content filtering must delete or quarantine malicious code in response to malicious code detection.
  • V-71383CAT IIThe CA API Gateway providing content filtering must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.
  • V-71385CAT IIThe CA API Gateway providing content filtering must automatically update malicious code protection mechanisms.
  • V-71387CAT IIThe CA API Gateway must generate error messages that provide the information necessary for corrective actions without revealing information that could be exploited by adversaries.
  • V-71389CAT IIThe CA API Gateway providing content filtering must block or restrict detected prohibited mobile code.
  • V-71391CAT IIThe CA API Gateway providing content filtering must prevent the download of prohibited mobile code.
  • V-71393CAT IIThe CA API Gateway providing intermediary services for remote access communications traffic must control remote access methods.
  • V-71395CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-71397CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-71399CAT IITo protect against data mining, the CA API Gateway providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-71421CAT IITo protect against data mining, the CA API Gateway providing content filtering must detect code injection attacks from being launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
  • V-71423CAT IITo protect against data mining, the CA API Gateway providing content filtering must detect SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields.
  • V-71425CAT IITo protect against data mining, the CA API Gateway providing content filtering as part of its intermediary services must detect code injection attacks launched against application objects including, at a minimum, application URLs and application code.
  • V-71427CAT IIThe CA API Gateway must off-load audit records onto a centralized log server.
  • V-71429CAT IIThe CA API Gateway providing user authentication intermediary services must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
  • V-71431CAT IIThe CA API Gateway providing user authentication intermediary services must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-71433CAT IIThe CA API Gateway providing user authentication intermediary services must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
  • V-71435CAT IIThe CA API Gateway must prohibit the use of cached authenticators after an organization-defined time period.
  • V-71437CAT IIThe CA API Gateway providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
  • V-71439CAT IIThe CA API Gateway providing user authentication intermediary services must conform to Federal Identity, Credential, and Access Management (FICAM) issued profiles.
  • V-71441CAT IIThe CA API Gateway providing user authentication intermediary services using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions.
  • V-71443CAT IIThe CA API Gateway providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
  • V-71445CAT IIThe CA API Gateway must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
  • V-71447CAT IIThe CA API Gateway must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
  • V-71449CAT IIThe CA API Gateway must behave in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
  • V-71451CAT IIThe CA API Gateway providing content filtering must be configured to integrate with a system-wide intrusion detection system.
  • V-71453CAT IIThe CA API Gateway providing content filtering must send an alert to, at a minimum, the ISSO and ISSM when detection events occur.
  • V-71455CAT IIThe CA API Gateway providing content filtering must generate a notification on the console when root-level intrusion events that attempt to provide unauthorized privileged access are detected.
  • V-71457CAT IIIThe CA API Gateway providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when user-level intrusions that provide non-privileged access are detected.
  • V-71459CAT IIIThe CA API Gateway providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when Denial of Service (DoS) incidents are detected.
  • V-71461CAT IIThe ALG providing content filtering must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.
  • V-71463CAT IIThe CA API Gateway providing user authentication intermediary services must transmit only encrypted representations of passwords.
  • V-71465CAT IIThe CA API Gateway must check the validity of all data inputs except those specifically identified by the organization.
  • V-71467CAT IIThe CA API Gateway must reveal error messages only to the ISSO, ISSM, and SCA.
  • V-71469CAT IIThe CA API Gateway providing user access control intermediary services must generate audit records when successful/unsuccessful logon attempts occur.
  • V-71471CAT IIThe CA API Gateway providing user access control intermediary services must generate audit records showing starting and ending time for user access to the system.
  • V-71473CAT IIThe CA API Gateway providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.
  • V-71475CAT IIThe CA API Gateway providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures.
  • V-71477CAT IIThe CA API Gateway that provides intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies.
  • V-71479CAT IIThe CA API Gateway that provides intermediary services for HTTP must inspect inbound and outbound HTTP traffic for protocol compliance and protocol anomalies.
  • V-71481CAT IIThe CA API Gateway providing user access control intermediary services must automatically terminate a user session when organization-defined conditions or trigger events that require a session disconnect occur.
  • V-71483CAT IIThe CA API Gateway providing user access control intermediary services must provide a logoff capability for user-initiated communications sessions.
  • V-71485CAT IIThe CA API Gateway providing user access control intermediary services must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.
  • V-71487CAT IIThe CA API Gateway providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services.
  • V-71489CAT IIThe CA API Gateway must off-load audit records onto a centralized log server in real time.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.