V1R2 changes
Cloud Computing Mission Owner Network Security Requirements Guide V1R2 (2025-01-30) replaced V1R1 (2024-06-14): 2 checks updated. It has 9 checks, against 9 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 0 added
- 0 removed
- 2 updated
Updated fields: Check text 2Fix text 2Title 2Severity 2Discussion 2
Updated in V1R2 (2)
V-259870CAT IThe Mission Owner must configure the Infrastructure as a Service (IaaS)/Platform to use certificate path validation to ensure revoked user credentials are prohibited from establishing a user or machine session.Title, Severity, Check text, Fix text, Discussion
Title
The Mission Owner ofmust configure the Infrastructure as a Service (IaaS)/Platform asto ause Servicecertificate (PaaS)path mustvalidation implementto anensure encrypted,revoked FIPSuser 140-2/3credentials compliantare pathprohibited betweenfrom theestablishing implementeda systems/applicationsuser andor themachine DOD Online Certificate Status Protocol (OCSP) responderssession.
Severity
mediumhigh
Check text
This applies to all Impact Levels.
If this is a Software as a Service (SaaS) implementation, this is not a finding.
Verify that acertificate FIPSpath 140-2/3validation compliantis communicationimplemented protocolto isensure configuredrevoked foruser communicationand/or betweenmachine thecredentials implementedare systems/applicationsprohibited andfrom theestablishing DODa OCSPuser respondersor machine session.
If the cloud IaaS/PaaS doesis not implementconfigured ato secureuse (encrypted)OCSP connection or pathCRLDP betweento theensure implementedrevoked systems/applicationscredentials andare theprohibited DODfrom OCSPestablishing respondersan allowed session, this is a finding.
Fix text
This applies to all Impact Levels.
FedRAMP Moderate, High.
Configure the IaaS/PaaS to implementuse anOCSP encryptedor pathCRLDP thatto isensure FIPSrevoked 140-2/3credentials compliantare betweenprohibited thefrom implementedestablishing systems/applicationsan andallowed session. This requirement applies to the DODuse OCSPof respondersboth user and machine credentials.
Discussion
TheA Missioncertificate's Ownercertification mustpath useis identitythe services,path includingfrom anthe OCSPend responder,entity forcertificate remoteto systema DODtrusted Commonroot Accesscertification Cardauthority (CACCA). two-factorCertification authenticationpath validation is necessary for a relying party to make an informed decision regarding acceptance of DODan privilegedend (allentity Impactcertificate.
Certification Levels)path and/orvalidation nonprivilegedincludes userschecks (Impactsuch Levelsas 4–6)certificate toissuer systemstrust, instantiatedtime withinvalidity, and revocation status for each certificate in the cloudcertification servicepath. environmentRevocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.
V-259871CAT IThe Mission Owner must configure the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) Cloud Service to use DOD-approved OCSP responder or CRL to validate certificates used for PKI-based authentication.Title, Severity, Check text, Fix text, Discussion
Title
The Mission Owner ofmust configure the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) mustCloud useService validto use DOD-approved OnlineOCSP Certificateresponder Statusor ProtocolCRL (OCSP)to respondersvalidate certificates used for PKI-based authentication.
Severity
mediumhigh
Check text
This applies to all Impact Levels.
If this is a Software as a Service (SaaS) implementation, this is not a finding.
Verify that a valid DOD-approved OCSP responder or CRL is configuredused forto thevalidate implementedcertificates systems/applicationsused for PKI-based authentication.
If the cloud IaaS/PaaS doesis not useconfigured anto approveduse DOD-approved OCSP responder or CRL to validate certificates used for PKI-based authentication, this is a finding.
Fix text
This applies to all Impact Levels.
FedRAMP Moderate, High.
Configure the IaaS/PaaS to use DOD-approved OCSP responder or CRL to validate certificates used for PKI-based authentication.
Configure the system to implement the following access policy:
- Configure CAC/PKI for remote access for privileged users at all Impact Levels. CAC/PKI access is required for nonprivileged users of access to Impact Levels 4–6.
- Impact Level 6: When an approvedon-premises, use NSS PKI. Enforce the use of a physical token referred to as the CNSS NSS Hardware Token for the authentication of DOD Mission Owner and CSP privileged and nonprivileged end users. When implementing NSS PKI, use NSS OCSP responderor CRL resources for checking revocation of NSS certificates and NSS Certificate Authorities and must follow CNSS/NSA instructions for the management and protection of cryptographic keys. CNSS-issued PKI server certificates will be used to identify the CSP’s DOD customer ordering/service management portals and SaaS applications and services contracted by and dedicated to DOD use.
Discussion
To provide assurances that certificates are validated by the correct responders, the Mission Owner must ensure they are using a valid DOD OCSP responder for remote system DOD Common Access Card (CAC) two-factor authentication of DOD privileged users to systems instantiated within the cloud service environment. When a Mission Owner is responsible for authenticating entities and/or identifying a hosted DOD information system, the Mission Owner must configure CAC/PKI for remote access for privileged users at all Impact Levels. CAC/PKI access is required for nonprivileged users of access to Impact Levels 4–6. Impact Level 6: When an on-premises, use NSS PKI. Enforce the use of a physical token referred to as the CNSS NSS Hardware Token for the authentication of DOD Mission Owner and CSP privileged and nonprivileged end users. When implementing NSS PKI, use NSS OCSP or CRL resources for checking revocation of NSS certificates and NSS Certificate Authorities and follow CNSS/NSA instructions for the management and protection of cryptographic keys. CNSS-issued PKI server certificates will be used to identify the CSP's DOD customer ordering/service management portals and SaaS applications and services contracted by and dedicated to DOD use.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.