Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must configure scanning using an Assured Compliance Assessment Solution (ACAS) server or solution that meets DOD scanning and reporting requirements.
Description
Discussion Text
Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.
Implement scanning using an ACAS server in accordance with USCYBERCOM TASKORD 13-670.
- Use an ACAS Security Center server within NIPRNet or within an associated common virtual services environment in the same cloud service offering (CSO).
- Implement a secure (encrypted) connection or path between the ACAS server and its assigned ACAS Security Center.
Impact Level 2: Applies to IaaS/PaaS CSOs where the Mission Owner has control over the environment. In this case, Mission Owners must provide their own enclave boundary protections or leverage an enterprise-level application protection service instantiated within the same CSO.
Implement scanning using an ACAS server in accordance with USCYBERCOM TASKORD 13-670.
- Use an ACAS Security Center server within NIPRNet or within an associated common virtual services environment in the same cloud service offering (CSO).
- Implement a secure (encrypted) connection or path between the ACAS server and its assigned ACAS Security Center.
Impact Level 2: Applies to IaaS/PaaS CSOs where the Mission Owner has control over the environment. In this case, Mission Owners must provide their own enclave boundary protections or leverage an enterprise-level application protection service instantiated within the same CSO.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.