V1R2 changes
DBN-6300 NDM STIG V1R2 (2024-07-24) replaced V1R1 (2017-09-12): 59 checks added, 58 removed. It has 59 checks, against 58 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 59 added
- 58 removed
- 0 updated
Added in V1R2 (59)
- V-255529CAT IThe DBN-6300 must provide automated support for account management functions.
- V-255530CAT IIThe DBN-6300 must automatically audit account creation.
- V-255531CAT IIThe DBN-6300 must automatically audit account modification.
- V-255532CAT IIThe DBN-6300 must automatically audit account removal actions.
- V-255533CAT IIThe DBN-6300 must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
- V-255534CAT IIIThe DBN-6300 must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
- V-255535CAT IIThe DBN-6300 must provide audit record generation capability for DoD-defined auditable events within the DBN-6300.
- V-255536CAT IIIThe DBN-6300 must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the audit log.
- V-255537CAT IIThe DBN-6300 must generate log records when successful attempts to access privileges occur.
- V-255538CAT IIIThe DBN-6300 must initiate session auditing upon startup.
- V-255539CAT IIIThe DBN-6300 must produce audit log records containing sufficient information to establish what type of event occurred.
- V-255540CAT IIIThe DBN-6300 must produce audit records containing information to establish when (date and time) the events occurred.
- V-255541CAT IIIThe DBN-6300 must produce audit records containing information to establish where the events occurred.
- V-255542CAT IIIThe DBN-6300 must produce audit log records containing information to establish the source of events.
- V-255543CAT IIIThe DBN-6300 must produce audit records that contain information to establish the outcome of the event.
- V-255544CAT IIIThe DBN-6300 must generate audit records containing information that establishes the identity of any individual or process associated with the event.
- V-255545CAT IIIThe DBN-6300 must generate audit records containing the full-text recording of privileged commands.
- V-255546CAT IIThe DBN-6300 must use internal system clocks to generate time stamps for audit records.
- V-255547CAT IIIThe DBN-6300 must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
- V-255548CAT IThe DBN-6300 must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
- V-255549CAT IIThe DBN-6300 must use multifactor authentication for network access (remote and nonlocal) to privileged accounts.
- V-255550CAT IIThe DBN-6300 must use multifactor authentication for local access to privileged accounts.
- V-255551CAT IIThe DBN-6300 must implement replay-resistant authentication mechanisms for network access to privileged accounts.
- V-255552CAT IIThe DBN-6300 must enforce a minimum 15-character password length.
- V-255553CAT IIThe DBN-6300 must prohibit password reuse for a minimum of five generations.
- V-255554CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one upper-case character be used.
- V-255555CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one lower-case character be used.
- V-255556CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one numeric character be used.
- V-255557CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one special character be used.
- V-255558CAT IIThe DBN-6300 must enforce 24 hours/1 day as the minimum password lifetime.
- V-255559CAT IIThe DBN-6300 must enforce a 60-day maximum password lifetime restriction.
- V-255560CAT IThe DBN-6300 must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
- V-255561CAT IIThe DBN-6300 must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
- V-255562CAT IIThe DBN-6300 must activate a system alert message, send an alarm, and/or automatically shut down when a component failure is detected.
- V-255563CAT IIThe DBN-6300 must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
- V-255564CAT IIThe DBN-6300 must automatically audit account enabling actions.
- V-255565CAT IIThe DBN-6300 must be compliant with at least one IETF Internet standard authentication protocol.
- V-255566CAT IIThe DBN-6300 must audit the execution of privileged functions.
- V-255567CAT IIIThe DBN-6300 must provide the capability for organization-identified individuals or roles to change the auditing to be performed based on all selectable event criteria within near real time.
- V-255568CAT IIThe DBN-6300 must compare internal information system clocks at least every 24 hours with an authoritative time server.
- V-255569CAT IIThe DBN-6300 must synchronize its internal system clock to the NTP server when the time difference is greater than one second.
- V-255570CAT IIThe DBN-6300 must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-255571CAT IIThe DBN-6300 must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.
- V-255572CAT IIThe DBN-6300 must audit the enforcement actions used to restrict access associated with changes to the device.
- V-255573CAT IIApplications used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
- V-255574CAT IIApplications used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
- V-255575CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur.
- V-255576CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur.
- V-255577CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful logon attempts occur.
- V-255578CAT IIThe DBN-6300 must generate audit records for privileged activities or other system-level access.
- V-255579CAT IIThe DBN-6300 must generate audit records showing starting and ending time for administrator access to the system.
- V-255580CAT IIThe DBN-6300 must generate audit records when concurrent logons from different workstations occur.
- V-255581CAT IIThe DBN-6300 must generate audit records for all account creation, modification, disabling, and termination events.
- V-255582CAT IIThe DBN-6300 must off-load audit records onto a different system or media than the system being audited.
- V-255583CAT IIThe DBN-6300 must generate audit log events for a locally developed list of auditable events.
- V-255584CAT IIAccounts for device management must be configured on the authentication server and not the network device itself, except for the account of last resort.
- V-255585CAT IIThe DBN-6300 must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-255586CAT IThe DBN-6300 must be configured to send log data to a syslog server for the purpose of forwarding alerts to the administrators and the ISSO.
- V-264431CAT IThe DBN-6300 NDM must be using a version supported by the vendor.
Removed since V1R1 (58)
- V-64975CAT IThe DBN-6300 must provide automated support for account management functions.
- V-64983CAT IIThe DBN-6300 must automatically audit account creation.
- V-64985CAT IIThe DBN-6300 must automatically audit account modification.
- V-64987CAT IIThe DBN-6300 must be compliant with at least one IETF Internet standard authentication protocol.
- V-64989CAT IIThe DBN-6300 must automatically audit account removal actions.
- V-64991CAT IIThe DBN-6300 must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
- V-64993CAT IIIThe DBN-6300 must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
- V-64995CAT IIThe DBN-6300 must generate audit log events for a locally developed list of auditable events.
- V-64997CAT IIThe DBN-6300 must provide audit record generation capability for DoD-defined auditable events within the DBN-6300.
- V-76927CAT IIIThe DBN-6300 must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the audit log.
- V-76929CAT IIThe DBN-6300 must generate log records when successful attempts to access privileges occur.
- V-76931CAT IIIThe DBN-6300 must initiate session auditing upon startup.
- V-76933CAT IIIThe DBN-6300 must produce audit log records containing sufficient information to establish what type of event occurred.
- V-76935CAT IIIThe DBN-6300 must produce audit records containing information to establish when (date and time) the events occurred.
- V-76937CAT IIIThe DBN-6300 must produce audit records containing information to establish where the events occurred.
- V-76939CAT IIIThe DBN-6300 must produce audit log records containing information to establish the source of events.
- V-76941CAT IIIThe DBN-6300 must produce audit records that contain information to establish the outcome of the event.
- V-76943CAT IIIThe DBN-6300 must generate audit records containing information that establishes the identity of any individual or process associated with the event.
- V-76945CAT IIIThe DBN-6300 must generate audit records containing the full-text recording of privileged commands.
- V-76947CAT IIThe DBN-6300 must use internal system clocks to generate time stamps for audit records.
- V-76949CAT IIIThe DBN-6300 must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
- V-76951CAT IThe DBN-6300 must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
- V-76953CAT IIThe DBN-6300 must use multifactor authentication for network access (remote and nonlocal) to privileged accounts.
- V-76955CAT IIThe DBN-6300 must use multifactor authentication for local access to privileged accounts.
- V-76957CAT IIThe DBN-6300 must implement replay-resistant authentication mechanisms for network access to privileged accounts.
- V-76959CAT IIThe DBN-6300 must enforce a minimum 15-character password length.
- V-76961CAT IIThe DBN-6300 must prohibit password reuse for a minimum of five generations.
- V-76963CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one upper-case character be used.
- V-76965CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one lower-case character be used.
- V-76967CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one numeric character be used.
- V-76969CAT IIIf multifactor authentication is not supported and passwords must be used, the DBN-6300 must enforce password complexity by requiring that at least one special character be used.
- V-76971CAT IIThe DBN-6300 must enforce 24 hours/1 day as the minimum password lifetime.
- V-76973CAT IIThe DBN-6300 must enforce a 60-day maximum password lifetime restriction.
- V-76975CAT IThe DBN-6300 must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
- V-76977CAT IIThe DBN-6300 must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
- V-76979CAT IIThe DBN-6300 must activate a system alert message, send an alarm, and/or automatically shut down when a component failure is detected.
- V-76981CAT IIThe DBN-6300 must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
- V-76983CAT IIThe DBN-6300 must automatically audit account enabling actions.
- V-76985CAT IIThe DBN-6300 must audit the execution of privileged functions.
- V-76987CAT IIIThe DBN-6300 must provide the capability for organization-identified individuals or roles to change the auditing to be performed based on all selectable event criteria within near real time.
- V-76989CAT IIThe DBN-6300 must compare internal information system clocks at least every 24 hours with an authoritative time server.
- V-76991CAT IIThe DBN-6300 must synchronize its internal system clock to the NTP server when the time difference is greater than one second.
- V-76993CAT IIThe DBN-6300 must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-76995CAT IIThe DBN-6300 must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.
- V-76997CAT IIThe DBN-6300 must audit the enforcement actions used to restrict access associated with changes to the device.
- V-76999CAT IIApplications used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
- V-77001CAT IIApplications used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
- V-77003CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur.
- V-77005CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur.
- V-77007CAT IIThe DBN-6300 must generate audit records when successful/unsuccessful logon attempts occur.
- V-77009CAT IIThe DBN-6300 must generate audit records for privileged activities or other system-level access.
- V-77011CAT IIThe DBN-6300 must generate audit records showing starting and ending time for administrator access to the system.
- V-77013CAT IIThe DBN-6300 must generate audit records when concurrent logons from different workstations occur.
- V-77015CAT IIThe DBN-6300 must generate audit records for all account creation, modification, disabling, and termination events.
- V-77017CAT IIThe DBN-6300 must off-load audit records onto a different system or media than the system being audited.
- V-77019CAT IThe DBN-6300 must be configured to send log data to a syslog server for the purpose of forwarding alerts to the administrators and the ISSO.
- V-77021CAT IIAccounts for device management must be configured on the authentication server and not the network device itself, except for the account of last resort.
- V-77023CAT IIThe DBN-6300 must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.