V2R6 changes
Forescout Network Access Control STIG V2R6 (2026-09-30) replaced V2R5 (2026-07-01): 25 checks updated. It has 25 checks, against 25 in V2R5.
V2R6 checklistV2R5 checklist Compare V2R5 and V2R6 in STIG Compare
- 0 added
- 0 removed
- 25 updated
Updated fields: Check text 25Fix text 5Discussion 5Title 1
Updated in V2R6 (25)
V-233309CAT IForescout must enforce approved access by employing admissions assessment filters that include, at a minimum, device attributes such as type, IP address, resource group, and/or mission conditions as defined in Forescout System Security Plan (SSP). This is required for compliance with C2C Step 4.Check text
Check text
If DoDDoW is not at C2C Step 4 or higher, this is not a finding.
Use the Forescout Administrator UI to ensure that the endpoint compliance assessment policies have been implemented per the SSP and are functioning correctly.
If Forescout does not have compliance assessment policies configured this is a finding.
V-233310CAT IEndpoint policy assessment must proceed after the endpoint attempting access has been identified using an approved identification method such as IP address. This is required for compliance with C2C Step 2.Check text, Discussion
Check text
If DoDDoW is not at C2C Step 2 or higher, this is not a finding.
Use the Forescout Administrator UI to ensure that the endpoint compliance assessment policies have been implemented per the SSP and are functioning correctly.
1. Log on to the Forescout Administrator UI.
2. From the Home screen select the "Policy" tab.
3. Verify that policies exist that assess compliance in accordance with the SSP.
If Forescout does not have compliance assessment policies configured this is a finding.
Discussion
Automated policy assessments must reflect the organization's current security policy so entry control decisions will happen only where remote endpoints meet the organization's security requirements. If the remote endpoints are allowed to connect to the organization's network without passing minimum-security controls, they become a threat to the entire network.
Organizational policy must be established for what Forescout will check on the host for the agent and agentless. The Forescout system security plan (SSP) will be used to assess compliance with the requirement since each SSP item must be configured.
Examples include, but are not limited to:
- Verification that anti-virus software is authorized, running, and virus signatures are up to date.
- Host-based firewall installed and configured according to the organization's security policy.
- Host IDS/IPS is installed, operational, and up to date.
- Uses the result of malware, anti-virus, and IDS scans and status as part of the assessment decision process.
- Required BIOS, operating system, browser, and office application patch levels.
- Performs an assessment of the list of running services.
- Test for the presence of DoDDoW-required software.
- Test for presence of peer-to-peer software (not allowed).
V-233311CAT IFor endpoints that require automated remediation, Forescout must be configured to logically separate endpoints from the trusted network traffic during remediation. This is required for compliance with C2C Step 4.Check text
Check text
If DODDoW is not at C2C Step 4 or higher, this is not a finding.
If a separate remediation network is configured and isolated from the trusted network, this is not a finding.
Use the Forescout Administrator UI to verify that Forescout is configured to either redirect endpoints requiring automated remediation to a network segment that is isolated from trusted traffic or, if assessment is done on the Forescout, the endpoint traffic is logically separate during remediation.
If Forescout does not isolate endpoints during remediation, this is a finding.
V-233312CAT IIf a device requesting access fails Forescout policy assessment, Forescout must communicate with other components and the switch to either terminate the session or isolate the device from the trusted network for remediation. This is required for compliance with C2C Step 3.Check text
Check text
If DODDoW is not at C2C Step 3 or higher, this is not a finding.
Use the Forescout Administrator UI to verify that policies are configured to filter the policy assessment devices based on risk and are remediated or isolated according to the SSP.
1. In the Forescout UI, go to the Policy Tab >> Compliance or Control Policies.
2. Verify the action within Compliance Policies is configured with one of the following actions:
- Terminate the connection and place the device on a denylist to prevent future connection attempts until action is taken to remove the device from the denylist.
- Redirect traffic from the remote endpoint to the automated remediation subnet for connection to the remediation server or segment the endpoint to a remediation VLAN. Use of ACLs or a VLAN solution is acceptable.
- Allow the device access to limited network services such as public web servers in the protected DMZ (must be approved by the authorizing official [AO]).
- Allow the device and user full entry into the protected networks, but flag it for future remediation. With this option, an automated reminder should be used to inform the user of the remediation status.
If Forescout does not communicate with the remote access gateway to implement a policy to either terminate the session or isolate the device from the trusted network this is a finding.
V-233313CAT IIForescout must be configured to notify the user before proceeding with remediation of the user's endpoint device when automated remediation is used. This is required for compliance with C2C Step 3.Check text, Fix text
Check text
If DODDoW is not at C2C Step 3 or higher, this is not a finding.
Check Forescout policy to ensureverify that exempt devices that are in need of remediation prompt the user to accept the remediation process, prior to conducting.
1. Log on to the Forescout UI.
2. Select the "Policy" tab.
3. Review the compliance policy identified by the site representation as the remediation policy, then click "Edit".
4. In the Sub-Rules section, select a policy and click "Edit".
5. From the Actions section, verify that the policy is configured to notify the user, prior to remediation, that user interaction is required.
If Forescout is not configured to notify the user before proceeding with remediation of the user's endpoint device when automated remediation is used, this is a finding.
Fix text
Log on to the Forescout UI. 1. Select the "Policy" tab. 2. Select a compliance policy, then click "Edit". 3. In the Sub-Rules section, select a policy and click "Edit". 4. From the Actions section, click Add >> Notify >> and select a notification method.
V-233314CAT IForescout must be configured so that all client machines are assessed by Forescout with exceptions that are allowed to bypass Forescout based on account or account type, as approved by the information system security manager (ISSM) and documented in the System Security Plan (SSP). This is required for compliance with C2C Step 1.Check text
Check text
If DODDoW is not at C2C Step 1 or higher, this is not a finding.
If traffic is not allowed to bypass the NAC policy, this is not a finding.
Use the Forescout Administrator UI to verify a policy exists that uses the exemption group configured so that all client machines are assessed by Forescout with exceptions that are allowed to bypass Forescout based on the account or account type, as approved by the ISSM and documented in the SSP.
1. In the filters pane under Groups, right-click the group editor. Pick the group indicated as compliance by the site representative.
2. Click "Scope" and review the Exemptions Group.
If Forescout is not configured to approve all instances where traffic is allowed to bypass the NAC as approved by the ISSM, this is a finding.
V-233317CAT IIWhen devices fail the policy assessment, Forescout must create a record with sufficient detail suitable for forwarding to a remediation server for automated remediation or sending to the user for manual remediation. This is required for compliance with C2C Step 3.Check text
Check text
If DoDDoW is not at C2C Step 3 or higher, this is not a finding.
Verify Forescout sends user and/or admin notification of remediation requirements, whether manual or automated. Examples of notifications can include events or incidents sent to automated ticketing systems, emails, or logs to SIEM systems.
If the NAC does not flag devices for future manual or automated remediation, when those devices failingfail policy assessment thatand are not automatically remediated either before or during the remote access session, this is a finding.
V-233318CAT IForescout must place client machines on a blacklist or terminate network communications on devices when critical security issues are found that put the network at risk. This is required for compliance with C2C Step 4.Check text
Check text
If DoDDoW is not at C2C Step 4 or higher, this is not a finding.
Check Forescout policy to ensure that any device with a critical security issue is checked through a security policy and an action is taken to either blacklist it or terminate communication with other network devices.
If the NAC does not immediately place the device on the blacklist and terminate the connection when critical security issues are found that put the network at immediate risk, this a finding.
V-233319CAT IIForescout must be configured so client machines do not communicate with other network devices in the DMZ or subnet except as needed to perform an access client assessment or to identify themselves. This is required for compliance with C2C Step 2.Check text, Fix text, Discussion
Check text
If DODDoW is not at C2C Step 2 or higher, this is not a finding.
Verify ForeScoutForescout is configured so endpoints under assessment are isolated from peer communication.
1. Navigate to the Policy tab and examine the Compliance Assessment policy.
2. Verify either a Quarantine VLAN, ACL Enforcement Method, or Forescout Virtual Firewall is configured as part of the policy.
If Forescout allows endpoints under assessment to communicate with other endpoints in the DMZ, or on other network segments outside of those assisting in the network access control decisions, this is a finding.
Fix text
Configure ForeScoutForescout so devices being assessed for compliance do not communicate with other devices in the DMZ or other network segments. There are different approaches; however, this typically involves isolating noncompliant devices into a quarantine or assessment zone until they meet compliance requirements.
The followingFor are examples.example:
Create a Quarantine VLAN:
1. Set up a dedicated VLAN (e.g., "Quarantine_VLAN") for devices under assessment.
2. This VLAN should have restricted access, blocking communication to other devices or production network segments.
3. Allow traffic only to specific remediation servers (e.g., patch servers, ForeScoutForescout appliance for assessment).
4. Configure the switches to support dynamic VLAN assignment via CounterACT.
5. Enforce Network Isolation using a VLAN:
- Select the "Quarantine_VLAN".
- CounterACT will instruct the switch (via SNMP or CLI) to move the device to this VLAN upon detection.
Or
ACL Enforcement Method:
1. If VLANs are not feasible, use the **Apply ACL** action.
2. Configure an ACL on the switches or routers to block all traffic from the device’'s IP or MAC to other network devices, allowing only traffic to remediation servers (e.g., IP of patch server, DNS, or CounterACT appliance).
- Example ACL (syntax depends on the switch/router):
```
deny ip <device_IP> 0.0.0.0 <network_range> <network_mask>
permit ip <device_IP> 0.0.0.0 <remediation_server_IP> 0.0.0.0
permit ip <device_IP> 0.0.0.0 <forescout_IP> 0.0.0.0
deny ip any any
```
Or
Virtual Firewall Method:
1. Use CounterACT’'s Virtual Firewall action to block all traffic from the device except to specific IPs/ports (e.g., remediation servers, CounterACT).
2. Configure rules in the action settings to allow only necessary outbound traffic.
Discussion
Devices not compliant with DODDoW secure configuration policies are vulnerable to attack. While endpoints are undergoing NAC authorization assessment, they must communicate only with the NAC or identified systems that evaluate, remediate, or otherwise assist in evaluating endpoint compliance with policy. These devices should not communicate with other hosts in the DMZ or other network segments.
V-233320CAT IIForescout must enforce the revocation of endpoint access authorizations when devices are removed from an authorization group. This is required for compliance with C2C Step 4.Check text
Check text
If DODDoW is not at C2C Step 4 or higher, this is not a finding.
Verify Forescout admission policy has been configured to revoke access to endpoints that have not met or are removed from the authorized group.
If Forescout is not configured with an admissions policy that enforces the revocation of endpoint access authorizations based on when devices are removed from an authorization group, this is a finding.
V-233321CAT IIForescout must enforce the revocation of endpoint access authorizations at the next compliance assessment interval based on changes to the compliance assessment security policy. This is required for compliance with C2C Step 4.Check text, Fix text
Check text
If DODDoW is not at C2C Step 4 or higher, this is not a finding.
Verify Forescout admission policy has been configured to revoke access, toremediate, or quarantine endpoints that have not met, or arefall removedout fromof, the authorized groupcompliance.
If Forescout is not configured with an admissionsadmission policy that enforces the revocation, quarantine, or remediation of endpoint access authorizations based on when devices arefall removedout fromof an authorization groupcompliance, this is a finding.
Fix text
Use the Forescout Administrator UI to configure the authorization policy to configured to perform a control action on any devices that have not met the authorization requirement or are no longer authorized.
1. Log on to the Forescout UI.
2. From the Policy tab, check that the authorization policy has a Block Action enabled on any devices that have not met or are removed from the authorized group.
V-233322CAT IIForescout must deny or restrict access for endpoints that fail critical endpoint security checks. This is required for compliance with C2C Step 4.Check text, Discussion
Check text
If DODDoW is not at C2C Step 4 or higher, this is not a finding.
Verify Forescout has been configured to redirect filterednon-compliant devices to a limited access network to include a remediation network or apply an ACL limited access network.
If a policy does not exist that redirects the failed device to an authorized network for remediation or limited access, thisor is not a finding.
If the NAC does not deny or restrict access for endpoints that fail critical endpoint security checks, this is not a finding.
Discussion
Devices that do not meet minimum-security configuration requirements pose a risk to the DODDoW network and information assets.
Endpoint devices must be disconnected or given limited access as designated by the approval authority and system owner if the device fails the authentication or security assessment. The user will be presented with a limited portal, which does not include access options for sensitive resources. Required security checks must implement DODDoW policy requirements.
V-233324CAT IIForescout must off-load log records onto a different system. This is required for compliance with C2C Step 1.Check text
Check text
If DODDoW is not at C2C Step 1 or higher, this is not a finding.
1. Go to Tools >> Options >> Syslog.
2. Verify a syslog server's IP address is configured.
Or
1. Go to Tools >> Options.
2. Navigate to the extended module (e.g., Splunk) that offloads log records to a separate device.
3. Verify the connection is successful.
If each Forescout device does not offload log records to a separate device, this is a finding.
V-233325CAT IIForescout must generate a critical alert to be sent to the Information System Security Officer (ISSO) and Systems Administrator (SA) (at a minimum) in the event of an audit processing failure. This is required for compliance with C2C Step 1.Check text
Check text
If DODDoW is not at C2C Step 1 or higher, this is not a finding.
Verify Forescout sends an alert to the proper security personnel when an audit process failure occurs.
1. Log on to the Forescout UI.
2. Locate the audit process policies as identified by the site representative.
3. Verify a policy for "audit failure" exists.
4. Verify this policy includes notification of security personnel as follows.
a. Navigate to Options >> General >> Mail and DNS.
b. Verify the configuration of the appropriate Operator Email and mail relay information to ensure alerts and notifications are being sent to the appropriate people.
c. Verify that any policies that need notification actions have one of the following actions configured:
- Send Email.
- Send Email to User.
- Send Balloon Notification.
- HTTP Notification.
- Splunk: Send Update from CounterACT.
If Forescout does not send an alert when an audit processing failure occurs, this is a finding.
V-233326CAT IIForescout must authenticate all endpoint devices before establishing a connection and proceeding with posture assessment. This is required for compliance with C2C Step 4.Check text
Check text
If DoDDoW is not at C2C Step 4 or higher, this is not a finding.
Use the Forescout Administrator UI to verify all IP addresses identified in the SSP are configured within the Appliance IP Assignments list.
1. Log on to the Forescout UI.
2. Select Tools >> Option >> Appliance >> IP Assignment.
3. Verify all IP addresses associated with the SSP are labeled within the IP Assignments list.
If Forescout does not authenticate all endpoints prior to establishing a connection and proceeding with posture assessment, this is a finding.
V-233327CAT IIForescout must be configured to apply dynamic ACLs that restrict the use of ports when nonentity endpoints are connected using MAC Authentication Bypass (MAB). This is required for compliance with C2C Step 4.Title, Check text, Fix text, Discussion
Title
Forescout must be configured to apply dynamic ACLs that restrict the use of ports when non-entitynonentity endpoints are connected using MAC Authentication Bypass (MAB). This is required for compliance with C2C Step 4.
Check text
If DODDoW is not at C2C Step 4 or higher, this is not a finding.
Verify Forescout applies dynamic ACLs (or VLAN restrictions) that restrict the use of ports when nonentity endpoints are connected using MAC Address Repository (MAR).
If the NAC or switch does not apply dynamic ACLs (or VLAN restrictions) that restrict the use of ports when nonentity endpoints are connected using MAR, this is a finding.
Fix text
Use the Forescout Administrator UI to configure the policy, which identifies nonentity endpoints to complete a control action when a device is added to the MAR. 1. Log on to Forescout UI. 2. In the Policy tab, locate the Authentication and Authorization policy set. 3. Select a policy that identifies nonentity endpoints. Highlight the policy, then select "Edit". 4. From the Sub-Rules section, ensure that when a device is added to the MAR, the policy also applies one of the following actions: -Access Port ACL. -Endpoint Address ACL. -WLAN Role. -VLAN Change. Note: The switch may be configured, for example, to have a voice-vlan designated by the local network to assign VoIP devices to specific vlans on the switch. In this case, the Policy, MAR, or RADIUS pre-authentication entry requires an AVPair setting (e.g., CISCO-AVPair, or other "AVPair" setting) when combined with the switch setting for the voice-vlan or equivalent to enforce VLAN designation. Expected Site Evidence: - Forescout policy and/or MAC Address Bypass configuration demonstrating assignment of VLAN or switch designating VLAN in the event of a VoIP device. - UI screenshots showing enforcement. - SSP mapping and approval. - Logs or alerts demonstrating enforcement.
Discussion
MAB is only one way of connecting non-entitynonentity endpoints, and can be defeated by spoofing the MAC address of an assumed authorized device. By adding the device to the MAR, the device can then gain access to the network.
NPE devices that can support PKI or an allowed authentication type must use PKI. MAB may be used for NPE that cannot support an approved device authentication. Non-entityNonentity endpoints include Internet of Things (IoT) devices, VoIP phone, and printer.
V-233328CAT IIForescout must reveal error messages only to the Information System Security Officer (ISSO), Information System Security Manager (ISSM), and System Administrator (SA). This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Use the Forescout Administrator UI to verify only individuals authorized by the SSP are configured to receive error messages.
1. Log on to the Forescout UI.
2. Within the highlighted policy, under the Actions section, select a configured action to view.
3. Find the Notify section and verify that only authorized individuals (IAW the SSP) are configured for the following:
- HTTP Notification
- Send Email
- Send Notification
If Forescout error messages can be viewed by unauthorized users other than the security personnel that have a need to know, this is a finding.
V-233329CAT IIForescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost. This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
1. Go to Tools >> Options >> Syslog.
2. Verify the Server Protocol is set to TCP.
3. Verify "Use TLS" setting is set.
4. Verify the "Identity, Facility, and Severity" setting is configured.
If Forescout does not use TCP for the syslog protocol, this is a finding.
V-233331CAT IIFor TLS connections, Forescout must automatically terminate the session when a client certificate is requested and the client does not have a suitable certificate. This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Verify Forescout is configured to a list of DoDDoW-approved certificate types and CAs.
Verify the TLS session is configured to automatically terminate any session if the client does not have a suitable certificate.
For TLS connections, if Forescout is not configured to automatically terminate the session when the client does not have a suitable certificate, this is a finding.
V-233332CAT IIForescout must use TLS 1.2, at a minimum, to protect the confidentiality of information passed between the endpoint agent and Forescout for the purposes of client posture assessment. This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Verify Forescout is configured to a list of DoDDoW-approved certificate types and CAs.
Verify the TLS session is configured to automatically terminate any session if the client does not have a suitable certificate.
For TLS connections, if Forescout is not configured to use TLS 1.2 at a minimum, this is a finding.
V-233334CAT IICommunications between Forescout endpoint agent and the switch must transmit access authorization information via a protected path using a cryptographic mechanism. This is required for compliance with C2C Step 1.Check text
Check text
If DODDoW is not at C2C Step 1 or higher, this is not a finding.
Verify both ends are configured for secure communications between the NAC and NAC agent.
If communication between the NAC and NAC agent does not use an encrypted method for protecting posture information transmitted between the devices, this is a finding.
V-233337CAT IIForescout must perform continuous detection and tracking of endpoint devices attached to the network. This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Verify the NAC performs continuous detection and tracking of endpoint devices attached to the network.
1. Log on to the Forescout UI.
2. Go to Tools >> Options >> Appliance >> IP Assignment.
3. Check that all IP addresses that should be managed are within the IP Assignments as required by the SSP.
If the NAC does not perform continuous detection and tracking of endpoint devices attached to the network, this is a finding.
V-233338CAT IIForescout must deny network connection for endpoints that cannot be authenticated using an approved method. This is required for compliance with C2C Step 4.Check text
Check text
If DoDDoW is not at C2C Step 4 or higher, this is not a finding.
Use the Forescout Administrator UI to verify that a policy exists to deny network connections for endpoints that cannot be authenticated using an approved method and that the authentication failure is logged.
1. Log on to Forescout UI.
2. From the Policy tab, select the Authentication and Authorization policy.
3. Find the 802.1x Authorization policy.
If NAC does not have an authorization policy that denies network connection for endpoints that cannot be authenticated using an approved method and log authentication failures, this is a finding.
V-233339CAT IIForescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.Check text, Fix text, Discussion
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Use the Forescout CLI credentials to verify FIPS mode is set by running the "fstool version" command and look for the "FIPS enabled" setting.
Log on using the CLIAdmin credentials established upon initial configuration.
Verify FIPS mode by typing the command "fstool version".
If Forescout does not use AES, this is a finding.
Fix text
To enable FIPS mode, log in to the CLI account a use the "fstool fips" command.
Note that use of FIPS mode is not mandatory in DoDDoW. However, it is the primary method for mitigation of this requirement and ensuring FIPS compliance.
Log on using the CLIAdmin credentials established upon initial configuration.
To enable FIPS mode, type "fstool fips". A prompt alerting the user that FIPS 140-2 will be enabled will be displayed. Type "Yes" for FIPS to accept this prompt.
Note: Use of FIPS mode is not mandatory in DoDDoW. However, it is the primary method for mitigation of this requirement and ensuring FIPS compliance.
Discussion
Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DoDDoW requires the use of AES for bidirectional authentication since it is the only FIPS-validated AES cipher block algorithm.
Because of the challenges of applying this requirement on a large scale, organizations are encouraged to apply the requirement only to those limited number (and type) of devices that truly need to support this capability.
V-233340CAT IWhen connecting with endpoints, Forescout must be configured to use FIPS 140-2/3 validated algorithms for encryption processes and communications. This is required for compliance with C2C Step 1.Check text
Check text
If DoDDoW is not at C2C Step 1 or higher, this is not a finding.
Use the Forescout CLI credentials to verify FIPS mode is set by running the "fstool version" command and look for the "FIPS enabled" setting. Use the Forescout Administrator UI to verify SecureConnector is set to use TLS version 1.2 or higher for Client-Server Connections.
1. Log on using the CLIAdmin credentials established upon initial configuration.
2. Verify FIPS mode by typing the command "fstool version".
To configure TLS:
1. Log on to the Forescout UI.
2. Select Tools >> Option >> HPS Inspection Engine >> SecureConnector.
3. In the Client-Server Connection, check the Minimum Supported TLS Version is set to TLS version 1.2.
If the NAC is not configured to use FIPS 140-2/3 validated algorithms when connecting with endpoints, this is a finding.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R6 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.