V1R3 changes
ForeScout CounterACT ALG STIG V1R3 (2024-07-24) replaced V1R2 (2018-01-26): 13 checks added, 12 removed. It has 13 checks, against 12 in V1R2.
V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare
- 13 added
- 12 removed
- 0 updated
Added in V1R3 (13)
- V-237572CAT IICounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
- V-237573CAT IIICounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
- V-237574CAT IICounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
- V-237575CAT IICounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
- V-237576CAT IIIf user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
- V-237577CAT IIIf user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
- V-237578CAT IICounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
- V-237579CAT IICounterACT must off-load audit records onto a centralized log server.
- V-237580CAT IICounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
- V-237581CAT IICounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
- V-237582CAT IICounterACT must off-load audit records onto a centralized log server in real time.
- V-237583CAT IICounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
- V-265638CAT IThe version of ForeScout CounterAct must be a supported version.
Removed since V1R2 (12)
- V-75913CAT IICounterACT, when providing user access control intermediary services, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the network.
- V-75931CAT IIICounterACT, when providing user access control intermediary services, must retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
- V-75933CAT IICounterACT, when providing user access control intermediary services for publicly accessible applications, must display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.
- V-75935CAT IICounterACT must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.
- V-75937CAT IIIf user authentication services are provided, CounterACT must be configured with a pre-established trust relationship and mechanisms with a central directory service that validates user account access authorizations and privileges.
- V-75939CAT IIIf user authentication services are provided, CounterACT must restrict user authentication traffic to specific authentication server(s).
- V-75941CAT IICounterACT, when providing user authentication intermediary services, must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.
- V-75943CAT IICounterACT must off-load audit records onto a centralized log server.
- V-76185CAT IICounterACT, when providing user authentication intermediary services, must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
- V-76187CAT IICounterACT, when providing user authentication intermediary services, must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
- V-76189CAT IICounterACT must off-load audit records onto a centralized log server in real time.
- V-76191CAT IICounterACT must use an Enterprise Manager or other high availability solution to ensure redundancy in case of audit failure in this critical network access control and security service.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.