V1R2 changes
ForeScout CounterACT NDM STIG V1R2 (2024-07-24) replaced V1R1 (2017-09-12): 39 checks added, 38 removed. It has 39 checks, against 38 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 39 added
- 38 removed
- 0 updated
Added in V1R2 (39)
- V-255624CAT IICounterACT must terminate all network connections associated with an Enterprise Manager Console session upon Exit, or session disconnection, or after 10 minutes of inactivity, except where prevented by documented and validated mission requirements.
- V-255625CAT IICounterACT must terminate all network connections associated with an SSH connection session upon Exit, session disconnection, or after 10 minutes of inactivity, except where prevented by documented and validated mission requirements.
- V-255626CAT IICounterACT must allow only authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media.
- V-255627CAT IICounterACT must restrict the ability to change the auditing to be performed within the system log based on selectable event criteria to the audit administrators role or to other roles or individuals.
- V-255628CAT IICounterACT must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-255629CAT IICounterACT must enable Threat Protection notifications to alert security personnel to Cyber events detected by a CounterACT IAW CJCSM 6510.01B.
- V-255630CAT IIICounterACT must generate audit log events for a locally developed list of auditable events.
- V-255631CAT IICounterACT must enforce access restrictions associated with changes to the system components.
- V-255632CAT IIAdministrative accounts for device management must be configured on the authentication server and not the network device itself (except for the account of last resort).
- V-255633CAT IICounterACT must support organizational requirements to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.
- V-255634CAT IIICounterACT must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
- V-255635CAT IICounterACT must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-255636CAT IICounterACT must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-255637CAT IIFor the local account, CounterACT must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
- V-255638CAT IIICounterACT must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
- V-255639CAT IIICounterACT must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-255640CAT IIIf any logs are stored locally which are not sent to the centralized audit server, CounterACT must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
- V-255641CAT IICounterACT must limit privileges to change the software resident within software libraries.
- V-255642CAT ICounterACT must disable all unnecessary and/or nonsecure plugins.
- V-255643CAT IIIn the event the authentication server is unavailable, one local account must be created for use as the account of last resort.
- V-255644CAT IICounterACT must enforce a minimum 15-character password length.
- V-255645CAT IICounterACT must prohibit password reuse for a minimum of five generations.
- V-255646CAT IICounterACT must enforce password complexity by requiring that at least one numeric character be used.
- V-255647CAT IICounterACT must enforce password complexity by requiring that at least one special character be used.
- V-255648CAT IICounterACT must enforce a 60-day maximum password lifetime restriction.
- V-255649CAT IICounterACT must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
- V-255650CAT IICounterACT must compare internal information systems clocks at least every 24 hours with an authoritative time server.
- V-255651CAT IICounterACT must be configured to synchronize internal information system clocks with the organizations primary and secondary NTP servers.
- V-255652CAT IICounterACT must authenticate any endpoint used for network management before establishing a local, remote, and/or network connection using cryptographically based bidirectional authentication.
- V-255653CAT ICounterACT must authenticate SNMPv3 endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
- V-255654CAT ICounterACT appliances performing maintenance functions must restrict use of these functions to authorized personal only.
- V-255655CAT IICounterACT must sent audit logs to a centralized audit server (i.e., syslog server).
- V-255656CAT IICounterACT must employ automated mechanisms to centrally apply authentication settings.
- V-255657CAT IIICounterACT must limit the number of concurrent sessions to an organization-defined number for each administrator account type.
- V-255658CAT IIIThe network device must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management.
- V-255659CAT IIIf multifactor authentication is not supported and passwords must be used, CounterACT must enforce password complexity by requiring that at least one upper-case character be used.
- V-255660CAT IIIf multifactor authentication is not supported and passwords must be used, CounterACT must enforce password complexity by requiring that at least one lower-case character be used.
- V-255661CAT IIThe network device must terminate shared/group account credentials when members leave the group.
- V-265636CAT IThe version of ForeScout CounterAct must be a supported version.
Removed since V1R1 (38)
- V-76193CAT IIFor the local account, CounterACT must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
- V-76195CAT IIICounterACT must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
- V-76197CAT IICounterACT must enforce password complexity by requiring that at least one numeric character be used.
- V-76199CAT IICounterACT must enforce a 60-day maximum password lifetime restriction.
- V-76201CAT IICounterACT must prohibit password reuse for a minimum of five generations.
- V-76203CAT IICounterACT must enforce a minimum 15-character password length.
- V-76205CAT IICounterACT must enforce access restrictions associated with changes to the system components.
- V-76207CAT IIICounterACT must generate audit log events for a locally developed list of auditable events.
- V-76209CAT IICounterACT must support organizational requirements to conduct backups of system-level information contained in the information system when changes occur or weekly, whichever is sooner.
- V-76211CAT IIICounterACT must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
- V-76213CAT IICounterACT must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-76215CAT IICounterACT must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-76217CAT IICounterACT must enable Threat Protection notifications to alert security personnel to Cyber events detected by a CounterACT IAW CJCSM 6510.01B.
- V-76219CAT ICounterACT appliances performing maintenance functions must restrict use of these functions to authorized personal only.
- V-76221CAT IICounterACT must employ automated mechanisms to centrally apply authentication settings.
- V-76223CAT ICounterACT must disable all unnecessary and/or nonsecure plugins.
- V-76225CAT IICounterACT must terminate all network connections associated with an Enterprise Manager Console session upon Exit, or session disconnection, or after 10 minutes of inactivity, except where prevented by documented and validated mission requirements.
- V-76227CAT IICounterACT must terminate all network connections associated with an SSH connection session upon Exit, session disconnection, or after 10 minutes of inactivity, except where prevented by documented and validated mission requirements.
- V-76229CAT IICounterACT must allow only authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media.
- V-76231CAT IIIf any logs are stored locally which are not sent to the centralized audit server, CounterACT must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
- V-76233CAT IICounterACT must limit privileges to change the software resident within software libraries.
- V-76235CAT IICounterACT must enforce password complexity by requiring that at least one special character be used.
- V-76237CAT IICounterACT must sent audit logs to a centralized audit server (i.e., syslog server).
- V-76239CAT IICounterACT must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-76241CAT IICounterACT must be configured to synchronize internal information system clocks with the organizations primary and secondary NTP servers.
- V-76243CAT IICounterACT must restrict the ability to change the auditing to be performed within the system log based on selectable event criteria to the audit administrators role or to other roles or individuals.
- V-76245CAT IICounterACT must authenticate any endpoint used for network management before establishing a local, remote, and/or network connection using cryptographically based bidirectional authentication.
- V-76247CAT ICounterACT must authenticate SNMPv3 endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
- V-76249CAT IIIn the event the authentication server is unavailable, one local account must be created for use as the account of last resort.
- V-76251CAT IICounterACT must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.
- V-76253CAT IIThe network device must terminate shared/group account credentials when members leave the group.
- V-76255CAT IIIThe network device must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management.
- V-76257CAT IIICounterACT must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-76259CAT IICounterACT must compare internal information systems clocks at least every 24 hours with an authoritative time server.
- V-76261CAT IIAdministrative accounts for device management must be configured on the authentication server and not the network device itself (except for the account of last resort).
- V-76263CAT IIIf multifactor authentication is not supported and passwords must be used, CounterACT must enforce password complexity by requiring that at least one upper-case character be used.
- V-76265CAT IIIf multifactor authentication is not supported and passwords must be used, CounterACT must enforce password complexity by requiring that at least one lower-case character be used.
- V-76267CAT IIICounterACT must limit the number of concurrent sessions to an organization-defined number for each administrator account type.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.