Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The system, if capable, must be configured to require the use of a CAC, PIV compliant hardware token or Alternate Logon Token (ALT) for authentication.
Description
Discussion Text
In accordance with CTO 07-015 PKI authentication is required. This provides stronger, two-factor authentication than using a username/password.
NOTE: The following are exempt from this; however, they must meet all password requirements and must be documented with the IAO:
- Stand-alone systems.
- Application Accounts.
- Students or unpaid employees (such as interns) who are not eligible to receive or not in receipt of a CAC, PIV, or ALT.
- Warfighters and support personnel located at operational tactical locations conducting wartime operations that are not "collocated" with RAPIDS workstations to issue CAC; are not eligible for CAC or do not have the capability to use ALT.
- Test systems that have an Interim Approval to Test (IATT) and provide protection via separate VPN, firewall or security measures preventing access to network and system components from outside the protection boundary documented in the IATT.
NOTE: The following are exempt from this; however, they must meet all password requirements and must be documented with the IAO:
- Stand-alone systems.
- Application Accounts.
- Students or unpaid employees (such as interns) who are not eligible to receive or not in receipt of a CAC, PIV, or ALT.
- Warfighters and support personnel located at operational tactical locations conducting wartime operations that are not "collocated" with RAPIDS workstations to issue CAC; are not eligible for CAC or do not have the capability to use ALT.
- Test systems that have an Interim Approval to Test (IATT) and provide protection via separate VPN, firewall or security measures preventing access to network and system components from outside the protection boundary documented in the IATT.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.