What changed in IBM MQ Appliance v9.0 NDM STIG V1R2V1R2 changes

IBM MQ Appliance v9.0 NDM STIG V1R2 (2024-07-24) replaced V1R1 (2017-06-05): 50 checks added, 49 removed. It has 50 checks, against 49 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 50 added
  • 49 removed
  • 0 updated

Added in V1R2 (50)

  • V-255726CAT IIAccess to the MQ Appliance network device must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type.
  • V-255727CAT IIAccess to the MQ Appliance network element must use two or more authentication servers for the purpose of granting administrative access.
  • V-255728CAT IIThe MQ Appliance network device access must automatically disable accounts after a 35-day period of account inactivity.
  • V-255729CAT IIThe MQ Appliance network device must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
  • V-255730CAT IIThe MQ Appliance network device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
  • V-255731CAT IIThe MQ Appliance network device must notify the administrator of changes to access and/or privilege parameters of the administrator account that occurred since the last logon.
  • V-255732CAT IIThe MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
  • V-255733CAT IIThe MQ Appliance network device must alert the Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) in the event of an audit processing failure.
  • V-255734CAT IIThe MQ Appliance network device must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-255735CAT IIThe MQ Appliance network device must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
  • V-255736CAT IIIn the event the authentication server is unavailable, the MQ Appliance must provide one local account created for emergency administration use.
  • V-255737CAT IIThe MQ Appliance network device must use multifactor authentication for network access to privileged accounts.
  • V-255738CAT IIWhen connecting to the MQ Appliance network device using the WebGUI, it must implement replay-resistant authentication mechanisms for network access to privileged accounts.
  • V-255739CAT IIThe MQ Appliance network device must enforce a minimum 15-character password length.
  • V-255740CAT IIThe MQ Appliance network device must prohibit password reuse for a minimum of five generations.
  • V-255741CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one upper-case character be used.
  • V-255742CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one lower-case character be used.
  • V-255743CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one numeric character be used.
  • V-255744CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one special character be used.
  • V-255745CAT IIAuthorization for access to the MQ Appliance network device must enforce a 60-day maximum password lifetime restriction.
  • V-255746CAT IIWebGUI access to the MQ Appliance network device, when using PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
  • V-255747CAT IIWebGUI access to the MQ Appliance network device must map the authenticated identity to the user account for PKI-based authentication.
  • V-255748CAT IIThe MQ Appliance network device must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
  • V-255749CAT IIThe WebGUI of the MQ Appliance network device must terminate all sessions and network connections when nonlocal device maintenance is completed.
  • V-255750CAT IIThe WebGUI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-255751CAT IIThe SSH CLI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-255752CAT IIThe MQ Appliance network device must generate unique session identifiers using a FIPS 140-2 approved random number generator.
  • V-255753CAT IIThe MQ Appliance network device must activate a system alert message, send an alarm, and/or automatically shut down when a component failure is detected.
  • V-255754CAT IIThe MQ Appliance network device must generate account activity alerts that are forwarded to the administrators and Information System Security Officer (ISSO). Activity includes, creation, removal, modification and re-enablement after being previously disabled.
  • V-255755CAT IIThe MQ Appliance network device must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
  • V-255756CAT IIThe MQ Appliance network device must terminate shared/group account credentials when members leave the group.
  • V-255757CAT IIThe MQ Appliance network device must notify the administrator, upon successful logon (access), of the location of last logon (terminal or IP address) in addition to the result, date and time of the last logon (access).
  • V-255758CAT IIThe MQ Appliance network device must generate an immediate alert when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.
  • V-255759CAT IIThe MQ Appliance network device must compare internal information system clocks at least every 24 hours with an authoritative time server.
  • V-255760CAT IIThe MQ Appliance network device must synchronize internal information system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.
  • V-255761CAT IIThe MQ Appliance network device must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.
  • V-255762CAT IIWebGUI access to the MQ Appliance network device must accept Personal Identity Verification (PIV) credentials.
  • V-255763CAT IIWebGUI access to the MQ Appliance network device must electronically verify Personal Identity Verification (PIV) credentials.
  • V-255764CAT IIThe MQ Appliance network device must prohibit the use of cached authenticators after an organization-defined time period.
  • V-255765CAT IIApplications used for nonlocal maintenance sessions using the MQ Appliance WebGUI must implement cryptographic mechanisms to protect the confidentiality and integrity of nonlocal maintenance and diagnostic communications.
  • V-255766CAT IIThe MQ Appliance network device must generate audit records when concurrent logons from different workstations occur.
  • V-255767CAT IIThe MQ Appliance network device must generate audit records for all account creations, modifications, disabling, and termination events.
  • V-255768CAT IIThe MQ Appliance network device must off-load audit records onto a different system or media than the system being audited.
  • V-255769CAT IIThe MQ Appliance network device must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and in association with CJCSM 6510.01B.
  • V-255770CAT IIAdministrative accounts for device management must be configured on the authentication server and not the MQ Appliance network device itself (except for the emergency administration account).
  • V-255771CAT IIAccess to the MQ Appliance network device must employ automated mechanisms to centrally apply authentication settings.
  • V-255772CAT IIThe MQ Appliance network device must support organizational requirements to conduct backups of system level information contained in the information system when changes occur or weekly, whichever is sooner.
  • V-255773CAT IIThe MQ Appliance network device must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
  • V-255774CAT IISSH CLI access to the MQ Appliance management interface must be restricted to approved management workstations.
  • V-265886CAT IThe version of MQ Appliance messaging server running on the system must be a supported version.

Removed since V1R1 (49)

  • V-74923CAT IIAccess to the MQ Appliance network device must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type.
  • V-74925CAT IIAccess to the MQ Appliance network element must use two or more authentication servers for the purpose of granting administrative access.
  • V-74927CAT IIThe MQ Appliance network device access must automatically disable accounts after a 35-day period of account inactivity.
  • V-74929CAT IIThe MQ Appliance network device must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
  • V-74931CAT IIThe MQ Appliance network device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
  • V-74933CAT IIThe MQ Appliance network device must notify the administrator of changes to access and/or privilege parameters of the administrator account that occurred since the last logon.
  • V-74935CAT IIThe MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
  • V-74937CAT IIThe MQ Appliance network device must alert the Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) in the event of an audit processing failure.
  • V-74939CAT IIThe MQ Appliance network device must back up audit records at least every seven days onto a different system or system component than the system or component being audited.
  • V-74941CAT IIThe MQ Appliance network device must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).
  • V-74943CAT IIIn the event the authentication server is unavailable, the MQ Appliance must provide one local account created for emergency administration use.
  • V-74945CAT IIThe MQ Appliance network device must use multifactor authentication for network access to privileged accounts.
  • V-74947CAT IIWhen connecting to the MQ Appliance network device using the WebGUI, it must implement replay-resistant authentication mechanisms for network access to privileged accounts.
  • V-74949CAT IIThe MQ Appliance network device must enforce a minimum 15-character password length.
  • V-74951CAT IIThe MQ Appliance network device must prohibit password reuse for a minimum of five generations.
  • V-74953CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one upper-case character be used.
  • V-74955CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one lower-case character be used.
  • V-74957CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one numeric character be used.
  • V-74959CAT IIThe MQ Appliance network device must enforce password complexity by requiring that at least one special character be used.
  • V-74961CAT IIAuthorization for access to the MQ Appliance network device must enforce a 60-day maximum password lifetime restriction.
  • V-74969CAT IIWebGUI access to the MQ Appliance network device, when using PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
  • V-74971CAT IIWebGUI access to the MQ Appliance network device must map the authenticated identity to the user account for PKI-based authentication.
  • V-74973CAT IIThe MQ Appliance network device must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
  • V-74975CAT IIThe WebGUI of the MQ Appliance network device must terminate all sessions and network connections when nonlocal device maintenance is completed.
  • V-74977CAT IIThe WebGUI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-74979CAT IIThe SSH CLI of the MQ Appliance network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.
  • V-74981CAT IIThe MQ Appliance network device must generate unique session identifiers using a FIPS 140-2 approved random number generator.
  • V-74983CAT IIThe MQ Appliance network device must activate a system alert message, send an alarm, and/or automatically shut down when a component failure is detected.
  • V-74985CAT IIThe MQ Appliance network device must generate account activity alerts that are forwarded to the administrators and Information System Security Officer (ISSO). Activity includes, creation, removal, modification and re-enablement after being previously disabled.
  • V-74987CAT IIThe MQ Appliance network device must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.
  • V-74989CAT IIThe MQ Appliance network device must terminate shared/group account credentials when members leave the group.
  • V-74991CAT IIThe MQ Appliance network device must notify the administrator, upon successful logon (access), of the location of last logon (terminal or IP address) in addition to the result, date and time of the last logon (access).
  • V-74993CAT IIThe MQ Appliance network device must generate an immediate alert when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.
  • V-74995CAT IIThe MQ Appliance network device must compare internal information system clocks at least every 24 hours with an authoritative time server.
  • V-74997CAT IIThe MQ Appliance network device must synchronize internal information system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.
  • V-74999CAT IIThe MQ Appliance network device must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.
  • V-75001CAT IIWebGUI access to the MQ Appliance network device must accept Personal Identity Verification (PIV) credentials.
  • V-75003CAT IIWebGUI access to the MQ Appliance network device must electronically verify Personal Identity Verification (PIV) credentials.
  • V-75005CAT IIThe MQ Appliance network device must prohibit the use of cached authenticators after an organization-defined time period.
  • V-75007CAT IIApplications used for nonlocal maintenance sessions using the MQ Appliance WebGUI must implement cryptographic mechanisms to protect the confidentiality and integrity of nonlocal maintenance and diagnostic communications.
  • V-75009CAT IIThe MQ Appliance network device must generate audit records when concurrent logons from different workstations occur.
  • V-75011CAT IIThe MQ Appliance network device must generate audit records for all account creations, modifications, disabling, and termination events.
  • V-75013CAT IIThe MQ Appliance network device must off-load audit records onto a different system or media than the system being audited.
  • V-75015CAT IIThe MQ Appliance network device must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and in association with CJCSM 6510.01B.
  • V-75017CAT IIAdministrative accounts for device management must be configured on the authentication server and not the MQ Appliance network device itself (except for the emergency administration account).
  • V-75019CAT IIAccess to the MQ Appliance network device must employ automated mechanisms to centrally apply authentication settings.
  • V-75021CAT IIThe MQ Appliance network device must support organizational requirements to conduct backups of system level information contained in the information system when changes occur or weekly, whichever is sooner.
  • V-75023CAT IIThe MQ Appliance network device must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
  • V-75025CAT IISSH CLI access to the MQ Appliance management interface must be restricted to approved management workstations.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.