IBM WebSphere Traditional V9.x Security Technical Implementation Guide

The IBM WebSphere Traditional V9.x Security Technical Implementation Guide (V2 R2) has 76 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

76STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R2

CurrentPublished Wed Sep 30 2026 What changed in V2R2

The WebSphere Application Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Assessment Title

Rule Text

The WebSphere Application Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

Description

Discussion Text

Quality of Protection specifies the security level, ciphers, and mutual authentication settings for the Secure Socket Layer (SSL/TLS) configuration.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-255829

Rule

SV-255829r1265296_rule

Severity

medium

Rule Version

WBSP-AS-000160

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the administrative console, navigate to Security >> SSL certificate and key management.

Click "SSL configurations".

Click on each SSL configuration to review.

Under "Additional Properties", click "Quality of protection (QoP)" settings.

If the "Protocol" field does not show "TLSv1.2 or greater", this is a finding.

Implementation Procedure

Fix Text

From the administrative console, navigate to Security >> SSL certificate and key management.

Click "SSL configurations".

Click on each SSL configuration.

Under "Additional Properties", click "Quality of protection (QoP)" settings.

At the "Protocol" pull-down menu, select "TLSv1.2 or greater".

Click "OK".

Click "Save".

Restart the DMGR and all the JVMs.

STIG check 12 of 76 in the IBM WebSphere Traditional V9.x STIG checklist

← Previous · V-255828The WebSphere Application Server users in a local user registry group must be authorized for that group.Next · V-255830 →The WebSphere Application Server global application security must be enabled.