V3R1 changes
Ivanti EPMM Server STIG V3R1 (2024-10-24) replaced V2R1 (2024-07-24): 26 checks updated. It has 26 checks, against 26 in V2R1.
V3R1 checklistV2R1 checklist Compare V2R1 and V3R1 in STIG Compare
- 0 added
- 0 removed
- 26 updated
Updated fields: Title 26Check text 3Fix text 3
Updated in V3R1 (26)
V-251400CAT IIThe Ivanti EPMM server must limit the number of concurrent sessions per privileged user account to three or less concurrent sessions.Title
Title
The Ivanti EPMobileIronM Core server must limit the number of concurrent sessions per privileged user account to three or less concurrent sessions.
V-251401CAT IIThe Ivanti EPMM server must initiate a session lock after a 15-minute period of inactivity.Title
Title
The Ivanti EPMobileIronM Core server must initiate a session lock after a 15-minute period of inactivity.
V-251402CAT IIThe Ivanti EPMM server must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.Title, Check text, Fix text
Title
The Ivanti EPMobileIronM Core server must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
Check text
Verify the Ivanti MobileIronEPMM Core server is configured to enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
In the Core server, navigate to the following: Settings >> Security >> Password Policy.
Verify the number of failed attempts is set to 3 and Auto-Lock Time is set to 900 seconds.
If the number of failed attempts is not set to 3 and Auto-Lock Time is not set to 900 seconds, this is a finding.
Fix text
Configure the Ivanti MobileIronEPMM Core server to enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.
Go to Settings >> Security >> Password Policy. Set Number of Failed attempts to 3 and set Auto-Lock Time to 900 seconds.
V-251403CAT IIThe Ivanti EPMM server must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.Title
Title
The Ivanti EPMobileIronM Core server must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.
V-251404CAT IIThe Ivanti EPMM server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.Title
Title
The Ivanti EPMobileIronM Core server must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
V-251405CAT IIThe Ivanti EPMM server must back up audit records at least every seven days onto a log management server.Title
Title
The Ivanti EPMobileIronM Core server must back up audit records at least every seven days onto a log management server.
V-251406CAT IIThe Ivanti EPMM server must be configured to use a DoD Central Directory Service to provide multifactor authentication for network access to privileged and non-privileged accounts.Title
Title
The Ivanti MobileIronEPMM Core server must be configured to use a DoD Central Directory Service to provide multifactor authentication for network access to privileged and non-privileged accounts.
V-251407CAT IIThe Ivanti EPMM server must enforce a minimum 15-character password length.Title
Title
The Ivanti EPMobileIronM Core server must enforce a minimum 15-character password length.
V-251408CAT IIThe Ivanti EPMM server must prohibit password reuse for a minimum of four generations.Title
Title
The Ivanti EPMobileIronM Core server must prohibit password reuse for a minimum of four generations.
V-251409CAT IIThe Ivanti EPMM server must enforce password complexity by requiring that at least one uppercase character be used.Title
Title
The Ivanti EPMobileIronM Core server must enforce password complexity by requiring that at least one uppercase character be used.
V-251410CAT IIThe Ivanti EPMM server must enforce password complexity by requiring that at least one lowercase character be used.Title
Title
The Ivanti EPMobileIronM Core server must enforce password complexity by requiring that at least one lowercase character be used.
V-251411CAT IIThe Ivanti EPMM server must enforce password complexity by requiring that at least one numeric character be used.Title
Title
The Ivanti EPMobileIronM Core server must enforce password complexity by requiring that at least one numeric character be used.
V-251412CAT IIThe Ivanti EPMM server must enforce password complexity by requiring that at least one special character be used.Title
Title
The Ivanti EPMobileIronM Core server must enforce password complexity by requiring that at least one special character be used.
V-251413CAT IThe Ivanti EPMM server must use FIPS-validated SHA-2 or higher hash function to protect the integrity of keyed-hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications.Title
Title
The Ivanti MobileIronEPMM Core server must use FIPS-validated SHA-2 or higher hash function to protect the integrity of keyed-hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications.
V-251414CAT IIThe Ivanti EPMM server must automatically terminate a user session after an organization-defined period of user inactivity.Title
Title
The Ivanti EPMobileIronM Core server must automatically terminate a user session after an organization-defined period of user inactivity.
V-251415CAT IIThe Ivanti EPMM server must be configured to transfer Ivanti EPMM server logs to another server for storage, analysis, and reporting. Note: Ivanti EPMM server logs include logs of UEM events and logs transferred to the Ivanti EPMM server by UEM agents of managed devices.Title
Title
The Ivanti MobileIronEPMM Core server must be configured to transfer Ivanti MobileIronEPMM Core server logs to another server for storage, analysis, and reporting. Note: Ivanti MobileIronEPMM Core server logs include logs of UEM events and logs transferred to the Ivanti MobileIronEPMM Core server by UEM agents of managed devices.
V-251416CAT IThe Ivanti EPMM server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.Title
Title
The Ivanti MobileIronEPMM Core server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
V-251417CAT IIThe Ivanti EPMM server must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.Title
Title
The Ivanti MobileIronEPMM Core server must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.
V-251418CAT IThe Ivanti EPMM server must be maintained at a supported version.Title
Title
The Ivanti EPMobileIronM Core server must be maintained at a supported version.
V-251419CAT IIThe Ivanti EPMM server must be configured with the periodicity of the following commands to the agent of six hours or less: - query connectivity status - query the current version of the managed device firmware/software - query the current version of installed mobile applications - read audit logs kept by the managed device.Title
Title
The Ivanti MobileIronEPMM Core server must be configured with the periodicity of the following commands to the agent of six hours or less: - query connectivity status - query the current version of the managed device firmware/software - query the current version of installed mobile applications - read audit logs kept by the managed device.
V-251420CAT IThe Ivanti EPMM server must use a FIPS-validated cryptographic module to generate cryptographic hashes.Title
Title
The Ivanti EPMobileIronM Core server must use a FIPS-validated cryptographic module to generate cryptographic hashes.
V-251421CAT IIThe Ivanti EPMM server must, at a minimum, off-load audit logs of interconnected systems in real time and off-load standalone systems weekly.Title
Title
The Ivanti EPMobileIronM Core server must, at a minimum, off-load audit logs of interconnected systems in real time and off-load standalone systems weekly.
V-251422CAT IIThe Ivanti EPMM server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.Title
Title
The Ivanti MobileIronEPMM Core server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
V-251423CAT IThe Ivanti EPMM server must be configured to implement FIPS 140-2 mode for all server and agent encryption.Title
Title
The Ivanti EPMobileIronM Core server must be configured to implement FIPS 140-2 mode for all server and agent encryption.
V-251774CAT IIThe Ivanti EPMM server must configured to lock administrator accounts after three unsuccessful login attempts.Title, Check text, Fix text
Title
The Ivanti EPMobileIronM Core server must configured to lock administrator accounts after three unsuccessful login attempts.
Check text
Verify the Ivanti MobileIronEPMM Core server has been configured to lock administrator accounts after three unsuccessful login attempts.
Log in to the Core Admin Console >> Settings >> Security >> Password Policy.
Verify "Number of Failed attempts" is set to "3".
If the Ivanti MobileIronEPMM Core server does not lock administrator accounts after three unsuccessful login attempts, this is a finding.
Fix text
Configure the Ivanti MobileIronEPMM Core server to lock administrator accounts after three unsuccessful login attempts.
Log in to the Core Admin Console >> Settings >> Security >> Password Policy.
Set "Number of Failed attempts" to "3".
V-251777CAT IIThe Ivanti EPMM server must be configured to lock an administrator's account for at least 15 minutes after the account has been locked because the maximum number of unsuccessful login attempts has been exceeded.Title, Check text, Fix text
Title
The Ivanti MobileIronEPMM Core server must be configured to lock an administrator's account for at least 15 minutes after the account has been locked because the maximum number of unsuccessful login attempts has been exceeded.
Check text
Verify the Ivanti MobileIronEPMM Core server has been configured to lock an administrator's account for at least 15 minutes after the account has been locked because the maximum number of unsuccessful login attempts has been exceeded.
Log in to the Core Admin Console >> Settings >> Security >> Password Policy.
Verify "Auto-Lock Time" is set to 15 minutes (900 seconds).
If the Ivanti MobileIronEPMM Core server does not lock an administrator's account for at least 15 minutes after the account has been locked because the maximum number of unsuccessful login attempts has been exceeded, this is a finding.
Fix text
Configure the Ivanti MobileIronEPMM Core server to lock an administrator's account for at least 15 minutes after the account has been locked because the maximum number of unsuccessful login attempts has been exceeded.
Log in to the Core Admin Console >> Settings >> Security >> Password Policy.
Set "Auto-Lock Time" to 15 minutes (900 seconds).
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.