What changed in NetApp ONTAP DSC 9.x STIG V2R4V2R4 changes

NetApp ONTAP DSC 9.x STIG V2R4 (2026-07-01) replaced V2R3 (2026-01-05): 2 checks updated. It has 29 checks, against 29 in V2R3.

V2R4 checklistV2R3 checklist Compare V2R3 and V2R4 in STIG Compare

  • 0 added
  • 0 removed
  • 2 updated

Updated fields: Check text 2Fix text 1Title 1

Updated in V2R4 (2)

V-246940CAT IONTAP must be configured to use an authentication server to provide multifactor authentication.Check text, Fix text

Check text

Use "security login show -authentication-method domain" to see users configured to authenticate with Active Directory. If ONTAP is not configured to use an authentication server, this is a finding. Note: The authentication method "domain" is one example. Other authentication methods such as "publickey" and "saml" are also acceptable.

Fix text

Configure ONTAP to make use of Active Directory to authenticate users and prohibit the use of cached authenticators with "security login create -user-or-group-name &ltuser or group name> -authentication-method domain -application ssh". Note: The authentication method "domain" is one example. Other authentication methods such as "publickey" and "saml" are also acceptable.

V-246940 in V2R4

V-246948CAT IIONTAP must implement replay-resistant authentication mechanisms for network access to privileged accounts.Title, Check text

Title

ONTAP must implement replay-resistant authentication mechanisms for network access to privilegesd accounts.

Check text

Use "security login show -role admin" to see all configured admin users and groups. If any account, other than the admin account used as the account of last resort, has an authentication method other than domainpassword, this is a finding.

V-246948 in V2R4

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R4 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.