Palo Alto Networks NDM Security Technical Implementation Guide

The Palo Alto Networks NDM Security Technical Implementation Guide (V3 R4) has 35 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

35STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Jul 01 2026 What changed in V3R4

The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.

Palo Alto Networks NDM Security Technical Implementation Guide

Assessment Title

Rule Text

The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.

Description

Discussion Text

DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling mandates that certificates must be issued by the DoD PKI or by a DoD-approved PKI for authentication, digital signature, or encryption.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-228674

Rule

SV-228674r961863_rule

Severity

medium

Rule Version

PANW-NM-000141

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Go to Device >> Certificate Management >> Certificates
Installed Certificates are listed in the "Device Certificates" tab.
If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding.

Implementation Procedure

Fix Text

Obtain a Device Certificate from the DoD PKI or from a DoD-approved PKI:
Go to Device >> Certificate Management >> Certificates
Select "Import" (at the bottom of the pane). 
In the "Import Certificate" pane, complete each field.
Select "OK".

STIG check 29 of 35 in the Palo Alto Networks NDM STIG checklist

← Previous · V-228673The Palo Alto Networks security platform must employ centrally managed authentication server(s).Next · V-228675 →The Palo Alto Networks security platform must not use Password Profiles.