Palo Alto Networks NDM Security Technical Implementation Guide

The Palo Alto Networks NDM Security Technical Implementation Guide (V3 R4) has 35 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

35STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Jul 01 2026 What changed in V3R4

The Palo Alto Networks security platform must not use Password Profiles.

Palo Alto Networks NDM Security Technical Implementation Guide

Assessment Title

Rule Text

The Palo Alto Networks security platform must not use Password Profiles.

Description

Discussion Text

Password profiles override settings made in the Minimum Password Complexity window. If Password Profiles are used they can bypass password complexity requirements.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-228675

Rule

SV-228675r961863_rule

Severity

medium

Rule Version

PANW-NM-000142

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Go to Device >> Password Profiles
If there are configured Password Profiles, this is a finding.

Implementation Procedure

Fix Text

Go to Device >> Password Profiles
If the screen is blank (no configured Password Profiles), do nothing.

If there are configured Password Profiles, identify which accounts are using them and bring this to the attention of the ISSO immediately.
Delete the Password Profiles when authorized to make changes to the device in accordance with local change management policies.

STIG check 30 of 35 in the Palo Alto Networks NDM STIG checklist

← Previous · V-228674The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.Next · V-228676 →The Palo Alto Networks security platform must not use the default admin account password.