V1R2 changes
VMware NSX 4.x Manager NDM STIG V1R2 (2025-01-30) replaced V1R1 (2024-08-07): 28 checks added, 28 removed. It has 28 checks, against 28 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 28 added
- 28 removed
- 0 updated
Added in V1R2 (28)
- V-265289CAT IIThe NSX Manager must configure logging levels for services to ensure audit records are generated.
- V-265292CAT IThe NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
- V-265293CAT IIThe NSX Manager must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
- V-265294CAT IIThe NSX Manager must display the Standard Mandatory DOD Notice and Consent Banner before granting access.
- V-265295CAT IIThe NSX Manager must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-265296CAT IThe NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).
- V-265313CAT IIThe NSX Manager must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
- V-265315CAT IThe NSX Manager must only enable TLS 1.2 or greater.
- V-265316CAT IIThe NSX Manager must enforce a minimum 15-character password length for local accounts.
- V-265317CAT IIThe NSX Manager must enforce password complexity by requiring that at least one uppercase character be used for local accounts.
- V-265318CAT IIThe NSX Manager must enforce password complexity by requiring that at least one lowercase character be used for local accounts.
- V-265319CAT IIThe NSX Manager must enforce password complexity by requiring that at least one numeric character be used for local accounts.
- V-265320CAT IIThe NSX Manager must enforce password complexity by requiring that at least one special character be used for local accounts.
- V-265321CAT IIThe NSX Manager must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
- V-265327CAT IThe NSX Manager must terminate all network connections associated with a session after five minutes of inactivity.
- V-265338CAT IIThe NSX Manager must be configured to synchronize internal information system clocks using redundant authoritative time sources.
- V-265339CAT IIThe NSX Manager must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-265346CAT IIThe NSX Manager must be configured to protect against denial-of-service (DoS) attacks by limit the number of concurrent sessions to an organization-defined number.
- V-265348CAT IThe NSX Manager must be configured to send logs to a central log server.
- V-265349CAT IIIThe NSX Manager must not provide environment information to third parties.
- V-265350CAT IIThe NSX Manager must be configured to conduct backups on an organizationally defined schedule.
- V-265351CAT IIThe NSX Manager must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-265352CAT IThe NSX Manager must be running a release that is currently supported by the vendor.
- V-265353CAT IIThe NSX Manager must disable SSH.
- V-265354CAT IIThe NSX Manager must disable SNMP v2.
- V-265355CAT IIThe NSX Manager must enable the global FIPS compliance mode for load balancers.
- V-265358CAT IIThe NSX Manager must be configured as a cluster.
- V-265359CAT IIThe NSX Managers must be deployed on separate physical hosts.
Removed since V1R1 (28)
- V-263202CAT IIThe NSX Manager must configure logging levels for services to ensure audit records are generated.
- V-263203CAT IThe NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
- V-263204CAT IIThe NSX Manager must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
- V-263205CAT IIThe NSX Manager must display the Standard Mandatory DOD Notice and Consent Banner before granting access.
- V-263206CAT IIThe NSX Manager must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-263207CAT IThe NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).
- V-263208CAT IIThe NSX Manager must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
- V-263209CAT IThe NSX Manager must only enable TLS 1.2 or greater.
- V-263210CAT IIThe NSX Manager must enforce a minimum 15-character password length for local accounts.
- V-263211CAT IIThe NSX Manager must enforce password complexity by requiring that at least one uppercase character be used for local accounts.
- V-263212CAT IIThe NSX Manager must enforce password complexity by requiring that at least one lowercase character be used for local accounts.
- V-263213CAT IIThe NSX Manager must enforce password complexity by requiring that at least one numeric character be used for local accounts.
- V-263214CAT IIThe NSX Manager must enforce password complexity by requiring that at least one special character be used for local accounts.
- V-263215CAT IIThe NSX Manager must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
- V-263216CAT IThe NSX Manager must terminate all network connections associated with a session after five minutes of inactivity.
- V-263217CAT IIThe NSX Manager must be configured to synchronize internal information system clocks using redundant authoritative time sources.
- V-263218CAT IIThe NSX Manager must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-263219CAT IIThe NSX Manager must be configured to protect against denial-of-service (DoS) attacks by limit the number of concurrent sessions to an organization-defined number.
- V-263220CAT IThe NSX Manager must be configured to send logs to a central log server.
- V-263221The NSX Manager must not provide environment information to third parties.
- V-263222CAT IIThe NSX Manager must be configured to conduct backups on an organizationally defined schedule.
- V-263223CAT IIThe NSX Manager must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-263224CAT IThe NSX Manager must be running a release that is currently supported by the vendor.
- V-263225CAT IIThe NSX Manager must disable SSH.
- V-263226CAT IIThe NSX Manager must disable SNMP v2.
- V-263227CAT IIThe NSX Manager must enable the global FIPS compliance mode for load balancers.
- V-263228CAT IIThe NSX Manager must be configured as a cluster.
- V-263229CAT IIThe NSX Managers must be deployed on separate physical hosts.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.