VMware vSphere 7.0 vCenter Security Technical Implementation Guide

The VMware vSphere 7.0 vCenter Security Technical Implementation Guide (V1 R4) has 57 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

57STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Sep 30 2026

The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

VMware vSphere 7.0 vCenter Security Technical Implementation Guide

Assessment Title

Rule Text

The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

Description

Discussion Text

The VMware CEIP sends VMware anonymized system information that is used to improve the quality, reliability, and functionality of VMware products and services. For confidentiality purposes this feature must be disabled.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-256343

Rule

SV-256343r961863_rule

Severity

medium

Rule Version

VCSA-70-000248

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the vSphere Client, go to Administration >> Deployment >> Customer Experience Improvement Program.

If Customer Experience Improvement "Program Status" is "Joined", this is a finding.

Implementation Procedure

Fix Text

From the vSphere Client, go to Administration >> Deployment >> Customer Experience Improvement Program.

Click "Leave Program".

STIG check 26 of 57 in the VMware vSphere 7.0 vCenter STIG checklist

← Previous · V-256342The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DoW certificate authority.Next · V-256344 →The vCenter server must enforce SNMPv3 security features where SNMP is required.