V2R5 changes
VMware vSphere 8.0 ESXi STIG V2R5 (2026-09-30) replaced V2R4 (2026-07-01): 8 checks updated. It has 76 checks, against 76 in V2R4.
V2R5 checklistV2R4 checklist Compare V2R4 and V2R5 in STIG Compare
- 0 added
- 0 removed
- 8 updated
Updated fields: Check text 6Title 5Discussion 5Fix text 2
Updated in V2R5 (8)
V-258729CAT IIThe ESXi host must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system via the Direct Console User Interface (DCUI).Title, Check text, Discussion
Title
The ESXi host must display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via the Direct Console User Interface (DCUI).
Check text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Select the "Annotations.WelcomeMessage" value and verify it contains the standard mandatory DODDoW notice and consent banner.
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage
If the "Annotations.WelcomeMessage" setting does not contain the standard mandatory DODDoW notice and consent banner, this is a finding.
Discussion
Display of a standardized and approved use notification before granting access to the host ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for a host that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner:
"I've read (literal ampersand) consent to terms in IS user agreem't."
Satisfies: SRG-OS-000023-VMM-000060, SRG-OS-000024-VMM-000070
V-258745CAT IIThe ESXi host must synchronize internal information system clocks to an authoritative time source.Check text, Discussion
Check text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Time Configuration.
Verify NTP or PTP are configured, and one or more authoritative time sources are listed.
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Services.
Verify the NTP or PTP service is running and configured to start and stop with the host.
or
From a PowerCLI command prompt while connected to the ESXi host, run the following commands:
Get-VMHost | Get-VMHostNTPServer
Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon" -or $_.Label -eq "PTP Daemon"}
If the NTP service is not configured with authoritative DODDoW time sources or the service is not configured to start and stop with the host ("Policy" of "on" in PowerCLI) or is stopped, this is a finding.
If PTP is used instead of NTP, this is not a finding.
Discussion
To ensure the accuracy of the system clock, it must be synchronized with an authoritative time source within DODDoW. Many system functions, including time-based logon and activity restrictions, automated reports, system logs, and audit records, depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.
Satisfies: SRG-OS-000355-VMM-001330, SRG-OS-000356-VMM-001340
V-258752CAT IIThe ESXi host must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system via Secure Shell (SSH).Title, Check text, Discussion
Title
The ESXi host must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system via Secure Shell (SSH).
Check text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Select the "Config.Etc.issue" value and verify it contains the standard mandatory DODDoW notice and consent banner.
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue
If the "Config.Etc.issue" setting does not contain the standard mandatory DODDoW notice and consent banner, this is a finding.
Discussion
Display of a standardized and approved use notification before granting access to the host ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for a host that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner:
"I've read (literal ampersand) consent to terms in IS user agreem't."
V-258753CAT IIThe ESXi host Secure Shell (SSH) daemon must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system.Title, Discussion
Title
The ESXi host Secure Shell (SSH) daemon must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system.
Discussion
Display of a standardized and approved use notification before granting access to the host ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for a host that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner:
"I've read (literal ampersand) consent to terms in IS user agreem't."
V-258754CAT IIThe ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).Check text
Check text
Note: SSH is not required to run credential based scans. If SSH is being temporarily opened for scanning, consider a different architecture. From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Services. Under Services, locate the "SSH" service and verify it is "Stopped". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"} If the SSH service is "Running", this is a finding.
V-258782CAT IIThe ESXi host must be configured with an appropriate maximum password age.Check text, Fix text
Check text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Select the "Security.PasswordMaxDays" value and verify it is set to "90365".
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Security.PasswordMaxDays
If the "Security.PasswordMaxDays" setting is not set to "90365", this is a finding.
Fix text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Click "Edit". Select the "Security.PasswordMaxDays" value and configure it to "90180".
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Security.PasswordMaxDays | Set-AdvancedSetting -Value 90180
V-258784CAT IIThe ESXi host must use DoW-approved certificates.Title, Check text, Fix text, Discussion
Title
The ESXi host must use DODoW-approved certificates.
Check text
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Certificate.
If the issuer is not a DODDoW-approved certificate authority, or other AO-approved certificate authority, this is a finding.
If the host will never be accessed directly (virtual machine console connections bypass vCenter), this is not a finding.
Fix text
Join the ESXi host to vCenter before replacing the certificate.
Obtain a DODDoW-issued certificate and private key for the host following the requirements below:
Key size: 2048 bits or more (PEM encoded)
Key format: PEM
VMware supports PKCS8 and PKCS1 (RSA keys)
x509 version 3
SubjectAltName must contain DNS Name=<machine_FQDN>
CRT (Base-64) format
Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment
Start time of one day before the current time
CN (and SubjectAltName) set to the host name (or IP address) that the ESXi host has in the vCenter Server inventory
From the vSphere Web Client, select the ESXi host's vCenter Server >> Configure >> System >> Advanced Settings.
Select the "vpxd.certmgmt.mode" value and ensure it is set to "custom".
Put the host into maintenance mode.
Temporarily enable Secure Shell (SSH) on the host. Use Secure Copy Protocol (SCP) to transfer the new certificate and key to /tmp. SSH to the host. Back up the existing certificate and key:
# mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.bak
# mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.bak
Copy the new certificate and key to "/etc/vmware/ssl/" and rename them to "rui.crt" and "rui.key" respectively.
Restart management agents to implement the new certificate:
# services.sh restart
Discussion
The default self-signed host certificate issued by the VMware Certificate Authority (VMCA) must be replaced with a DODDoW-approved certificate when the host will be accessed directly, such as during a virtual machine (VM) console connection.
The use of a DODDoW certificate on the host assures clients the service they are connecting to is legitimate and properly secured.
V-265974CAT IIThe ESXi host must use DoW-approved encryption to protect the confidentiality of network sessions.Title
Title
The ESXi host must use DODoW-approved encryption to protect the confidentiality of network sessions.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R5 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.