MD7X-00-000300 MongoDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53|AC-3

CAT|I

CCI|CCI-000213

Rule-ID|SV-265906r1028504_rule

STIG-ID|MD7X-00-000300

Vuln-ID|V-265906

MD7X-00-002900 Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be owned by database/DBMS principals authorized for ownership.

800-53|CM-5(6)

CAT|II

CCI|CCI-001499

Rule-ID|SV-265913r1028525_rule

STIG-ID|MD7X-00-002900

Vuln-ID|V-265913

MD7X-00-003000 The role(s)/group(s) used to modify database structure (including but not limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

Rule-ID|SV-265914r1028528_rule

STIG-ID|MD7X-00-003000

Vuln-ID|V-265914

MD7X-00-003600 MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-265916r1028534_rule

STIG-ID|MD7X-00-003600

Vuln-ID|V-265916

MD7X-00-004200 MongoDB must map the PKI-authenticated identity to an associated user account.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-265920r1028546_rule

STIG-ID|MD7X-00-004200

Vuln-ID|V-265920

MD7X-00-004500 MongoDB must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

800-53|IA-8

CCI|CCI-000804

Rule-ID|SV-265923r1028800_rule

STIG-ID|MD7X-00-004500

Vuln-ID|V-265923

MD7X-00-004600 MongoDB must separate user functionality (including user interface services) from database management functionality.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-265924r1028722_rule

STIG-ID|MD7X-00-004600

Vuln-ID|V-265924

MD7X-00-005700 MongoDB must check the validity of all data inputs except those specifically identified by the organization.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-265929r1028804_rule

STIG-ID|MD7X-00-005700

Vuln-ID|V-265929

MD7X-00-006000 MongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-265931r1028807_rule

STIG-ID|MD7X-00-006000

Vuln-ID|V-265931

MD7X-00-006100 MongoDB must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-265932r1028808_rule

STIG-ID|MD7X-00-006100

Vuln-ID|V-265932

MD7X-00-006200 The DBMS must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-265933r1028585_rule

STIG-ID|MD7X-00-006200

Vuln-ID|V-265933

MD7X-00-006400 MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.

800-53|AC-16a.

CCI|CCI-002262

CCI|CCI-002263

CCI|CCI-002264

Rule-ID|SV-265934r1028811_rule

STIG-ID|MD7X-00-006400

Vuln-ID|V-265934

MD7X-00-006800 MongoDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-265936r1028813_rule

STIG-ID|MD7X-00-006800

Vuln-ID|V-265936

MD7X-00-007700 MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-001812

Rule-ID|SV-265941r1028609_rule

STIG-ID|MD7X-00-007700

Vuln-ID|V-265941

MD7X-00-007800 MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-265942r1028817_rule

STIG-ID|MD7X-00-007800

Vuln-ID|V-265942

MD7X-00-008000 The DBMS must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

800-53|CM-7(1)(b)

CCI|CCI-001762

Rule-ID|SV-265943r1028615_rule

STIG-ID|MD7X-00-008000

Vuln-ID|V-265943

MD7X-00-008300 MongoDB must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-265945r1028621_rule

STIG-ID|MD7X-00-008300

Vuln-ID|V-265945

MD7X-00-009000 When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.

800-53|SI-10(3)

CCI|CCI-002754

Rule-ID|SV-265950r1028819_rule

STIG-ID|MD7X-00-009000

Vuln-ID|V-265950

Detections

Analytics

DISA MongoDB Enterprise Advanced 7.x STIG v1r1

Audit Details

File Details

Audit Changelog

No revisions found