FGFW-ND-000005 - The FortiGate device must automatically audit account creation

800-53|AC-2(4)

CAT|II

CCI|CCI-000018

Rule-ID|SV-234162r879525_rule

STIG-ID|FGFW-ND-000005

Vuln-ID|V-234162

FGFW-ND-000010 - The FortiGate device must automatically audit account modification

CCI|CCI-001403

Rule-ID|SV-234163r879526_rule

STIG-ID|FGFW-ND-000010

Vuln-ID|V-234163

FGFW-ND-000020 - The FortiGate device must automatically audit account removal actions

CCI|CCI-001405

Rule-ID|SV-234164r879528_rule

STIG-ID|FGFW-ND-000020

Vuln-ID|V-234164

FGFW-ND-000030 - The FortiGate device must have only one local account to be used as the account of last resort in the event the authentication server is unavailable.

800-53|AC-2(7)(a)

800-53|AC-2a.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-234165r879589_rule

STIG-ID|FGFW-ND-000030

Vuln-ID|V-234165

FGFW-ND-000035 - The FortiGate device must allow full access to only those individuals or roles designated by the ISSM.

800-53|AC-4

CCI|CCI-001368

Rule-ID|SV-234166r879533_rule

STIG-ID|FGFW-ND-000035

Vuln-ID|V-234166

FGFW-ND-000040 - The FortiGate device must audit the execution of privileged functions

800-53|AC-6(9)

CCI|CCI-002234

Rule-ID|SV-234167r879720_rule

STIG-ID|FGFW-ND-000040

Vuln-ID|V-234167

FGFW-ND-000045 - The FortiGate device must enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-234168r879546_rule

STIG-ID|FGFW-ND-000045

Vuln-ID|V-234168

FGFW-ND-000050 - The FortiGate device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-234169r879547_rule

STIG-ID|FGFW-ND-000050

Vuln-ID|V-234169

FGFW-ND-000055 - The FortiGate device must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.

800-53|AC-8b.

CCI|CCI-000050

Rule-ID|SV-234170r879548_rule

STIG-ID|FGFW-ND-000055

Vuln-ID|V-234170

FGFW-ND-000060 - The FortiGate device must log all user activity.

800-53|AU-10

CCI|CCI-000166

Rule-ID|SV-234171r879554_rule

STIG-ID|FGFW-ND-000060

Vuln-ID|V-234171

FGFW-ND-000065 - The FortiGate device must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-234172r879866_rule

STIG-ID|FGFW-ND-000065

Vuln-ID|V-234172

FGFW-ND-000070 - The FortiGate device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur

Rule-ID|SV-234173r879870_rule

STIG-ID|FGFW-ND-000070

Vuln-ID|V-234173

FGFW-ND-000075 - The FortiGate device must generate audit records when successful/unsuccessful logon attempts occur

Rule-ID|SV-234174r879874_rule

STIG-ID|FGFW-ND-000075

Vuln-ID|V-234174

FGFW-ND-000080 - The FortiGate device must generate audit records for privileged activities or other system-level access

Rule-ID|SV-234175r879875_rule

STIG-ID|FGFW-ND-000080

Vuln-ID|V-234175

FGFW-ND-000085 - The FortiGate device must generate audit records showing starting and ending time for administrator access to the system

Rule-ID|SV-234176r879876_rule

STIG-ID|FGFW-ND-000085

Vuln-ID|V-234176

FGFW-ND-000090 - The FortiGate device must generate audit records when concurrent logons from different workstations occur

Rule-ID|SV-234177r879877_rule

STIG-ID|FGFW-ND-000090

Vuln-ID|V-234177

FGFW-ND-000095 - The FortiGate device must generate audit records containing information that establishes the identity of any individual or process associated with the event.

800-53|AU-3

CCI|CCI-001487

Rule-ID|SV-234178r879568_rule

STIG-ID|FGFW-ND-000095

Vuln-ID|V-234178

FGFW-ND-000100 - The FortiGate device must generate audit records containing the full-text recording of privileged commands.

800-53|AU-3(1)

CCI|CCI-000135

Rule-ID|SV-234179r879569_rule

STIG-ID|FGFW-ND-000100

Vuln-ID|V-234179

FGFW-ND-000105 - The FortiGate device must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-234180r879730_rule

STIG-ID|FGFW-ND-000105

Vuln-ID|V-234180

FGFW-ND-000110 - The FortiGate device must off-load audit records on to a different system or media than the system being audited.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-234181r879886_rule

STIG-ID|FGFW-ND-000110

Vuln-ID|V-234181

FGFW-ND-000115 - The FortiGate device must generate an immediate real-time alert of all audit failure events requiring real-time alerts.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-234182r879733_rule

STIG-ID|FGFW-ND-000115

Vuln-ID|V-234182

FGFW-ND-000120 - The FortiGate device must synchronize internal information system clocks using redundant authoritative time sources

800-53|AU-8(2)

800-53|CM-6b.

CCI|CCI-000366

CCI|CCI-001893

Rule-ID|SV-234183r879746_rule

STIG-ID|FGFW-ND-000120

Vuln-ID|V-234183

FGFW-ND-000125 - The FortiGate device must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

800-53|AU-8b.

CCI|CCI-001890

Rule-ID|SV-234184r879747_rule

STIG-ID|FGFW-ND-000125

Vuln-ID|V-234184

FGFW-ND-000130 - The FortiGate device must protect audit information from unauthorized deletion.

800-53|AU-9

CCI|CCI-000164

Rule-ID|SV-234185r879578_rule

STIG-ID|FGFW-ND-000130

Vuln-ID|V-234185

FGFW-ND-000135 - The FortiGate device must protect audit tools from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-234186r879579_rule

STIG-ID|FGFW-ND-000135

Vuln-ID|V-234186

FGFW-ND-000140 - The FortiGate device must protect audit tools from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-234187r879580_rule

STIG-ID|FGFW-ND-000140

Vuln-ID|V-234187

FGFW-ND-000145 - The FortiGate device must prohibit installation of software without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-001812

Rule-ID|SV-234188r879751_rule

STIG-ID|FGFW-ND-000145

Vuln-ID|V-234188

FGFW-ND-000150 - The FortiGate device must enforce access restrictions associated with changes to device configuration.

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-234189r879753_rule

STIG-ID|FGFW-ND-000150

Vuln-ID|V-234189

FGFW-ND-000155 - The FortiGate device must limit privileges to change the software resident within software libraries.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-234190r879586_rule

STIG-ID|FGFW-ND-000155

Vuln-ID|V-234190

FGFW-ND-000160 - The FortiGate device must enforce access restrictions associated with changes to the system components.

800-53|CM-5

CCI|CCI-000345

Rule-ID|SV-234191r879887_rule

STIG-ID|FGFW-ND-000160

Vuln-ID|V-234191

FGFW-ND-000165 - The FortiGate device must use LDAP for authentication.

800-53|CM-6(1)

CCI|CCI-000370

Rule-ID|SV-234192r916111_rule

STIG-ID|FGFW-ND-000165

Vuln-ID|V-234192

FGFW-ND-000170 - The FortiGate device must be running an operating system release that is currently supported by the vendor.

CAT|I

Rule-ID|SV-234193r879887_rule

STIG-ID|FGFW-ND-000170

Vuln-ID|V-234193

FGFW-ND-000175 - The FortiGate device must generate log records for a locally developed list of auditable events

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-234194r879887_rule

STIG-ID|FGFW-ND-000175

Vuln-ID|V-234194

FGFW-ND-000180 - The FortiGate device must conduct backups of system-level information contained in the information system when changes occur.

800-53|CP-9b.

CCI|CCI-000537

Rule-ID|SV-234195r916221_rule

STIG-ID|FGFW-ND-000180

Vuln-ID|V-234195

FGFW-ND-000185 - The FortiGate device must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.

800-53|CP-9c.

CCI|CCI-000539

Rule-ID|SV-234196r879887_rule

STIG-ID|FGFW-ND-000185

Vuln-ID|V-234196

FGFW-ND-000190 - FortiGate devices performing maintenance functions must restrict use of these functions to authorized personnel only.

Detections

Analytics

DISA Fortigate Firewall NDM STIG v1r4

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous