VCSA-70-000009 - The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.

CAT|I

CCI|CCI-000068

CCI|CCI-000382

CCI|CCI-001184

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002450

Rule-ID|SV-256318r919041_rule

STIG-ID|VCSA-70-000009

Vuln-ID|V-256318

VCSA-70-000023 - The vCenter Server must enforce the limit of three consecutive invalid login attempts by a user.

CAT|II

CCI|CCI-000044

Rule-ID|SV-256319r885568_rule

STIG-ID|VCSA-70-000023

Vuln-ID|V-256319

VCSA-70-000024 - The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before login.

CCI|CCI-000048

CCI|CCI-000050

CCI|CCI-001384

Rule-ID|SV-256320r885571_rule

STIG-ID|VCSA-70-000024

Vuln-ID|V-256320

VCSA-70-000034 - The vCenter Server must produce audit records containing information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-256321r885574_rule

STIG-ID|VCSA-70-000034

Vuln-ID|V-256321

VCSA-70-000057 - vCenter Server plugins must be verified.

CCI|CCI-000381

Rule-ID|SV-256322r885577_rule

STIG-ID|VCSA-70-000057

Vuln-ID|V-256322

VCSA-70-000059 - The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

CCI|CCI-000764

CCI|CCI-000770

CCI|CCI-000795

CCI|CCI-000804

CCI|CCI-001682

Rule-ID|SV-256323r885580_rule

STIG-ID|VCSA-70-000059

Vuln-ID|V-256323

VCSA-70-000060 - The vCenter Server must require multifactor authentication.

CCI|CCI-000166

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-001953

CCI|CCI-002009

Rule-ID|SV-256324r885583_rule

STIG-ID|VCSA-70-000060

Vuln-ID|V-256324

VCSA-70-000069 - The vCenter Server passwords must be at least 15 characters in length.

CCI|CCI-000205

Rule-ID|SV-256325r885586_rule

STIG-ID|VCSA-70-000069

Vuln-ID|V-256325

VCSA-70-000070 - The vCenter Server must prohibit password reuse for a minimum of five generations.

CCI|CCI-000200

Rule-ID|SV-256326r885589_rule

STIG-ID|VCSA-70-000070

Vuln-ID|V-256326

VCSA-70-000071 - The vCenter Server passwords must contain at least one uppercase character.

CCI|CCI-000192

Rule-ID|SV-256327r885592_rule

STIG-ID|VCSA-70-000071

Vuln-ID|V-256327

VCSA-70-000072 - The vCenter Server passwords must contain at least one lowercase character.

CCI|CCI-000193

Rule-ID|SV-256328r885595_rule

STIG-ID|VCSA-70-000072

Vuln-ID|V-256328

VCSA-70-000073 - The vCenter Server passwords must contain at least one numeric character.

CCI|CCI-000194

Rule-ID|SV-256329r885598_rule

STIG-ID|VCSA-70-000073

Vuln-ID|V-256329

VCSA-70-000074 - The vCenter Server passwords must contain at least one special character.

CCI|CCI-001619

Rule-ID|SV-256330r885601_rule

STIG-ID|VCSA-70-000074

Vuln-ID|V-256330

VCSA-70-000077 - The vCenter Server must enable FIPS-validated cryptography.

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-001188

CCI|CCI-001199

CCI|CCI-001967

CCI|CCI-003123

Rule-ID|SV-256331r885604_rule

STIG-ID|VCSA-70-000077

Vuln-ID|V-256331

VCSA-70-000079 - The vCenter Server must enforce a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-256332r885607_rule

STIG-ID|VCSA-70-000079

Vuln-ID|V-256332

VCSA-70-000080 - The vCenter Server must enable revocation checking for certificate-based authentication.

CCI|CCI-000185

CCI|CCI-001954

CCI|CCI-001991

CCI|CCI-002010

Rule-ID|SV-256333r919043_rule

STIG-ID|VCSA-70-000080

Vuln-ID|V-256333

VCSA-70-000089 - The vCenter Server must terminate vSphere Client sessions after 10 minutes of inactivity.

CCI|CCI-001133

CCI|CCI-002038

CCI|CCI-002361

Rule-ID|SV-256334r885613_rule

STIG-ID|VCSA-70-000089

Vuln-ID|V-256334

VCSA-70-000095 - The vCenter Server users must have the correct roles assigned.

CCI|CCI-001082

CCI|CCI-001084

CCI|CCI-001813

Rule-ID|SV-256335r885616_rule

STIG-ID|VCSA-70-000095

Vuln-ID|V-256335

VCSA-70-000110 - The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

CCI|CCI-001095

Rule-ID|SV-256336r885619_rule

STIG-ID|VCSA-70-000110

Vuln-ID|V-256336

VCSA-70-000123 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

CCI|CCI-002132

Rule-ID|SV-256337r885622_rule

STIG-ID|VCSA-70-000123

Vuln-ID|V-256337

VCSA-70-000145 - The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

CCI|CCI-002238

Rule-ID|SV-256338r885625_rule

STIG-ID|VCSA-70-000145

Vuln-ID|V-256338

VCSA-70-000148 - The vCenter Server must be configured to send logs to a central log server.

CCI|CCI-001851

Rule-ID|SV-256339r885628_rule

STIG-ID|VCSA-70-000148

Vuln-ID|V-256339

VCSA-70-000150 - vCenter must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

CCI|CCI-000172

CCI|CCI-001744

CCI|CCI-001858

Rule-ID|SV-256340r885631_rule

STIG-ID|VCSA-70-000150

Vuln-ID|V-256340

VCSA-70-000158 - The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.

CCI|CCI-001891

Rule-ID|SV-256341r892804_rule

STIG-ID|VCSA-70-000158

Vuln-ID|V-256341

VCSA-70-000195 - The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.

CCI|CCI-002470

Rule-ID|SV-256342r885637_rule

STIG-ID|VCSA-70-000195

Vuln-ID|V-256342

VCSA-70-000248 - The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

CCI|CCI-000366

Rule-ID|SV-256343r885640_rule

STIG-ID|VCSA-70-000248

Vuln-ID|V-256343

VCSA-70-000253 - The vCenter server must enforce SNMPv3 security features where SNMP is required.

Rule-ID|SV-256344r885643_rule

STIG-ID|VCSA-70-000253

Vuln-ID|V-256344

VCSA-70-000265 - The vCenter server must disable SNMPv1/2 receivers.

Rule-ID|SV-256345r885646_rule

STIG-ID|VCSA-70-000265

Vuln-ID|V-256345

VCSA-70-000266 - The vCenter Server must require an administrator to unlock an account locked due to excessive login failures.

Rule-ID|SV-256346r885649_rule

STIG-ID|VCSA-70-000266

Vuln-ID|V-256346

VCSA-70-000267 - The vCenter Server must disable the distributed virtual switch health check.

CAT|III

Rule-ID|SV-256347r885652_rule

STIG-ID|VCSA-70-000267

Vuln-ID|V-256347

VCSA-70-000268 - The vCenter Server must set the distributed port group Forged Transmits policy to 'Reject' - Reject.

Rule-ID|SV-256348r885655_rule

STIG-ID|VCSA-70-000268

Vuln-ID|V-256348

VCSA-70-000269 - The vCenter Server must set the distributed port group Media Access Control (MAC) Address Change policy to 'Reject' - Reject.

Rule-ID|SV-256349r885658_rule

STIG-ID|VCSA-70-000269

Vuln-ID|V-256349

VCSA-70-000270 - The vCenter Server must set the distributed port group Promiscuous Mode policy to 'Reject' - Reject.

Rule-ID|SV-256350r885661_rule

STIG-ID|VCSA-70-000270

Vuln-ID|V-256350

VCSA-70-000271 - The vCenter Server must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-256351r885664_rule

Detections

Analytics

DISA STIG VMware vSphere 7.0 vCenter v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.1 May 1, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.

Detections

Analytics

DISA STIG VMware vSphere 7.0 vCenter v1r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG VMware vSphere 7.0 vCenter v1r2