CCI-001199
Protects the confidentiality and/or integrity of organization-defined information at rest.
Docker Secrets must be used to store configuration files and small amounts of user-generated data (up to 500 kb in size) in Docker Enterprise.
1 rule found Severity: Medium
The FortiGate device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
1 rule found Severity: High
CounterACT must allow only authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media.
1 rule found Severity: Medium
IBM Aspera Faspex must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: Medium
IBM Aspera Shares must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: Medium
The MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
1 rule found Severity: Medium
1 rule found Severity: Medium
Microsoft Android 11 must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
2 rules found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
Samsung Android must be configured to enable encryption for data at rest on removable storage media or alternatively, the use of removable storage media must be disabled.
2 rules found Severity: High
The Tanium Operating System (TanOS) must use FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of operating system configuration and user-generated data stored on the host.
2 rules found Severity: Medium
Apple iOS/iPadOS 16 must require a valid password be successfully entered before the mobile device data is unencrypted.
2 rules found Severity: High
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
5 rules found Severity: Low
The macOS system must implement cryptographic mechanisms to protect the confidentiality and integrity of all information at rest.
1 rule found Severity: Medium
Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
1 rule found Severity: Medium
3 rules found Severity: High
The DBMS must take needed steps to protect data at rest and ensure confidentiality and integrity of application data.
1 rule found Severity: Medium
3 rules found Severity: High
The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
1 rule found Severity: High
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
8 rules found Severity: High
The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
2 rules found Severity: High
Apple iOS/iPadOS 17 must require a valid password be successfully entered before the mobile device data is unencrypted.
2 rules found Severity: High
1 rule found Severity: Low
1 rule found Severity: Low
The macOS system must implement cryptographic mechanisms to protect the confidentiality and integrity of all information at rest.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
Permissions assigned to the DNSSEC keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.
1 rule found Severity: Medium
Ubuntu operating systems handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
1 rule found Severity: Medium
The Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored.
1 rule found Severity: High
The DNS server implementation must protect the confidentiality and integrity of secret/private cryptographic keys at rest and the integrity of DNS information at rest.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The Juniper device must be configured to only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
1 rule found Severity: High
JBoss file permissions must be configured to protect the confidentiality and integrity of application files.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
1 rule found Severity: High
1 rule found Severity: Medium
The network device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
1 rule found Severity: High
1 rule found Severity: High
The Oracle Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
1 rule found Severity: High
The MySQL Database Server 8.0 must protect the confidentiality and integrity of all information at rest.
1 rule found Severity: High
Automation Controller must implement cryptography mechanisms to protect the integrity of information.
1 rule found Severity: High
1 rule found Severity: High
All SLEM 5 persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
1 rule found Severity: High
All TOSS local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: Medium
Information at rest must be encrypted using a DoD-accepted algorithm to protect the confidentiality and integrity of the information.
1 rule found Severity: Medium
1 rule found Severity: High
AAA Services must be configured to protect the confidentiality and integrity of all information at rest.
1 rule found Severity: High
Apple iOS/iPadOS 18 must require a valid password be successfully entered before the mobile device data is unencrypted.
1 rule found Severity: High
1 rule found Severity: Low
1 rule found Severity: Medium
The application server must employ cryptographic mechanisms to ensure confidentiality and integrity of all information at rest when stored off-line.
1 rule found Severity: Medium
The application must protect the confidentiality and integrity of stored information when required by DoD policy or the information owner.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest.
1 rule found Severity: Medium
AlmaLinux OS 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: High
1 rule found Severity: High
Dragos must use FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of application configuration files and user-generated data stored or aggregated on the device.
1 rule found Severity: Medium
Forescout must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
1 rule found Severity: High
1 rule found Severity: Medium
ACF2 SECVOLS GSO record value must be set to VOLMASK(). Any local changes are justified and documented with the ISSO.
1 rule found Severity: Medium
ACF2 RESVOLS GSO record value must be set to Volmask(-). Any other setting requires documentation justifying the change.
1 rule found Severity: Medium
The IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.
2 rules found Severity: High
The IBM z/OS systems requiring data-at-rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
Office applications must be configured to specify encryption type in password-protected Office 97-2003 files.
1 rule found Severity: Medium
Office applications must be configured to specify encryption type in password-protected Office Open XML files.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
1 rule found Severity: Medium
The Certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server.
1 rule found Severity: Medium
1 rule found Severity: High
The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
1 rule found Severity: High
1 rule found Severity: High
Windows 10 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.
1 rule found Severity: High
Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
1 rule found Severity: High
Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
1 rule found Severity: High
The DBMS must take needed steps to protect data at rest and ensure confidentiality and integrity of application data.
1 rule found Severity: High
All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
1 rule found Severity: High
All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: High
RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: High
All SUSE operating system persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
1 rule found Severity: High
All SUSE operating system persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
1 rule found Severity: High
2 rules found Severity: Low
The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
1 rule found Severity: High
1 rule found Severity: Medium