Capacity
CCI-003123
Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
18
Rule
Severity: Medium
Use Only FIPS 140-2 Validated Ciphers
17
Rule
Severity: Medium
Use Only FIPS 140-2 Validated MACs
9
Rule
Severity: High
Set kernel parameter 'crypto.fips_enabled' to 1
7
Rule
Severity: High
Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config
1
Rule
Severity: High
The A10 Networks ADC must not use SNMP Versions 1 or 2.
1
Rule
Severity: Medium
Arista Multilayer Switches used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
2
Rule
Severity: High
The Arista network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
2
Rule
Severity: Medium
Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications.
3
Rule
Severity: Medium
Applications used for nonlocal maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
1
Rule
Severity: High
FIPS mode must be enabled on all Docker Engine - Enterprise nodes.
1
Rule
Severity: High
The FortiGate device must implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
1
Rule
Severity: High
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
1
Rule
Severity: High
The HYCU server must use FIPS-validated algorithms for authentication to a cryptographic module and Keyed-Hash Message Authentication Code (HMAC) to protect the integrity and confidentiality of remote maintenance sessions.
1
Rule
Severity: Medium
Applications used for nonlocal maintenance sessions using the MQ Appliance WebGUI must implement cryptographic mechanisms to protect the confidentiality and integrity of nonlocal maintenance and diagnostic communications.
1
Rule
Severity: High
The Ivanti MobileIron Core server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
1
Rule
Severity: High
MobileIron Sentry must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
2
Rule
Severity: Medium
The ISEC7 EMM Suite must use a FIPS-validated cryptographic module to provision digital signatures.
2
Rule
Severity: High
The Juniper router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.
2
Rule
Severity: High
For nonlocal maintenance sessions using SNMP, the Juniper SRX Services Gateway must securely configure SNMPv3 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
2
Rule
Severity: Medium
For nonlocal maintenance sessions using SSH, the Juniper SRX Services Gateway must securely configured SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
2
Rule
Severity: Medium
For nonlocal maintenance sessions, the Juniper SRX Services Gateway must ensure only zones where management functionality is desired have host-inbound-traffic system-services configured.
2
Rule
Severity: Medium
Mainframe Products must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
1
Rule
Severity: High
The SCOM Web Console must be configured for HTTPS.
2
Rule
Severity: High
ONTAP must be configured to implement cryptographic mechanisms using FIPS 140-2.
2
Rule
Severity: High
The network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions
1
Rule
Severity: High
Nutanix AOS must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
2
Rule
Severity: High
The Riverbed NetProfiler must be configured to implement cryptographic mechanisms using a FIPS 140-2/140-3 validated algorithm to protect the confidentiality and integrity of all cryptographic functions.
1
Rule
Severity: High
The SEL-2740S must be adopted by OTSDN Controllers for secure communication identifiers and initial trust for configuration of remote maintenance and diagnostic communications.
1
Rule
Severity: High
The Symantec ProxySG Web Management Console and SSH sessions must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
2
Rule
Severity: High
The TippingPoint TPS must have FIPS mode enforced.
2
Rule
Severity: High
The UEM server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
3
Rule
Severity: High
The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.
3
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH server configuration.
3
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH server configuration.
1
Rule
Severity: High
The macOS system must disable the SSHD service.
1
Rule
Severity: High
The macOS system must implement approved ciphers to protect the confidentiality of SSH connections.
1
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs).
1
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms.
3
Rule
Severity: High
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
3
Rule
Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
3
Rule
Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
3
Rule
Severity: High
The macOS system must limit SSHD to FIPS-compliant connections.
1
Rule
Severity: Medium
The Ubuntu operating system must configure the SSH daemon to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms to protect the integrity of nonlocal maintenance and diagnostic communications.
2
Rule
Severity: Medium
The Ubuntu operating system must configure the SSH daemon to use FIPS 140-2 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
2
Rule
Severity: High
The Cisco ASA must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
6
Rule
Severity: High
The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.
6
Rule
Severity: High
The Cisco switch must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.
2
Rule
Severity: High
The Cisco ISE must be configured to implement cryptographic mechanisms using a FIPS 140-2 validated algorithm to protect the confidentiality of remote maintenance sessions.
2
Rule
Severity: Medium
The container platform must configure web management tools and Application Program Interfaces (API) with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
2
Rule
Severity: High
The operating system must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions.
2
Rule
Severity: Medium
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
2
Rule
Severity: High
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
2
Rule
Severity: Medium
AIX must protect the confidentiality and integrity of transmitted information during preparation for transmission and maintain the confidentiality and integrity of information during reception and disable all non-encryption network access methods.
4
Rule
Severity: Medium
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
2
Rule
Severity: Medium
IBM z/OS SSL encryption options for the TN3270 Telnet server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
1
Rule
Severity: High
The ICS must be configured to implement cryptographic mechanisms using a FIPS 140-2/3 approved algorithm.
2
Rule
Severity: Medium
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
2
Rule
Severity: High
The Juniper EX switch must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
4
Rule
Severity: High
The network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
4
Rule
Severity: Medium
The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
6
Rule
Severity: Medium
The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
2
Rule
Severity: Medium
Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic.
2
Rule
Severity: Medium
Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
2
Rule
Severity: Medium
Windows Server 2022 Windows Remote Management (WinRM) client must not allow unencrypted traffic.
2
Rule
Severity: Medium
Windows Server 2022 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
2
Rule
Severity: High
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
2
Rule
Severity: Medium
The Oracle Linux 7 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
2
Rule
Severity: High
The Palo Alto Networks security platform must not use SNMP Versions 1 or 2.
2
Rule
Severity: High
OpenShift must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 validated cryptography.
4
Rule
Severity: Medium
The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
2
Rule
Severity: Medium
RHEL 9 must have the crypto-policies package installed.
2
Rule
Severity: Medium
RHEL 9 crypto policy must not be overridden.
1
Rule
Severity: Medium
RHEL 9 must implement a system-wide encryption policy.
1
Rule
Severity: Low
The Photon operating system must configure sshd to use FIPS 140-2 ciphers.
4
Rule
Severity: High
The vCenter Server must enable FIPS-validated cryptography.
3
Rule
Severity: High
The Photon operating system must have the OpenSSL FIPS provider installed to protect the confidentiality of remote access sessions.
1
Rule
Severity: Medium
Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
1
Rule
Severity: Medium
The ISEC7 SPHERE must use a FIPS-validated cryptographic module to provision digital signatures.
1
Rule
Severity: High
The Ivanti EPMM server must configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
1
Rule
Severity: High
Sentry must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
1
Rule
Severity: High
FIPS mode must be enabled.
1
Rule
Severity: Medium
RHEL 9 must implement a systemwide encryption policy.
1
Rule
Severity: High
SLEM 5 SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2/140-3 approved cryptographic hash algorithms.
1
Rule
Severity: Medium
The TOSS operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules