VCSA-70-000009 - The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.

CAT|I

CCI|CCI-000068

CCI|CCI-000382

CCI|CCI-001184

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002450

Rule-ID|SV-256318r919041_rule

STIG-ID|VCSA-70-000009

Vuln-ID|V-256318

VCSA-70-000023 - The vCenter Server must enforce the limit of three consecutive invalid login attempts by a user.

CAT|II

CCI|CCI-000044

Rule-ID|SV-256319r885568_rule

STIG-ID|VCSA-70-000023

Vuln-ID|V-256319

VCSA-70-000024 - The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before login.

CCI|CCI-000048

CCI|CCI-000050

CCI|CCI-001384

Rule-ID|SV-256320r885571_rule

STIG-ID|VCSA-70-000024

Vuln-ID|V-256320

VCSA-70-000034 - The vCenter Server must produce audit records containing information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-256321r885574_rule

STIG-ID|VCSA-70-000034

Vuln-ID|V-256321

VCSA-70-000057 - vCenter Server plugins must be verified.

CCI|CCI-000381

Rule-ID|SV-256322r885577_rule

STIG-ID|VCSA-70-000057

Vuln-ID|V-256322

VCSA-70-000059 - The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

CCI|CCI-000764

CCI|CCI-000770

CCI|CCI-000795

CCI|CCI-000804

CCI|CCI-001682

Rule-ID|SV-256323r885580_rule

STIG-ID|VCSA-70-000059

Vuln-ID|V-256323

VCSA-70-000060 - The vCenter Server must require multifactor authentication.

CCI|CCI-000166

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-001953

CCI|CCI-002009

Rule-ID|SV-256324r885583_rule

STIG-ID|VCSA-70-000060

Vuln-ID|V-256324

VCSA-70-000069 - The vCenter Server passwords must be at least 15 characters in length.

CCI|CCI-000205

Rule-ID|SV-256325r885586_rule

STIG-ID|VCSA-70-000069

Vuln-ID|V-256325

VCSA-70-000070 - The vCenter Server must prohibit password reuse for a minimum of five generations.

CCI|CCI-000200

Rule-ID|SV-256326r885589_rule

STIG-ID|VCSA-70-000070

Vuln-ID|V-256326

VCSA-70-000071 - The vCenter Server passwords must contain at least one uppercase character.

CCI|CCI-000192

Rule-ID|SV-256327r885592_rule

STIG-ID|VCSA-70-000071

Vuln-ID|V-256327

VCSA-70-000072 - The vCenter Server passwords must contain at least one lowercase character.

CCI|CCI-000193

Rule-ID|SV-256328r885595_rule

STIG-ID|VCSA-70-000072

Vuln-ID|V-256328

VCSA-70-000073 - The vCenter Server passwords must contain at least one numeric character.

CCI|CCI-000194

Rule-ID|SV-256329r885598_rule

STIG-ID|VCSA-70-000073

Vuln-ID|V-256329

VCSA-70-000074 - The vCenter Server passwords must contain at least one special character.

CCI|CCI-001619

Rule-ID|SV-256330r885601_rule

STIG-ID|VCSA-70-000074

Vuln-ID|V-256330

VCSA-70-000077 - The vCenter Server must enable FIPS-validated cryptography.

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-001188

CCI|CCI-001199

CCI|CCI-001967

CCI|CCI-003123

Rule-ID|SV-256331r885604_rule

STIG-ID|VCSA-70-000077

Vuln-ID|V-256331

VCSA-70-000079 - The vCenter Server must enforce a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-256332r885607_rule

STIG-ID|VCSA-70-000079

Vuln-ID|V-256332

VCSA-70-000080 - The vCenter Server must enable revocation checking for certificate-based authentication.

CCI|CCI-000185

CCI|CCI-001954

CCI|CCI-001991

CCI|CCI-002010

Rule-ID|SV-256333r919043_rule

STIG-ID|VCSA-70-000080

Vuln-ID|V-256333

VCSA-70-000089 - The vCenter Server must terminate vSphere Client sessions after 10 minutes of inactivity.

CCI|CCI-001133

CCI|CCI-002038

CCI|CCI-002361

Rule-ID|SV-256334r885613_rule

STIG-ID|VCSA-70-000089

Vuln-ID|V-256334

VCSA-70-000095 - The vCenter Server users must have the correct roles assigned.

CCI|CCI-001082

CCI|CCI-001084

CCI|CCI-001813

Rule-ID|SV-256335r885616_rule

STIG-ID|VCSA-70-000095

Vuln-ID|V-256335

VCSA-70-000110 - The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

CCI|CCI-001095

Rule-ID|SV-256336r885619_rule

STIG-ID|VCSA-70-000110

Vuln-ID|V-256336

VCSA-70-000123 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

CCI|CCI-002132

Rule-ID|SV-256337r885622_rule

STIG-ID|VCSA-70-000123

Vuln-ID|V-256337

VCSA-70-000145 - The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

CCI|CCI-002238

Rule-ID|SV-256338r885625_rule

STIG-ID|VCSA-70-000145

Vuln-ID|V-256338

VCSA-70-000148 - The vCenter Server must be configured to send logs to a central log server.

CCI|CCI-001851

Rule-ID|SV-256339r885628_rule

STIG-ID|VCSA-70-000148

Vuln-ID|V-256339

VCSA-70-000150 - vCenter must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

CCI|CCI-000172

CCI|CCI-001744

CCI|CCI-001858

Rule-ID|SV-256340r885631_rule

STIG-ID|VCSA-70-000150

Vuln-ID|V-256340

VCSA-70-000158 - The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.

CCI|CCI-001891

Rule-ID|SV-256341r892804_rule

STIG-ID|VCSA-70-000158

Vuln-ID|V-256341

VCSA-70-000195 - The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.

CCI|CCI-002470

Rule-ID|SV-256342r885637_rule

STIG-ID|VCSA-70-000195

Vuln-ID|V-256342

VCSA-70-000248 - The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

CCI|CCI-000366

Rule-ID|SV-256343r885640_rule

STIG-ID|VCSA-70-000248

Vuln-ID|V-256343

VCSA-70-000253 - The vCenter server must enforce SNMPv3 security features where SNMP is required.

Rule-ID|SV-256344r885643_rule

STIG-ID|VCSA-70-000253

Vuln-ID|V-256344

VCSA-70-000265 - The vCenter server must disable SNMPv1/2 receivers.

Rule-ID|SV-256345r885646_rule

STIG-ID|VCSA-70-000265

Vuln-ID|V-256345

VCSA-70-000266 - The vCenter Server must require an administrator to unlock an account locked due to excessive login failures.

Rule-ID|SV-256346r885649_rule

STIG-ID|VCSA-70-000266

Vuln-ID|V-256346

VCSA-70-000267 - The vCenter Server must disable the distributed virtual switch health check.

CAT|III

Rule-ID|SV-256347r885652_rule

STIG-ID|VCSA-70-000267

Vuln-ID|V-256347

VCSA-70-000268 - The vCenter Server must set the distributed port group Forged Transmits policy to 'Reject' - Reject.

Rule-ID|SV-256348r885655_rule

STIG-ID|VCSA-70-000268

Vuln-ID|V-256348

VCSA-70-000269 - The vCenter Server must set the distributed port group Media Access Control (MAC) Address Change policy to 'Reject' - Reject.

Rule-ID|SV-256349r885658_rule

STIG-ID|VCSA-70-000269

Vuln-ID|V-256349

VCSA-70-000270 - The vCenter Server must set the distributed port group Promiscuous Mode policy to 'Reject' - Reject.

Rule-ID|SV-256350r885661_rule

STIG-ID|VCSA-70-000270

Vuln-ID|V-256350

VCSA-70-000271 - The vCenter Server must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-256351r885664_rule

Detections

Analytics

DISA STIG VMware vSphere 7.0 vCenter v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous