VCSA-80-000009 The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.

CAT|II

CCI|CCI-000068

CCI|CCI-000382

CCI|CCI-001184

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002450

Rule-ID|SV-265978r1003613_rule

STIG-ID|VCSA-80-000009

Vuln-ID|V-265978

VCSA-80-000023 The vCenter Server must enforce the limit of three consecutive invalid login attempts by a user.

CCI|CCI-000044

Rule-ID|SV-258905r960840_rule

STIG-ID|VCSA-80-000023

Vuln-ID|V-258905

VCSA-80-000024 The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before logon.

CCI|CCI-000048

CCI|CCI-000050

CCI|CCI-001384

Rule-ID|SV-258906r960843_rule

STIG-ID|VCSA-80-000024

Vuln-ID|V-258906

VCSA-80-000034 The vCenter Server must produce audit records containing information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-258907r960891_rule

STIG-ID|VCSA-80-000034

Vuln-ID|V-258907

VCSA-80-000057 vCenter Server plugins must be verified.

CCI|CCI-000381

Rule-ID|SV-258908r960963_rule

STIG-ID|VCSA-80-000057

Vuln-ID|V-258908

VCSA-80-000059 The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

CCI|CCI-000764

CCI|CCI-000804

CCI|CCI-001682

CCI|CCI-003627

CCI|CCI-004045

Rule-ID|SV-258909r1003590_rule

STIG-ID|VCSA-80-000059

Vuln-ID|V-258909

VCSA-80-000060 The vCenter Server must require multifactor authentication.

CCI|CCI-000166

CCI|CCI-000765

CCI|CCI-000766

CCI|CCI-001953

CCI|CCI-002009

Rule-ID|SV-258910r960864_rule

STIG-ID|VCSA-80-000060

Vuln-ID|V-258910

VCSA-80-000069 The vCenter Server passwords must be at least 15 characters in length.

CCI|CCI-004066

Rule-ID|SV-258911r1003591_rule

STIG-ID|VCSA-80-000069

Vuln-ID|V-258911

VCSA-80-000070 The vCenter Server must prohibit password reuse for a minimum of five generations.

CCI|CCI-004061

Rule-ID|SV-258912r1003592_rule

STIG-ID|VCSA-80-000070

Vuln-ID|V-258912

VCSA-80-000071 The vCenter Server passwords must contain at least one uppercase character.

Rule-ID|SV-258913r1003593_rule

STIG-ID|VCSA-80-000071

Vuln-ID|V-258913

VCSA-80-000072 The vCenter Server passwords must contain at least one lowercase character.

Rule-ID|SV-258914r1003594_rule

STIG-ID|VCSA-80-000072

Vuln-ID|V-258914

VCSA-80-000073 The vCenter Server passwords must contain at least one numeric character.

Rule-ID|SV-258915r1003595_rule

STIG-ID|VCSA-80-000073

Vuln-ID|V-258915

VCSA-80-000074 The vCenter Server passwords must contain at least one special character.

Rule-ID|SV-258916r1003596_rule

STIG-ID|VCSA-80-000074

Vuln-ID|V-258916

VCSA-80-000077 The vCenter Server must enable FIPS-validated cryptography.

CAT|I

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-001188

CCI|CCI-001199

CCI|CCI-001967

CCI|CCI-003123

Rule-ID|SV-258917r961029_rule

STIG-ID|VCSA-80-000077

Vuln-ID|V-258917

VCSA-80-000079 The vCenter Server must enforce a 90-day maximum password lifetime restriction.

Rule-ID|SV-258918r1003597_rule

STIG-ID|VCSA-80-000079

Vuln-ID|V-258918

VCSA-80-000080 The vCenter Server must enable revocation checking for certificate-based authentication.

CCI|CCI-000185

CCI|CCI-001954

CCI|CCI-002010

CCI|CCI-004068

Rule-ID|SV-258919r1003600_rule

STIG-ID|VCSA-80-000080

Vuln-ID|V-258919

VCSA-80-000089 The vCenter Server must terminate vSphere Client sessions after 15 minutes of inactivity.

CCI|CCI-001133

CCI|CCI-002361

CCI|CCI-004895

Rule-ID|SV-258920r1003601_rule

STIG-ID|VCSA-80-000089

Vuln-ID|V-258920

VCSA-80-000095 The vCenter Server user roles must be verified.

CCI|CCI-001082

CCI|CCI-001084

CCI|CCI-001813

Rule-ID|SV-258921r961095_rule

STIG-ID|VCSA-80-000095

Vuln-ID|V-258921

VCSA-80-000110 The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

CCI|CCI-001095

Rule-ID|SV-258922r961155_rule

STIG-ID|VCSA-80-000110

Vuln-ID|V-258922

VCSA-80-000123 The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

CCI|CCI-000015

Rule-ID|SV-258923r1003602_rule

STIG-ID|VCSA-80-000123

Vuln-ID|V-258923

VCSA-80-000145 The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

CCI|CCI-002238

Rule-ID|SV-258924r961368_rule

STIG-ID|VCSA-80-000145

Vuln-ID|V-258924

VCSA-80-000148 The vCenter Server must be configured to send logs to a central log server.

CCI|CCI-001851

Rule-ID|SV-258925r961395_rule

STIG-ID|VCSA-80-000148

Vuln-ID|V-258925

VCSA-80-000150 The vCenter server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

CCI|CCI-000172

CCI|CCI-001744

CCI|CCI-001858

Rule-ID|SV-258926r961401_rule

STIG-ID|VCSA-80-000150

Vuln-ID|V-258926

VCSA-80-000158 The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.

CCI|CCI-004923

Rule-ID|SV-258927r1003604_rule

STIG-ID|VCSA-80-000158

Vuln-ID|V-258927

VCSA-80-000195 The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.

CCI|CCI-002470

Rule-ID|SV-258928r961596_rule

STIG-ID|VCSA-80-000195

Vuln-ID|V-258928

VCSA-80-000196 The vCenter Server must enable data at rest encryption for vSAN.

CCI|CCI-002475

Rule-ID|SV-258929r961599_rule

STIG-ID|VCSA-80-000196

Vuln-ID|V-258929

VCSA-80-000248 The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

CCI|CCI-000366

Rule-ID|SV-258930r961863_rule

STIG-ID|VCSA-80-000248

Vuln-ID|V-258930

VCSA-80-000253 The vCenter server must enforce SNMPv3 security features where SNMP is required.

Rule-ID|SV-258931r961878_rule

STIG-ID|VCSA-80-000253

Vuln-ID|V-258931

VCSA-80-000265 The vCenter server must disable SNMPv1/2 receivers.

Rule-ID|SV-258932r961878_rule

STIG-ID|VCSA-80-000265

Vuln-ID|V-258932

VCSA-80-000266 The vCenter Server must require an administrator to unlock an account locked due to excessive login failures.

Rule-ID|SV-258933r961368_rule

STIG-ID|VCSA-80-000266

Vuln-ID|V-258933

VCSA-80-000267 The vCenter Server must disable the distributed virtual switch health check.

Rule-ID|SV-258934r961863_rule

STIG-ID|VCSA-80-000267

Vuln-ID|V-258934

VCSA-80-000268 The vCenter Server must set the distributed port group Forged Transmits policy to "Reject".

Rule-ID|SV-258935r961863_rule

STIG-ID|VCSA-80-000268

Vuln-ID|V-258935

VCSA-80-000269 The vCenter Server must set the distributed port group Media Access Control (MAC) Address Change policy to "Reject".

Rule-ID|SV-258936r961863_rule

STIG-ID|VCSA-80-000269

Vuln-ID|V-258936

VCSA-80-000270 The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".

Rule-ID|SV-258937r961863_rule

STIG-ID|VCSA-80-000270

Vuln-ID|V-258937

VCSA-80-000271 The vCenter Server must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-258938r961863_rule

STIG-ID|VCSA-80-000271

Vuln-ID|V-258938

VCSA-80-000272 The vCenter Server must configure all port groups to a value other than that of the native virtual local area network (VLAN).

Rule-ID|SV-258939r961863_rule

STIG-ID|VCSA-80-000272

Vuln-ID|V-258939

Detections

Analytics

DISA VMware vSphere 8.0 vCenter STIG v2r1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous