APSC-DV-002970 The ISSO must ensure if a DoW STIG or NSA guide is not available, a third-party product will be configured by following available guidance.
All changes in this version
Maps to CM-6 via CCI-000363
Title
The ISSO must ensure if a DoW STIG or NSA guide is not available, a third-party product will be configured by following available guidance.
Control
Review the application documentation to identify application name, features and version. Identify if a DoW STIG or NSA guide is available. If no STIG is available for the product, the application and application components must be configured by the following as available: - commercially accepted practices, - independent testing results, or - vendor literature and lock down guides. If the application and application components do not have DoW STIG or NSA guidance available and are not configured according to: commercially accepted practices, independent testing results, or vendor literature and lock down guides, this is a finding.
Discussion
Not all COTS products are covered by a STIG. Those products not covered by a STIG, should follow commercially accepted best practices, independent testing results and vendors lock down guides and recommendations if they are available.
Related controls
CCI-000363
Fix
Configure the application according to the product STIG or when a STIG is not available, utilize: - commercially accepted practices, - independent testing results, or - vendor literature and lock down guides.