AC-17(02) Protection of Confidentiality and Integrity Using Encryption

STIG rules that implement this control 50

Apple iOS/iPadOS 26 V1R3

• AIOS-26-001000 CAT III Apple iOS/iPadOS 26 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis].

Apple macOS 15 (Sequoia) V1R8

• APPL-15-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
• APPL-15-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.

Apple macOS 26 (Tahoe) V1R4

• APPL-26-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
• APPL-26-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.

Application Security and Development V6R5

• APSC-DV-000160 CAT II The application must implement DoW-approved encryption to protect the confidentiality of remote access sessions.
• APSC-DV-000170 CAT II The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.
• APSC-DV-000180 CAT II Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.
• APSC-DV-000190 CAT I Messages protected with WS_Security must use time stamps with creation and expiration times.
• APSC-DV-000200 CAT I Validity periods must be verified on all application messages using WS-Security or SAML assertions.
• APSC-DV-000210 CAT II The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.
• APSC-DV-000220 CAT II The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.
• APSC-DV-000230 CAT I The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion.
• APSC-DV-000240 CAT I The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion.
• APSC-DV-000250 CAT II The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.
• APSC-DV-000260 CAT II The application must ensure messages are encrypted when the SessionIndex is tied to privacy data.

Canonical Ubuntu 22.04 LTS V2R10

• UBTU-22-255050 CAT II Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
• UBTU-22-255055 CAT II Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
• UBTU-22-255060 CAT II Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms.

Canonical Ubuntu 24.04 LTS V1R7

• UBTU-24-100820 CAT II Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
• UBTU-24-100830 CAT II Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
• UBTU-24-100840 CAT II Ubuntu 24.04 LTS SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.
• UBTU-24-100850 CAT II Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
• UBTU-24-100860 CAT II Ubuntu 24.04 LTS SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.

Cisco IOS XE Router NDM Y26M04

• CISC-ND-001140 CAT II The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm.

Microsoft Windows 11 V2R11

• WN11-CC-000285 CAT II The Remote Desktop Session Host must require secure RPC communications.
• WN11-CC-000290 CAT II Remote Desktop Services must be configured with the client connection encryption set to the required level.

Microsoft Windows Server 2022 V2R11

• WN22-CC-000370 CAT II Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
• WN22-CC-000380 CAT II Windows Server 2022 Remote Desktop Services must be configured with the client connection encryption set to High Level.

Microsoft Windows Server 2025 V1R4

• WN25-CC-000370 CAT II Windows Server 2025 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
• WN25-CC-000380 CAT II Windows Server 2025 Remote Desktop Services must be configured with the client connection encryption set to High Level.
• WN25-SH-000050 CAT II Windows Server 2025 OpenSSH must force a frequent session key renegotiation for SSH connections to the server.

Mozilla Firefox V6R9

• FFOX-00-000002 CAT I Firefox must be configured to allow only TLS 1.2 or above.

Red Hat Enterprise Linux 10 V1R3

• RHEL-10-000500 CAT I RHEL 10 must enable FIPS mode.
• RHEL-10-300010 CAT I RHEL 10 must implement a FIPS 140-3-compliant systemwide cryptographic policy.
• RHEL-10-300030 CAT I RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
• RHEL-10-300040 CAT I RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
• RHEL-10-300050 CAT I RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
• RHEL-10-300060 CAT I RHEL 10 must be configured so that Secure Shell (SSH) servers use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
• RHEL-10-300070 CAT I RHEL 10 must use FIPS 140-3-approved cryptographic algorithms for IP tunnels.
• RHEL-10-300085 CAT I RHEL 10 must implement DoW-approved encryption in the OpenSSL package.
• RHEL-10-700650 CAT I RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.

Red Hat Enterprise Linux 9 V2R10

• RHEL-09-255064 CAT I The RHEL 9 SSH client must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
• RHEL-09-255065 CAT I The RHEL 9 SSH server must be configured to use only DoW-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
• RHEL-09-255070 CAT I The RHEL 9 SSH client must be configured to use only DoW-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
• RHEL-09-255075 CAT I The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
• RHEL-09-255090 CAT II RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
• RHEL-09-671010 CAT I RHEL 9 must enable FIPS mode.
• RHEL-09-671020 CAT I RHEL 9 IP tunnels must use FIPS 140-3 approved cryptographic algorithms.
• RHEL-09-672055 CAT I RHEL 9 must implement DoW-approved encryption in the OpenSSL package.