Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The network device must enforce a two-person rule for changes to organizationally defined information system components and system-level information.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-NET-000122-NDM-000080 | SRG-NET-000122-NDM-000080 | SRG-NET-000122-NDM-000080_rule | Medium |
| Description |
|---|
| Changes to any software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the network device for implementing any changes or upgrades to system components. Enforcing a two-person rule will ensure the changes have been approved. |
| STIG | Date |
|---|---|
| Network Device Management Security Requirements Guide | 2013-07-30 |
Details
| Check Text ( C-SRG-NET-000122-NDM-000080_chk ) |
|---|
| If the two-person rule is not required, this is not applicable. Review the configuration to verify the settings required to implement two-person rule are enabled. If the two-person rule is required and the network device has not been configured to automate the requirement, this is a finding. |
| Fix Text (F-SRG-NET-000122-NDM-000080_fix) |
|---|
| Configure the network device to require two-person rule for organizationally defined privileged commands. |