The VPN Gateway must establish organization-defined alternate communications paths for system operations organizational command and control.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-264330	SRG-NET-000760-VPN-000160	SV-264330r984319_rule		Medium

Description
An incident, whether adversarial- or nonadversarial-based, can disrupt established communications paths used for system operations and organizational command and control. Alternate communications paths reduce the risk of all communications paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or to provide timely direction to operational elements after a communications path incident, can impact the ability of the organization to respond to such incidents in a timely manner. Establishing alternate communications paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization's ability to continue to operate and take appropriate actions during an incident.

Description

An incident, whether adversarial- or nonadversarial-based, can disrupt established communications paths used for system operations and organizational command and control. Alternate communications paths reduce the risk of all communications paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or to provide timely direction to operational elements after a communications path incident, can impact the ability of the organization to respond to such incidents in a timely manner. Establishing alternate communications paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization's ability to continue to operate and take appropriate actions during an incident.

STIG	Date
Virtual Private Network (VPN) Security Requirements Guide	2024-07-02

Details

Check Text ( C-68243r984317_chk )
Verify the VPN Gateway is configured to establish organization-defined alternate communications paths for system operations organizational command and control. If the VPN Gateway is not configured to establish organization-defined alternate communications paths for system operations organizational command and control, this is a finding.

Fix Text (F-68151r984318_fix)
Configure the VPN Gateway to establish organization-defined alternate communications paths for system operations organizational command and control.