The Voice Video Endpoint used for videoconferencing must electronically verify the Common Access Card (CAC) or derived credentials.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66745	SRG-NET-000342-VVEP-00031	SV-81235r1_rule		Medium

Description
The use of CAC or derived credentials facilitates standardization and reduces the risk of unauthorized access. DoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.

STIG	Date
Voice Video Endpoint Security Requirements Guide	2019-03-15

Details

Check Text ( C-67395r1_chk )
If the Voice Video Endpoint is a hardware endpoint, this check procedure is Not Applicable. Verify the Voice Video Endpoint used for videoconferencing electronically verifies the CAC or derived credentials. For hardware endpoints, the devices must use certificates to register with the session manager or multipoint controller. If the Voice Video Endpoint used for videoconferencing does not electronically verify the CAC or derived credentials, this is a finding.

Check Text ( C-67395r1_chk )

If the Voice Video Endpoint is a hardware endpoint, this check procedure is Not Applicable.

Verify the Voice Video Endpoint used for videoconferencing electronically verifies the CAC or derived credentials. For hardware endpoints, the devices must use certificates to register with the session manager or multipoint controller.

If the Voice Video Endpoint used for videoconferencing does not electronically verify the CAC or derived credentials, this is a finding.

Fix Text (F-72845r1_fix)
Configure the Voice Video Endpoint used for videoconferencing to electronically verify the CAC or derived credentials.