Access to need-to-know information must be restricted to an authorized community of interest.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-243481 | AD.0170 | SV-243481r959010_rule | CCI-000366 | medium |
| Description | ||||
| Because trust relationships effectively eliminate a level of authentication in the trusting domain or forest, they represent less stringent access control at the domain or forest level in which the resource resides. To mitigate this risk, trust relationships must be documented so that they can be readily verified during periodic inspections designed to validate only approved trusts are configured in AD. | ||||
| STIG | Date | |||
| Active Directory Domain Security Technical Implementation Guide | 2024-09-13 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-243481r959010_chk)
1. Before performing this check, perform V-243494, which validates the trusts within the documentation are current within AD.
2. Obtain documentation of the site's approved trusts from the site representative.
3. For each of the identified trusts, verify the documentation includes a justification or explanation of the need-to-know basis of the trust.
4. If the need for the trust is not documented, this is a finding.
Fix Text (F-46713r890558_fix)
Delete the unneeded trust relationship or document the access requirement or mission need for the trust.