OpenControls Logo

STIG Viewer

STIGViewer Support

Signature generation using the KSK must be done off-line, using the KSK-private stored off-line.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-205174SRG-APP-000176-DNS-000096SV-205174r961041_ruleCCI-000186medium
Description
Security-relevant information is any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data. Security-relevant information includes, for example, file permissions, cryptographic key management information, configuration parameters for security services, and access control lists. Secure, non-operable system states include the times in which information systems are not performing mission/business-related processing (e.g., the system is off-line for maintenance, troubleshooting, boot-up, and shut down).
STIGDate
Domain Name System (DNS) Security Requirements Guide2025-12-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (55) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+45 more (top 10 by confidence shown)

CCI1 mapping
CCI-000186
1.00

Details

Check Text (C-205174r961041_chk)

Verify the DNS operational procedures and confirm procedures exist to enforce generating signatures using the KSK are performed off-line, using the KSK-private stored off-line or the secure, protected module. If the procedures do not exist or the procedures do not specify to perform the signature generation off-line from the name server, this is a finding.

Fix Text (F-5441r392439_fix)

Create operation documentation to include the safe management of keys and key storage within the DNS implementation. Include in the documentation steps to ensure signature generation using the KSK are done off-line, using the KSK-private stored off-line or the secure, protected module.