OpenControls Logo

STIG Viewer

STIGViewer Support

The DNS server implementation must, when a component failure is detected, activate a notification to the system administrator.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279967SRG-APP-000474-DNS-000039SV-279967r1157010_ruleCCI-002702medium
Description
Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining systems security fail to function, the system could continue operating in an insecure state. The organization must be prepared and the application must support requirements that specify if the application must alarm for such conditions and/or automatically shut down the application or the system. This can include conducting a graceful application shutdown to avoid losing information. Automatic or manual transfer of components from standby to active mode can occur, for example, upon detection of component failures. If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fail, the DNS server should shut itself down to prevent continued execution without the necessary security components in place. Transactions such as zone transfers would not be able to work correctly anyway in this state.
STIGDate
Domain Name System (DNS) Security Requirements Guide2025-12-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-06Control Functionality Verification
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (16) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
AU-12Audit Record Generation
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(2)Real-time Alerts
1.00
AU-6(4)Central Review and Analysis
1.00
AU-7Audit Record Reduction and Report Generation
1.00
AU-7(1)Automatic Processing
1.00
AU-9Protection of Audit Information
1.00

+6 more (top 10 by confidence shown)

CCI1 mapping
CCI-002702
1.00

Details

Check Text (C-279967r1157010_chk)

Review the DNS server implementation configuration to determine if the DNS server activates a notification to the system administrator when a component failure is detected. If the DNS server does not activate a notification to the system administrator when a failure is detected, this is a finding.

Fix Text (F-84433r1157009_fix)

Configure the DNS server so that when a component failure is detected, the server activates a notification to the system administrator.