Dragos Platform must accept the DOD CAC or other PKI credential for identity management and personal authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-271034	DRAG-OT-001750	SV-271034r1057745_rule	CCI-002009	medium
Description
The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials. Satisfies: SRG-APP-000402, SRG-APP-000403, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403, SRG-APP-000177, SRG-APP-000176, SRG-APP-000175, SRG-APP-000401
STIG			Date
Dragos Platform 2.x Security Technical Implementation Guide			2025-05-15

Related Frameworks

8 mappings across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-03.1Acceptance of PIV Credentials from Other Organizations

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

IAC-10.2PKI-Based Authentication

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

IAC-02.3Acceptance of PIV Credentials

0.50

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (83) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-11Device Lock

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-11(1)Pattern-hiding Displays

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12Session Termination

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(10)Authenticate Remote Commands

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(2)Protection of Confidentiality and Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(1)Automated System Account Management

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(11)Usage Conditions

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(2)Automated Temporary and Emergency Account Management

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+73 more (top 10 by confidence shown)

CCI8 mappings

CCI-000185

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-000186

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-000187

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-001953

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-001954

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-001991

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-002009

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

CCI-002010

1.00

DISA STIG Benchmark (XCCDF)1intersects(normalised)

Details

Check Text (C-271034r1057745_chk)

Verify that Dragos is configured to use the DOD CAC or other PKI credential to log in to the application. Log in to the application. If DOD CAC or other PKI is not configured, this is a finding.

Fix Text (F-74978r1057744_fix)

Configure an SSO proxy service using LDAP to provide PKI credentials.