OpenControls Logo

STIG Viewer

STIGViewer Support

Implementing Unified Capabilities (UC) soft clients as the primary voice endpoint must have authorizing official (AO) approval.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-259907SRG-VOIP-000270SV-259907r1173933_ruleCCI-003963medium
Description
The AO responsible for the implementation of a voice system that uses UC soft clients for its endpoints must be made aware of the risks and benefits. In addition, the commander of an organization whose mission depends on such a telephone system must also be made aware and provide approval. When UC soft clients are fielded as the primary endpoint, the risk of unavailability is high compared to dedicated instruments. Another major difficulty for UC soft clients deployed on laptops is providing accurate location information for emergency services. When emergency services are called from the laptop, if it is not at the location entered in the Automated Location Identification (ALI) database, emergency services may be dispatched to the wrong place.
STIGDate
Enterprise Voice, Video, and Messaging Policy Security Requirements Guide2025-12-23

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-02Asset Inventories
1.00
CFG-01Configuration Management Program
1.00
TPM-01.1Third-Party Inventories
1.00
AST-02.3Component Duplication Avoidance
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-8System Component Inventory
1.00
NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-003963
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

ID.AM-01
1.00
ID.AM-02
1.00
PR.PS-01
1.00
ID.AMAsset Management
0.50

Who does this work

10 NICE work roles and 8 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-259907r1173933_chk)

Verify the Command and AO approves the implementation or transition to UC soft clients as the primary endpoints in writing. Verify the ISSO maintains approval documentation for inspection by IA reviewers or auditors. Review the written Command and AO approval for the implementation of a telephone system that primarily uses UC soft client applications for its endpoints. If no written Command and AO approval exists for UC soft client endpoints, this is a finding.

Fix Text (F-63545r946641_fix)

Obtain the Command and AO approval for the implementation or transition to UC soft clients as the primary endpoints in writing. Approval documentation must be maintained by the ISSO for future inspection by IA reviewers or auditors. If Command and AO written approval is not available, hardware endpoints must be used as the primary endpoints. NOTE: This requirement is in addition to AO approval for deploying UC soft clients on DOD networks. When UC soft clients are deployed as the primary endpoint, additional risks to availability exist.