The operating system, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-203734	SRG-OS-000384-GPOS-00167	SV-203734r982217_rule	CCI-004068	medium
Description
Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).
STIG			Date
General Purpose Operating System Security Requirements Guide			2024-12-04

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (59) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(10)Authenticate Remote Commands

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(1)Automated System Account Management

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V2R6our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(11)Usage Conditions

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(2)Automated Temporary and Emergency Account Management

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(3)Disable Accounts

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-2(4)Automated Audit Actions

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3(4)Discretionary Access Control

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+49 more (top 10 by confidence shown)

CCI1 mapping

CCI-004068

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)

Details

Check Text (C-203734r982217_chk)

Verify the operating system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network. If it does not, this is a finding.

Fix Text (F-3859r375267_fix)

Configure the operating system, for PKI-based authentication, to implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.