OpenControls Logo

STIG Viewer

STIGViewer Support

Individual user accounts with passwords must be maintained for the Hardware Management Console operating system and application.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-256877HMC0100SV-256877r958482_ruleCCI-000760medium
Description
Without identification and authentication, unauthorized users could reconfigure the Hardware Management Console or disrupt its operation by logging in to the system or application and execute unauthorized commands. The System Administrator will ensure individual user accounts with passwords are set up and maintained for the Hardware Management Console.
STIGDate
IBM Hardware Management Console (HMC) Security Technical Implementation Guide2024-06-24

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-05Contingency Plan Root Cause Analysis (RCA) & Lessons Learned
1.00
CPL-01Statutory, Regulatory & Contractual Compliance
1.00
CPL-02Security, Compliance & Resilience Controls Oversight
1.00
CPL-03Control Conformity Monitoring
1.00
CPL-03.2Functional Review Of Security, Compliance & Resilience Controls
1.00
GOV-01Security, Compliance & Resilience Program (SCRP)
1.00
GOV-01.1Steering Committee & Program Oversight
1.00
GOV-01.2Status Reporting To Governing Body
1.00
GOV-02Publishing Security, Compliance & Resilience Documentation
1.00
GOV-03Periodic Review & Update of Security, Compliance & Resilience Program
1.00

+24 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IA-1Policy and Procedures
1.00
CCI1 mapping
CCI-000760
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (16) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

GV.OC-03
1.00
GV.OV-01
1.00
GV.PO-01
1.00
GV.PO-02
1.00
GV.SC-03
1.00
ID.IM-01
1.00
ID.IM-02
1.00
ID.IM-03
1.00
PR.AAIdentity Management, Authentication, and Access Control
1.00
PR.AA-01
1.00

+6 more (top 10 by confidence shown)

Who does this work

22 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-256877r958482_chk)

Have the System Administrator prove that individual USER IDs are specified for each user and DD2875 are on file for each user. If USERIDs are shared among multiple users and crresponding DD2875 forms do not exist for each user, then this is a FINDING.

Fix Text (F-60495r890976_fix)

Have the System Administrator verify that all users of the Hardware Management Console are individually defined with USER IDs and passwords and that their roles and responsibilities are documented. Verify that a DD2875 exists for each USER ID.