OpenControls Logo

STIG Viewer

STIGViewer Support

A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-218749IIST-SI-000220SV-218749r1210386_ruleCCI-000197medium
Description
A DOD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites. Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186
STIGDate
Microsoft IIS 10.0 Site Security Technical Implementation Guide2026-05-23

Related Frameworks

3 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-11Certificate Authorities
1.00
NET-09.2Unique System-Generated Session Identifiers
1.00
IAC-10Authenticator Management
0.50
IAC-10.1Password-Based Authentication
0.50
IAC-10.4Automated Support For Password Strength
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (71) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00

+61 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.10
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI3 mappings
CCI-000197
1.00
CCI-001188
1.00
CCI-002470
1.00

Details

Check Text (C-218749r1210386_chk)

Note: If any of the following is true, this requirement is Not Applicable: - Authentication is offloaded to an external enterprise authentication mechanism that is performing certificate handling. - The server being reviewed is a public IIS 10.0 web server. - The server being reviewed is hosting SharePoint. - The server being reviewed is hosting WSUS. - Certificate handling is performed at the Proxy/Load Balancer. - The server being reviewed is hosting Simple Certificate Enrollment Services (SCEP). - The server being reviewed is hosting Network Device Enrollment Services (NDES). - The server is providing OCSP and not otherwise hosting any content. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. If the "Clients Certificate Required" check box is not selected, this is a finding.

Fix Text (F-20220r1111804_fix)

Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. Select "Apply" from the "Actions" pane.