OpenControls Logo

STIG Viewer

STIGViewer Support

Nutanix OS must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279622NXAC-OS-000191SV-279622r1192573_ruleCCI-004910medium
Description
A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.
STIGDate
Nutanix Acropolis GPOS Security Technical Implementation Guide2026-02-24

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-09Cryptographic Key Management
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IA-5(1)Password-based Authentication
1.00
IA-5(2)Public Key-based Authentication
1.00
SC-17Public Key Infrastructure Certificates
1.00
SC-28Protection of Information at Rest
1.00
SC-28(1)Cryptographic Protection
1.00
SC-28(3)Cryptographic Keys
1.00
CCI1 mapping
CCI-004910
1.00

Details

Check Text (C-279622r1192573_chk)

Verify that the Nutanix OS hardware consists of a hardware TPM module installed and loaded using the following command. $ sudo lsmod | grep -i tpm tpm 77824 1 trusted rng_core 16384 1 tpm If no lines are returned or if the TPM does not indicate "trusted", this is a finding.

Fix Text (F-84080r1192572_fix)

Hardware TPM modules consist of a hardware chip that is built into the motherboard of the physical server. If no TPM module exists, then a new physical server is required. For AHV, if the TPM module exists but is not "trusted' then something has been modified within AHV and the system must be rebuilt from source to correct this issue.