OpenControls Logo

STIG Viewer

STIGViewer Support

The Omnissa WS1 UEM server must be configured to require a One-Time Password (OTP) or Short Message Service (SMS) two-factor authentication for local accounts.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-284284OMW1-00-004020SV-284284r1224027_ruleCCI-000765medium
Description
DoW sites may implement one "break-glass" WS1 UEM local account for the purpose of server recovery. This account must use two-factor authentication to provide secure access control. At the current time, WS1 UEM only supports OTP or SMS based authentication as the second authentication factor.
STIGDate
Omnissa WS1 UEM Server Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-06Multi-Factor Authentication (MFA)
0.50
IAC-06.1Network Access to Privileged Accounts
0.50
IAC-06.2Network Access to Non-Privileged Accounts
0.50
IAC-06.3Local Access to Privileged Accounts
0.50
IAC-06.4Out-of-Band Multi-Factor Authentication
0.50
IAC-10.7Hardware Token-Based Authentication
0.50
TDA-02.2Information Assurance Enabled Products
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (67) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00

+57 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.3
1.00
CCI1 mapping
CCI-000765
1.00

Details

Check Text (C-284284r1224027_chk)

Authenticate to the Workspace ONE UEM console as an administrator. 1. Navigate to Accounts >> Administrators >> List View. 2. For each account with an "Admin Type" of "Basic", click the three vertical dots next to the account name and select "Edit". 3. Click "Next" three times to reach the "Settings" page. If "Two Factor Authentication" is not enabled, this is a finding. If the account has the "Read Only" role and is used for automation such as compliance scanning, this is not applicable to that account.

Fix Text (F-88753r1211903_fix)

Authenticate to the Workspace ONE UEM console as an administrator. 1. Navigate to Accounts >> Administrators >> List View. 2. For each account with an "Admin Type" of "Basic", click the three vertical dots next to the account name and select "Edit". 3. Click "Next" three times to reach the "Settings" page. 4. Enable "Two Factor Authentication" and configure either email or SMS notification. 5. Click "Save". Note: The OTP code will be sent to the email or mobile phone configured on the previous pages. Ensure they are configured correctly. Note: The only authorized local account is the "break-glass" account.