OpenControls Logo

STIG Viewer

STIGViewer Support

The VPN Gateway must use Always On VPN connections for remote computing.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-264336SRG-NET-000230-VPN-002436SV-264336r1056131_ruleCCI-001184medium
Description
Allowing remote users to manually toggle a VPN connection can create critical security risks. With Always On VPN, if a secured connection to the gateway is lost, hybrid-working users will be disconnected from the internet until the issue is solved. "Always On" is a term that describes a VPN connection that is secure and always on after the initial connection is established. An Always On VPN deployment automatically establishes a VPN connection with the client at startup. The remote client must not be able to access the internet without first establishing a VPN session with a DOD site. Note that device compliance checks, including the banner presentation, are still required prior to connecting to DOD resources. Although out of scope for this requirement, the connection process must ensure remote devices meet security standards before accessing DOD resources. Devices that fail to meet compliance requirements can be denied access, reducing the risk of compromised endpoints.
STIGDate
Virtual Private Network (VPN) Security Requirements Guide2025-09-10

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09Session Integrity
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (30) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AU-10(1)Association of Identities
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
AU-9(3)Cryptographic Protection
1.00
CM-14Signed Components
1.00
CM-5(3)Signed Components
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00

+20 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.15
1.00
CCI1 mapping
CCI-001184
1.00

Details

Check Text (C-264336r1056131_chk)

Verify that the VPN Gateway uses an Always On VPN connection for remote computing. If the VPN Gateway does not use an Always On VPN connection for remote computing, this is a finding.

Fix Text (F-68157r984343_fix)

Configure the VPN Gateway to enable Always On VPN connections for all remote users. The remote client must not be able to access the internet without first establishing a VPN session with a DOD site.