The vCenter Server must enable FIPS-validated cryptography.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256331 | VCSA-70-000077 | SV-256331r885604_rule | CCI-000197 | high |
| Description | ||||
| FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. In vSphere 6.7 and later, ESXi and vCenter Server use FIPS-validated cryptography to protect management interfaces and the VMware Certificate Authority (VMCA). vSphere 7.0 Update 2 and later adds additional FIPS-validated cryptography to vCenter Server Appliance. By default, this FIPS validation option is disabled and must be enabled. Satisfies: SRG-APP-000172, SRG-APP-000179, SRG-APP-000224, SRG-APP-000231, SRG-APP-000412, SRG-APP-000514, SRG-APP-000555, SRG-APP-000600, SRG-APP-000610, SRG-APP-000620, SRG-APP-000630, SRG-APP-000635 | ||||
| STIG | Date | |||
| VMware vSphere 7.0 vCenter Security Technical Implementation Guide | 2023-12-21 | |||
Related Frameworks
6 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
IA-5(1)
1.00
- DISA · V1R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1714 mappings
3.5.10
1.00
- DISA · V1R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.7
1.00
- DISA · V1R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.8
1.00
- DISA · V1R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.9
1.00
- DISA · V1R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000197
1.00
- DISA · V1R3 · disa_xccdf · related
Details
Check Text (C-256331r885604_chk)
From the vSphere Web Client, go to Developer Center >> API Explorer.
From the "Select API" drop-down menu, select appliance.
Expand system/security/global_fips >> GET.
Click "Execute" and then "Copy Response" to view the results.
Example response:
{
"enabled": true
}
If global FIPS mode is not enabled, this is a finding.
Fix Text (F-59949r885603_fix)
From the vSphere Web Client, go to Developer Center >> API Explorer.
From the "Select API" drop-down menu, select appliance.
Expand system/security/global_fips >> PUT.
In the response body under "Try it out", paste the following:
{
"enabled": true
}
Click "Execute".
Note: The vCenter server reboots after FIPS is enabled or disabled.