OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter Server must enable FIPS-validated cryptography.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258917VCSA-80-000077SV-258917r961029_ruleCCI-000197high
Description
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. In vSphere 6.7 and later, ESXi and vCenter Server use FIPS-validated cryptography to protect management interfaces and the VMware Certificate Authority (VMCA). vSphere 7.0 Update 2 and later adds additional FIPS-validated cryptography to vCenter Server Appliance. By default, this FIPS validation option is disabled and must be enabled. Satisfies: SRG-APP-000172, SRG-APP-000179, SRG-APP-000224, SRG-APP-000231, SRG-APP-000412, SRG-APP-000514, SRG-APP-000555, SRG-APP-000600, SRG-APP-000610, SRG-APP-000620, SRG-APP-000630, SRG-APP-000635
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2025-06-09

Related Frameworks

7 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
CRY-01.1Alternate Physical Protection
1.00
CRY-03Transmission Confidentiality
1.00
CRY-04Transmission Integrity
1.00
CRY-05Encrypting Data At Rest
1.00
DCH-01Data Protection
1.00
IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00

+12 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (95) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00

+85 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.11
1.00
3.13.16
1.00
3.5.10
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI7 mappings
CCI-000197
1.00
CCI-000803
1.00
CCI-001188
1.00
CCI-001199
1.00
CCI-001967
1.00
CCI-002450
1.00
CCI-003123
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.DS-01
1.00
PR.DS-02
1.00
PR.DS-10
1.00
PR.AA-05
0.50

Who does this work

13 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-258917r961029_chk)

From the vSphere Web Client, go to Developer Center >> API Explorer. From the "Select API" drop-down menu, select appliance. Expand system/security/global_fips >> GET. Click "Execute" and then "Copy Response" to view the results. Example response: { "enabled": true } or From a PowerCLI command prompt while connected to the vCenter server, run the following command: Invoke-GetSystemGlobalFips If global FIPS mode is not enabled, this is a finding.

Fix Text (F-62566r934408_fix)

From the vSphere Web Client go to Developer Center >> API Explorer. From the "Select API" drop-down menu, select appliance. Expand system/security/global_fips >> PUT. In the response body under "Try it out" paste the following: { "enabled": true } Click "Execute". or From a PowerCLI command prompt while connected to the vCenter server, run the following command: $spec = Initialize-SystemSecurityGlobalFipsUpdateSpec -Enabled $true; Invoke-SetSystemGlobalFips -SystemSecurityGlobalFipsUpdateSpec $spec Note: The vCenter server reboots after FIPS is enabled or disabled.