MA-4 Nonlocal Maintenance
Maintenance family. 27 Control Correlation Identifiers map to this control, and 76 STIG rules implement those CCIs.
11CAT I (high)
64CAT II (medium)
1CAT III (low)
27CCIs
What this page is built from, and what it is not.
The mapping below is derived from 8 DISA STIG benchmarks (Google Chrome Current Windows, Kubernetes, Microsoft Windows 10, Microsoft Windows 11, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9) covering 2,030 rules, joined to 5,137 Control Correlation Identifiers.
It is not the complete STIG library. A control showing no rules here means no rule in these benchmarks maps to it, not that no STIG covers it. CCI to control mappings are published by DISA and reflect both Revision 4 and Revision 5 of NIST SP 800-53; where the two revisions disagree, both are shown. This page reports what the source data says and nothing further. It is not a compliance determination.
Where these rules come from
| STIG benchmark | Version | Rules mapped to MA-4 |
|---|---|---|
| Red Hat Enterprise Linux 9 | V2 | 55 |
| Microsoft Windows 10 | V3 | 6 |
| Microsoft Windows Server 2019 | V3 | 5 |
| Microsoft Windows 11 | V2 | 5 |
| Microsoft Windows Server 2022 | V2 | 5 |
Control Correlation Identifiers mapped to MA-4
| CCI | Definition | Rev |
|---|---|---|
| CCI-000873 | Approve nonlocal maintenance and diagnostic activities. | 5, 4 |
| CCI-000874 | Monitor nonlocal maintenance and diagnostic activities. | 5, 4 |
| CCI-000876 | Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system. | 5, 4 |
| CCI-000877 | Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions. | 5, 4 |
| CCI-000878 | Maintain records for nonlocal maintenance and diagnostic activities. | 5, 4 |
| CCI-000879 | The organization terminates sessions and network connections when nonlocal maintenance is completed. | 4 |
| CCI-000881 | The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections. | 4 |
| CCI-000882 | Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced. | 5, 4 |
| CCI-000883 | Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information). | 5, 4 |
| CCI-000884 | Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant. | 5, 4 |
| CCI-000886 | Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance. | 5, 4 |
| CCI-000887 | Require the approval of each nonlocal maintenance session by organization-defined personnel or roles. | 5, 4 |
| CCI-001631 | After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system. | 5, 4 |
| CCI-001632 | Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption. | 5, 4 |
| CCI-002884 | Log organization-defined audit events for nonlocal maintenance and diagnostic sessions. | 5, 4 |
| CCI-002885 | Defines the audit events for logged for nonlocal maintenance and diagnostic sessions. | 5, 4 |
| CCI-002886 | Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior. | 5, 4 |
| CCI-002887 | Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions. | 5, 4 |
| CCI-002888 | Defines the personnel or roles authorized to approve each nonlocal maintenance session. | 5, 4 |
| CCI-002889 | Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance. | 5, 4 |
| CCI-002890 | Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications. | 5, 4 |
| CCI-002891 | Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions. | 5, 4 |
| CCI-003123 | Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications. | 5, 4 |
| CCI-004190 | Terminate session when nonlocal maintenance is completed. | 5 |
| CCI-004191 | Terminate network connection when nonlocal maintenance is completed. | 5 |
| CCI-004192 | Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths. | 5 |
| CCI-004193 | Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications. | 5 |
STIG rules that implement MA-4
| Rule | STIG ID | Severity | Requirement |
|---|---|---|---|
| V-205711 | WN19-CC-000470 | high | Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication. |
| V-205712 | WN19-CC-000490 | medium | Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication. |
| V-205713 | WN19-CC-000500 | high | Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication. |
| V-205816 | WN19-CC-000480 | medium | Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic. |
| V-205817 | WN19-CC-000510 | medium | Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic. |
| V-220852 | WN10-CC-000290 | medium | Remote Desktop Services must be configured with the client connection encryption set to the required level. |
| V-220862 | WN10-CC-000330 | high | The Windows Remote Management (WinRM) client must not use Basic authentication. |
| V-220863 | WN10-CC-000335 | medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic. |
| V-220865 | WN10-CC-000345 | high | The Windows Remote Management (WinRM) service must not use Basic authentication. |
| V-220866 | WN10-CC-000350 | medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic. |
| V-220868 | WN10-CC-000360 | medium | The Windows Remote Management (WinRM) client must not use Digest authentication. |
| V-253416 | WN11-CC-000330 | high | The Windows Remote Management (WinRM) client must not use Basic authentication. |
| V-253417 | WN11-CC-000335 | medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic. |
| V-253418 | WN11-CC-000345 | high | The Windows Remote Management (WinRM) service must not use Basic authentication. |
| V-253419 | WN11-CC-000350 | medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic. |
| V-253421 | WN11-CC-000360 | medium | The Windows Remote Management (WinRM) client must not use Digest authentication. |
| V-254378 | WN22-CC-000470 | high | Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication. |
| V-254379 | WN22-CC-000480 | medium | Windows Server 2022 Windows Remote Management (WinRM) client must not allow unencrypted traffic. |
| V-254380 | WN22-CC-000490 | medium | Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication. |
| V-254381 | WN22-CC-000500 | high | Windows Server 2022 Windows Remote Management (WinRM) service must not use Basic authentication. |
| V-254382 | WN22-CC-000510 | medium | Windows Server 2022 Windows Remote Management (WinRM) service must not allow unencrypted traffic. |
| V-257796 | RHEL-09-212055 | low | RHEL 9 must enable auditing of processes that start prior to the audit daemon. |
| V-257986 | RHEL-09-255050 | high | RHEL 9 must enable the Pluggable Authentication Module (PAM) interface for SSHD. |
| V-257996 | RHEL-09-255100 | medium | RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. |
| V-258151 | RHEL-09-653010 | medium | RHEL 9 audit package must be installed. |
| V-258152 | RHEL-09-653015 | medium | RHEL 9 audit service must be enabled. |
| V-258177 | RHEL-09-654015 | medium | RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls. |
| V-258178 | RHEL-09-654020 | medium | RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls. |
| V-258179 | RHEL-09-654025 | medium | RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. |
| V-258180 | RHEL-09-654030 | medium | RHEL 9 must audit all uses of umount system calls. |
| V-258181 | RHEL-09-654035 | medium | RHEL 9 must audit all uses of the chacl command. |
| V-258182 | RHEL-09-654040 | medium | RHEL 9 must audit all uses of the setfacl command. |
| V-258183 | RHEL-09-654045 | medium | RHEL 9 must audit all uses of the chcon command. |
| V-258184 | RHEL-09-654050 | medium | RHEL 9 must audit all uses of the semanage command. |
| V-258185 | RHEL-09-654055 | medium | RHEL 9 must audit all uses of the setfiles command. |
| V-258186 | RHEL-09-654060 | medium | RHEL 9 must audit all uses of the setsebool command. |
| V-258187 | RHEL-09-654065 | medium | RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls. |
| V-258188 | RHEL-09-654070 | medium | RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls. |
| V-258189 | RHEL-09-654075 | medium | RHEL 9 must audit all uses of the delete_module system call. |
| V-258190 | RHEL-09-654080 | medium | RHEL 9 must audit all uses of the init_module and finit_module system calls. |
| V-258191 | RHEL-09-654085 | medium | RHEL 9 must audit all uses of the chage command. |
| V-258192 | RHEL-09-654090 | medium | RHEL 9 must audit all uses of the chsh command. |
| V-258193 | RHEL-09-654095 | medium | RHEL 9 must audit all uses of the crontab command. |
| V-258194 | RHEL-09-654100 | medium | RHEL 9 must audit all uses of the gpasswd command. |
| V-258195 | RHEL-09-654105 | medium | RHEL 9 must audit all uses of the kmod command. |
| V-258196 | RHEL-09-654110 | medium | RHEL 9 must audit all uses of the newgrp command. |
| V-258197 | RHEL-09-654115 | medium | RHEL 9 must audit all uses of the pam_timestamp_check command. |
| V-258198 | RHEL-09-654120 | medium | RHEL 9 must audit all uses of the passwd command. |
| V-258199 | RHEL-09-654125 | medium | RHEL 9 must audit all uses of the postdrop command. |
| V-258200 | RHEL-09-654130 | medium | RHEL 9 must audit all uses of the postqueue command. |
| V-258201 | RHEL-09-654135 | medium | RHEL 9 must audit all uses of the ssh-agent command. |
| V-258202 | RHEL-09-654140 | medium | RHEL 9 must audit all uses of the ssh-keysign command. |
| V-258203 | RHEL-09-654145 | medium | RHEL 9 must audit all uses of the su command. |
| V-258204 | RHEL-09-654150 | medium | RHEL 9 must audit all uses of the sudo command. |
| V-258205 | RHEL-09-654155 | medium | RHEL 9 must audit all uses of the sudoedit command. |
| V-258206 | RHEL-09-654160 | medium | RHEL 9 must audit all uses of the unix_chkpwd command. |
| V-258207 | RHEL-09-654165 | medium | RHEL 9 must audit all uses of the unix_update command. |
| V-258208 | RHEL-09-654170 | medium | RHEL 9 must audit all uses of the userhelper command. |
| V-258209 | RHEL-09-654175 | medium | RHEL 9 must audit all uses of the usermod command. |
| V-258210 | RHEL-09-654180 | medium | RHEL 9 must audit all uses of the mount command. |
| V-258215 | RHEL-09-654205 | medium | Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record. |
| V-258216 | RHEL-09-654210 | medium | Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record. |
| V-258217 | RHEL-09-654215 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers. |
| V-258218 | RHEL-09-654220 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/ directory. |
| V-258219 | RHEL-09-654225 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. |
| V-258220 | RHEL-09-654230 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. |
| V-258221 | RHEL-09-654235 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. |
| V-258222 | RHEL-09-654240 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. |
| V-258223 | RHEL-09-654245 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. |
| V-258224 | RHEL-09-654250 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. |
| V-258225 | RHEL-09-654255 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog. |
| V-258226 | RHEL-09-654260 | medium | RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. |
| V-258230 | RHEL-09-671010 | high | RHEL 9 must enable FIPS mode. |
| V-258234 | RHEL-09-215100 | medium | RHEL 9 must have the crypto-policies package installed. |
| V-258236 | RHEL-09-672020 | high | RHEL 9 cryptographic policy must not be overridden. |
| V-258241 | RHEL-09-215105 | medium | RHEL 9 must implement a FIPS 140-3 compliant systemwide cryptographic policy. |
Get this as data
The same mapping is served as JSON, no key required: /api/v1/stig-nist/control/MA-4. The interactive version of the full cube is the STIG to NIST mapper, and the endpoint is documented on the compliance API page.