← Back to Forescout Network Access Control Security Technical Implementation Guide

V-233317

CAT II (Medium)

When devices fail the policy assessment, Forescout must create a record with sufficient detail suitable for forwarding to a remediation server for automated remediation or sending to the user for manual remediation. This is required for compliance with C2C Step 3.

Rule ID

SV-233317r1270624_rule

STIG

Forescout Network Access Control Security Technical Implementation Guide

Version

V2R6

CCIs

CCI-000213

Discussion

Notifications sent to the user and/or network administrator informing them of remediation requirements will ensure that action is taken.

Check Content

If DoW is not at C2C Step 3 or higher, this is not a finding.

Verify Forescout sends user and/or admin notification of remediation requirements, whether manual or automated. Examples of notifications can include events or incidents sent to automated ticketing systems, emails, or logs to SIEM systems. 

If the NAC does not flag devices for future manual or automated remediation when those devices fail policy assessment and are not automatically remediated either before or during the remote access session, this is a finding.

Fix Text

Log on to the Forescout UI. 

1. Within the Policy tab, locate the Compliance policies. 
2. Within the policy Sub-Rule, ensure all policies that indicate remediation have been configured to notify the user and/or network administrator of required action.