STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 23 hours ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

Aviat Networks WTM NDM Security Technical Implementation Guide

Version

V1R1

Release Date

Sep 14, 2026

SCAP Benchmark ID

Aviat_Networks_WTM_NDM_STIG

Total Checks

23

Tags

network
CAT I: 6CAT II: 17CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (23)

V-286471MEDIUMWTM must configure management ACLs to enforce approved authorizations for controlling the flow of management information.V-286473MEDIUMWTM must be configured to authenticate SNMPv3 messages using a FIPS 140-3-validated Keyed-Hash Message Authentication Code (HMAC).V-286474MEDIUMWTM must enforce password complexity by requiring that at least one uppercase character be used.V-286475MEDIUMWTM must enforce password complexity by requiring that at least one lowercase character be used.V-286476MEDIUMWTM must enforce password complexity by requiring that at least one numeric character be used.V-286477MEDIUMWTM must enforce password complexity by requiring at least one special character be used.V-286478HIGHWTM must have a version of Aviat OS installed that is version 6.x or later and currently supported by the vendor.V-286479HIGHWTM must enable FIPS mode so only FIPS 140-3-approved algorithms for authentication to a cryptographic module are selectable for use.V-286480HIGHWTM must be configured to implement multifactor authentication (MFA) for local, network, and/or remote access to privileged accounts using DoW PKI.V-286481MEDIUMWTM must retain the Standard Mandatory DoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log in for further access.V-286482HIGHWTM must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required.V-286483HIGHWTM must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements.V-286485HIGHWTM must be configured to store passwords using an approved salted key derivation function, preferably using a keyed hash for password-based authentication.V-286486MEDIUMWTM must enforce a minimum 15-character password length.V-286487MEDIUMWTM must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.V-286488MEDIUMWTM must obtain its public key certificates from an appropriate certificate policy through an approved service provider.V-286489MEDIUMWTM must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-286490MEDIUMWTM must require that when a password is changed, the characters are changed in at least eight of the positions within the password.V-286491MEDIUMWTM must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.V-286492MEDIUMWTM must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the device.V-286493MEDIUMWTM must limit the number of concurrent sessions to eight or an organizationally identified limit.V-286495MEDIUMWTM must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.V-286496MEDIUMWTM must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.