STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 1 hour ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

Broadcom Content Analysis System (CAS) Security Technical Implementation Guide

Version

V1R1

Release Date

Sep 16, 2026

SCAP Benchmark ID

Broadcom_CAS_STIG

Total Checks

38

Tags

other
CAT I: 12CAT II: 26CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (38)

V-285606MEDIUMThe Content Analysis System (CAS) must automatically perform both continuous and weekly backups of its configuration settings to a secure, remote server to ensure continuity of operations.V-285607HIGHThe Content Analysis System (CAS) must be running an operating system release that is currently supported by the vendor.V-285608HIGHThe Content Analysis System (CAS) must implement signature based and/or nonsignature-based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.V-285609HIGHThe Content Analysis System (CAS) must be configured to operate in a FIPS-compliant mode to ensure the use of FIPS 140-3-validated cryptographic modules and algorithms.V-285610MEDIUMThe Content Analysis System (CAS) must limit the number of concurrent sessions to a maximum of three for each account type.V-285611HIGHThe Content Analysis System (CAS) must enforce Role-Based Access Control (RBAC) to ensure least privilege and protect system configurations, cryptographic settings, and audit records from unauthorized access or modification.V-285612MEDIUMThe Content Analysis System (CAS) must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.V-285613MEDIUMThe Content Analysis System (CAS) must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the device.V-285614MEDIUMThe Content Analysis System (CAS) must map the authenticated identity to the user account for PKI-based authentication.V-285618HIGHThe Content Analysis System (CAS) must disable nonsecure ports, protocols, and services to prevent unauthorized access and protect the integrity of the system.V-285619MEDIUMThe Content Analysis System (CAS) must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.V-285620HIGHThe Content Analysis System (CAS) must disable nonsecure TLS versions to prevent the use of deprecated cryptographic protocols for network communications.V-285621HIGHThe Content Analysis System (CAS) must use DoW Public Key Infrastructure (PKI) to enforce multifactor authentication for all interactive administrative logins.V-285623MEDIUMThe Content Analysis System (CAS) must enforce a minimum 15-character password length.V-285624MEDIUMThe Content Analysis System (CAS) must enforce password complexity by requiring that at least one uppercase character be used.V-285625MEDIUMThe Content Analysis System (CAS) must enforce password complexity by requiring that at least one lowercase character be used.V-285626MEDIUMThe Content Analysis System (CAS) must enforce password complexity by requiring that at least one numeric character be used.V-285627MEDIUMThe Content Analysis System (CAS) must enforce password complexity by requiring that at least one special character be used.V-285628MEDIUMThe Content Analysis System (CAS) must require that when a password is changed, the characters are changed in at least eight of the positions within the password.V-285631HIGHThe Content Analysis System (CAS) must be configured to use DoW-approved online certificate status protocol (OCSP) responders or certificate revocation lists (CRLs) to validate certificates used for PKI-based authentication.V-285632HIGHThe Content Analysis System (CAS) must be configured to use a centralized authentication server to securely map PKI-authenticated identities to administrative user accounts and roles.V-285634HIGHThe Content Analysis System (CAS) must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity.V-285641MEDIUMThe Content Analysis System (CAS) must provide an immediate real-time alert to appropriate personnel (such as the system administrator [SA] and information system security officer [ISSO]) upon the detection of an audit failure or the unauthorized access, modification, or deletion of audit information.V-285642MEDIUMThe Content Analysis System (CAS) must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-285644MEDIUMThe Content Analysis System (CAS) must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a Federal Information Processing Standards (FIPS)-validated Keyed-Hash Message Authentication Code (HMAC).V-285645MEDIUMThe Content Analysis System (CAS) must be configured to authenticate Network Time Protocol (NTP) sources using authentication with Federal Information Processing Standards (FIPS)-compliant algorithms.V-285646MEDIUMThe Content Analysis System (CAS) must enforce approved authorizations for controlling the flow of management information and protect against known types of denial-of-service (DoS) attacks by implementing a web-management access list.V-285649MEDIUMThe Content Analysis System (CAS) must be configured to generate audit records and alert administrators upon detecting potential system or file integrity violations using Intelligent Connection Traffic Monitoring (ICTM) and Hash Reputation.V-285650MEDIUMThe Content Analysis System (CAS) must generate audit records for all security-relevant events, including successful and unsuccessful logons, account management actions, privilege usage, and configuration changes.V-285651HIGHThe Content Analysis System (CAS) must utilize a centralized authentication server via a secure, encrypted connection to authenticate all administrative users prior to granting access.V-285652MEDIUMThe Content Analysis System (CAS) must obtain its public key certificates from an appropriate certificate policy through an approved service provider.V-285653HIGHThe Content Analysis System (CAS) must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).V-285654MEDIUMThe Content Analysis System (CAS) must be configured to verify, when users create or update passwords, the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-5 (1) (a) for password-based authentication.V-285655MEDIUMThe Content Analysis System (CAS) must be configured to allow user selection of long passwords and passphrases, including spaces and all printable characters for password-based authentication.V-285656MEDIUMThe Content Analysis System (CAS) must be configured to implement certificate revocation checking to support path discovery and validation for public key-based authentication.V-285657MEDIUMThe Content Analysis System (CAS) must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.V-285658MEDIUMThe Content Analysis System (CAS) must be configured to include only approved trust anchors in trust stores or certificate stores managed by the organization.V-285659MEDIUMThe Content Analysis System (CAS) must be configured to synchronize system clocks within and between systems.