STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 3 hours ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide

Version

V1R1

Release Date

Oct 7, 2026

SCAP Benchmark ID

Omnissa_Horizon_UAG

Total Checks

24

Tags

other
CAT I: 0CAT II: 24CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (24)

V-286580MEDIUMThe UAG must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.V-286581MEDIUMThe UAG administrative interface must display the Standard Mandatory DoW-approved Notice and Consent Banner before allowing access.V-286582MEDIUMThe UAG user interface must display the Standard Mandatory DoW-approved Notice and Consent Banner before allowing access.V-286583MEDIUMThe FIPS version of the UAG must be deployed to protect the confidentiality and integrity of remote access sessions.V-286584MEDIUMThe UAG must be configured to comply with the TLS versions required by NIST SP 800-52.V-286585MEDIUMThe UAG must not have unnecessary services and functions enabled.V-286586MEDIUMThe UAG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.V-286587MEDIUMThe UAG must point to a specific Horizon server.V-286588MEDIUMThe UAG must perform initial validation of user Public Key Infrastructure (PKI) credentials.V-286589MEDIUMThe UAG must be configured to determine certificate validity.V-286590MEDIUMThe UAG must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.V-286591MEDIUMThe UAG must limit the length of time that a client session can stay connected.V-286592MEDIUMThe UAG must off-load all audit records to a centralized log server.V-286593MEDIUMThe UAG must only allow Public Key Infrastructure (PKI) login via certificates issued by DoW certificate authorities.V-286594MEDIUMThe UAG must have a clock skew tolerance of less than five minutes.V-286595MEDIUMThe UAG must disable host time synchronization and use authoritative Network Time Protocol (NTP) time sources.V-286596MEDIUMThe UAG local administrator account must be configured with a password maximum lifetime of 60 days or less.V-286597MEDIUMThe UAG local monitoring accounts must be configured with a password maximum lifetime of 90 days or less.V-286598MEDIUMThe UAG must configure SNMP properly.V-286599MEDIUMThe UAG must only generate messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages.V-286600MEDIUMThe UAG must be configured with a DoW-issued TLS certificate.V-286601MEDIUMThe UAG must configure the Response Security Headers.V-286602MEDIUMThe UAG must not provide environment information to third parties.V-286603MEDIUMThe UAG must use cryptographic algorithms approved by the National Security Agency (NSA) to protect Network Security Services (NSS) when transporting classified traffic across an unclassified network.