Title

The DSN system major software version releases must be tested, certified, and placed on the DoD Approved Product List (APL) prior to installation. (Cat II impact)

Discussion

All DSN system major software releases must be tested on non-production systems and hardware prior to use to determine the effects the new software will have on systems operations and security. DoD policy mandates testing on non-production configurations.

Check Content

Review site documentation to confirm the DSN local system major software version releases on production systems are on the DoD APL. If the DSN local system major software version releases on production systems are not on the DoD APL, this is a finding.

Fix Text

Implement and document the DSN local system with major software version releases listed on the DoD APL. Ensure only VVoIP systems listed on the DoD APL are connected to the DSN. Sponsor the system for DSN APL testing and certification.

Additional Identifiers

Rule ID: SV-9032r2_rule

Vulnerability ID: V-8535

Group Title: Major releases APL listed

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.