Title

The Voice Video Endpoint used for videoconferencing must electronically verify the Common Access Card (CAC) or derived credentials. (Cat II impact)

Discussion

The use of CAC or derived credentials facilitates standardization and reduces the risk of unauthorized access. DoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.

Check Content

If the Voice Video Endpoint is a hardware endpoint, this check procedure is Not Applicable. Verify the Voice Video Endpoint used for videoconferencing electronically verifies the CAC or derived credentials. For hardware endpoints, the devices must use certificates to register with the session manager or multipoint controller. If the Voice Video Endpoint used for videoconferencing does not electronically verify the CAC or derived credentials, this is a finding.

Fix Text

Configure the Voice Video Endpoint used for videoconferencing to electronically verify the CAC or derived credentials.

Additional Identifiers

Rule ID: SV-206773r604140_rule

Vulnerability ID: V-206773

Group Title: SRG-NET-000342

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.