Title

The Voice Video Endpoint used for videoconferencing must accept a Common Access Card (CAC) or derived credentials. (Cat II impact)

Discussion

The use of CAC or derived credentials facilitates standardization and reduces the risk of unauthorized access. DoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.

Check Content

If the Voice Video Endpoint is a hardware endpoint, this check procedure is Not Applicable. Verify the Voice Video Endpoint used for videoconferencing accepts a CAC or derived credentials. For hardware endpoints, the devices must use certificates to register with the session manager or multipoint controller. If the Voice Video Endpoint used for videoconferencing does not accept a CAC or derived credentials, this is a finding.

Fix Text

Configure the Voice Video Endpoint used for videoconferencing to accept a CAC or derived credentials.

Additional Identifiers

Rule ID: SV-206772r604140_rule

Vulnerability ID: V-206772

Group Title: SRG-NET-000341

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.