This document is a requirement for all DoD-administered information systems and all systems connected to DoD networks, as addressed in the technology section. These requirements are designed to assist System Managers (SMs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), and System Administrators (SAs) with configuring and maintaining security controls. The ArcGIS for Server 10.3 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems by providing technical security policies, requirements, configuration settings, and implementation details for the ArcGIS for Server 10.3.x application. ArcGIS for Server 10.3 is Geographic Information Service (GIS) software that enables centralized, enterprise-level geodatabase management and server-based publication of maps and geographic information services available throughout an enterprise or over the Internet as web services. ArcGIS for Server 10.3 offers services for all GIS-related work, such as mapping, geocoding, geoprocessing, imagery analysis, 3D data, and serving geographic features. Users can host GIS resources on ArcGIS for Server 10.3 and allow sharing with tablets, smartphones, laptops, desktop workstations, and any other devices that can connect to web services. ArcGIS for Server 10.3 is offered in three editions (basic, standard, and advanced), with each successive edition offering greater functionality using additional extensions. This ArcGIS for Server 10.3 STIG is intended for use with all three editions of ArcGIS for Server 10.3 operating on a Windows platform. Other applicable STIGs, such as, but not limited to, operating system and web server, must also be applied.
- Specialized Security-Limited Functionality (SSLF)
DoD Instruction (DoDI) 8500.01 requires that “all IT that receives, processes, stores, displays, or transmits DoD information will be […] configured […] consistent with applicable DoD cybersecurity policies, standards, and architectures” and tasks that Defense Information Systems Agency (DISA) “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs), and mobile code risk categories and usage guides that implement and are consistent with DoD cybersecurity policies, standards, architectures, security controls, and validation procedures, with the support of the NSA/CSS, using input from stakeholders, and using automation whenever possible.” This document is provided under the authority of DoDI 8500.01.
It must be noted that the guidelines specified should be evaluated in a local, representative test environment before implementation within large user populations. The extensive variety of environments makes it impossible to test these guidelines for all potential software configurations. For some environments, failure to test before implementation may lead to a loss of required functionality.
Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Information Assurance Support Environment (IASE) website. This site contains the latest copies of any STIGs, SRGs, and other related security information. The address for the IASE site is http://iase.disa.mil/.
Comments or proposed revisions to this document should be sent via email to the following address: firstname.lastname@example.org. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.
New Checklist - 07/31/2017
Updated URL to reflect change to the DISA website - http --> https
updated to v1,r3 - 02/16/2018
Updated to FINAL - 3/18/2018
Updated URLs - 6/5/19
NIST checklist record last modified on 06/06/2019