Checklist Summary:

The MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. This document is meant to be used in conjunction with the Red Hat Enterprise Linux (OS) STIG, Network STIG, and other STIGs as applicable to the database host environment. It is based on the Database Security Requirements Guide (SRG) Version 2, Release 10, which in turn derives its cybersecurity controls from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4. MongoDB is an open-source document database built on a horizontal scale-out architecture. MongoDB stores data in flexible, JSON-like documents, meaning fields can vary from document to document and data structure can be changed over time. The document model maps to the objects in your application code, making data easy to work with. Indexing, ad hoc queries, and real time aggregation provide powerful ways to access and analyze your data. MongoDB is a distributed database at its core; so high availability, horizontal scaling, and geographic distribution are built in and easy to use. This STIG requires that the product be deployed on a FIPS-compliant, cryptography-enabled operating system found in the Cryptographic Module Validation Program (https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules); or by other means ensure that FIPS 140-2-certified OpenSSL libraries are used by the DBMS.

Checklist Role:

• Database Server

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

This document is provided under the authority of DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Information Assurance Support Environment (IASE) website. This site contains the latest copies of any STIGs, SRGs, and other related security information. The address for the IASE site is http://iase.disa.mil/.

Disclaimer:

Not provided.

Product Support:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

updated status to FINAL - 4/4/2022
Updated resource per DISA - 10/26/22
updated URLs - 1/26/24

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 01/26/2024