Checklist Summary:

This document contains procedures that enable qualified personnel to conduct a Security Readiness Review (SRR) of generic Enterprise Resource Planning (ERP) implementations. This checklist is to be used for ERP implementations for which no product specific checklists exists. The SRR assesses compliance with Defense information Systems Agency's (DISA's) Enterprise Resource Planning Security Technical Implementation Guide. An ERP SRR encompasses all of the server-side components of an application, including, but not necessarily limited to the following items supporting the application: - Application code - Web server(s) - Database server(s) - Directory and authentication device(s) (e.g., Windows domain controllers, RADIUS, etc.) - Firewall(s) - Network and enclave configuration required to support the application - Operating system platforms for any of the above During a full ERP review, an SRR is performed on each of the listed components in addition to the ERP SRR itself. For example, if an ERP infrastructure consisted of a front-end web server running on Windows and a backend database running on UNIX, then the full review would consist of Web Server, Database, Windows, and UNIX SRRs. A penetration test will also be performed. If this review is a full system baseline all components would be evaluated. If this review is an Security Test and Evaluation (ST&E) validation or a re-accreditation and current reviews exist for these components, only the penetration test needs to be completed at the time of the ERP review. A current review is defined as a review performed based upon the current STIG. A review is also deemed to not be current if the operating system or component has been reinstalled since the last SRR. Some elements are outside the scope of the ERP SRR. These include: - Configuration and behavior of web browser clients - Application development methodology

Checklist Role:

• Server
• Server Operating System
• Operating System
• Desktop and Server Operating System
• Web Application Server
• Web Server
• Firewall
• Virtualization Server

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

Not provided.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Version 1, Release 1.1 - 10 April 2007
Version 1, Release 1 - 7 December 2006
Updated "Point of Contact" - 08 January 2015
Updated URL to reflect change to the DISA website - http --> https
moved to archive status - 4/15/19

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 04/15/2019