Checklist Summary:

This document is a requirement for all DoD-administered information systems and all systems connected to DoD networks, as addressed in the technology section. These requirements are designed to assist System Managers (SMs), Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), and System Administrators (SAs) with configuring and maintaining security controls. The ArcGIS for Server 10.3 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems by providing technical security policies, requirements, configuration settings, and implementation details for the ArcGIS for Server 10.3.x application. ArcGIS for Server 10.3 is Geographic Information Service (GIS) software that enables centralized, enterprise-level geodatabase management and server-based publication of maps and geographic information services available throughout an enterprise or over the Internet as web services. ArcGIS for Server 10.3 offers services for all GIS-related work, such as mapping, geocoding, geoprocessing, imagery analysis, 3D data, and serving geographic features. Users can host GIS resources on ArcGIS for Server 10.3 and allow sharing with tablets, smartphones, laptops, desktop workstations, and any other devices that can connect to web services. ArcGIS for Server 10.3 is offered in three editions (basic, standard, and advanced), with each successive edition offering greater functionality using additional extensions. This ArcGIS for Server 10.3 STIG is intended for use with all three editions of ArcGIS for Server 10.3 operating on a Windows platform. Other applicable STIGs, such as, but not limited to, operating system and web server, must also be applied.

Checklist Role:

• Application Server

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoD Instruction (DoDI) 8500.01 requires that “all IT that receives, processes, stores, displays, or transmits DoD information will be […] configured […] consistent with applicable DoD cybersecurity policies, standards, and architectures” and tasks that Defense Information Systems Agency (DISA) “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs), and mobile code risk categories and usage guides that implement and are consistent with DoD cybersecurity policies, standards, architectures, security controls, and validation procedures, with the support of the NSA/CSS, using input from stakeholders, and using automation whenever possible.” This document is provided under the authority of DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

It must be noted that the guidelines specified should be evaluated in a local, representative test environment before implementation within large user populations. The extensive variety of environments makes it impossible to test these guidelines for all potential software configurations. For some environments, failure to test before implementation may lead to a loss of required functionality.

Product Support:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Information Assurance Support Environment (IASE) website. This site contains the latest copies of any STIGs, SRGs, and other related security information. The address for the IASE site is http://iase.disa.mil/.

Point of Contact:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

New Checklist - 07/31/2017
Updated URL to reflect change to the DISA website - http --> https
updated to v1,r3 - 02/16/2018
Updated to FINAL - 3/18/2018
Updated URLs - 6/5/19
Updated URLs and Sunset per DISA - 7/25/23

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 07/25/2023