Attachment_8_-_ONE-NET_Remote_Testing_Guidance_for_Printers_and_MFDs_V00.02.pdf

SP7000-16-R-1004, Amendment 3 ONE-NET Remote Testing Guidance for Printers and MFDs V00.02 Page 1 of 1

1. Complete STIG Checklist:

1.1. Fully populate the U_Multifunction_Device_and_Network_Printers Manual Test Case checklist

1.2. Configurations and results called out in the STIG checklist, including all applicable ports and protocols, must align with the actual configurations in place on the device during scanning (i.e., do not identify what the device “can” do, but rather what the device “will” do)

1.3. Please ensure any pass/fail/na result has a detailed comment to provide justification.

1.4. Testing results will be inputted to Columns E, F, and also S (as needed).

2. ACAS Scanning and Reporting

2.1. The Navy Testing Guidance pdf outlines the ACAS scanning and reporting requirements

(Appendix 3).

2.2. The primary artifacts of interest that we will need from you are the .nessus scan file and 2 reports (.csv and pdf) configured in accordance with the Navy Testing Guidance doc.

2.3. NOTE: DLA Document Services has previously stated that MFDs require a unique scan policy to run scans correctly. Per DLA, “the DISA FSO guidance as written will not scan printers for vulnerabilities. If you are looking for a way to scan them, you will need to deviate from the FSO guidance and make a change under the "Do not scan fragile devices: 22481" plugin under Preferences in the scan policy. Without that deviation, the scanner will identify the MFD as a printer during the device identification part of the scan and stop itself from running the vulnerability checks against the ‘fragile device.’” The ONE-NET Security Validator team is unable to validate this scenario without access to the devices, but you may have to follow DLA’s suggestion to get a good scan.

3. Device Questionnaire

Manufacturer:

Make/Model to be tested:

Firmware Version:

Any associated drivers/software required?

List of all required Ports, Protocols, Services:

Use Case - list all that apply (Print, Scan, Fax, etc):

Is the device PKI enabled?

Enclave (NIPR only, SIPR only, NIPR/SIPR) List any software/drivers and version required.

Have they been tested on a representative workstation (Yes, No)?