What does ACAS TASKORD 20-0020 FRAGO 2 emphasize regarding configuration scanning?

What does ACAS TASKORD 20-0020 FRAGO 2 emphasize regarding configuration scanning?

• A. Only DISA STIG Tenable Audit files should be used
• B. Third-party tools are acceptable for scanning
• C. All types of configuration files are acceptable
• D. Customized scripts should be used

Answer: (A)

The focus of ACAS TASKORD 20-0020 FRAGO 2 is to ensure consistent and standardized security configuration scanning across systems. By emphasizing that only DISA STIG (Security Technical Implementation Guide) Tenable Audit files should be used, the directive promotes the use of vetted and authoritative sources for scanning configurations. DISA STIGs are developed and published by the Defense Information Systems Agency to provide specific security guidelines for various technologies, ensuring compliance with Department of Defense (DoD) standards. Utilizing these audit files guarantees that the scanning procedures align with established government benchmarks, effectively reducing risk and enhancing security posture. This approach minimizes potential vulnerabilities that could arise from using unverified or generic scanning tools, as they may not adhere to the strict security protocols required for DoD systems. Therefore, relying on these officially sanctioned audit files ensures that assessments of configuration compliance are thorough and reliable.

The focus of ACAS TASKORD 20-0020 FRAGO 2 is to ensure consistent and standardized security configuration scanning across systems. By emphasizing that only DISA STIG (Security Technical Implementation Guide) Tenable Audit files should be used, the directive promotes the use of vetted and authoritative sources for scanning configurations.

DISA STIGs are developed and published by the Defense Information Systems Agency to provide specific security guidelines for various technologies, ensuring compliance with Department of Defense (DoD) standards. Utilizing these audit files guarantees that the scanning procedures align with established government benchmarks, effectively reducing risk and enhancing security posture.

This approach minimizes potential vulnerabilities that could arise from using unverified or generic scanning tools, as they may not adhere to the strict security protocols required for DoD systems. Therefore, relying on these officially sanctioned audit files ensures that assessments of configuration compliance are thorough and reliable.