F5 BIG-IP TMOS STIG Compliance Checklist

20 items · Security · Hard difficulty · 4 hours

Practical steps to harden and validate F5 BIG-IP TMOS against STIG requirements.

• Update TMOS to the latest STIG-approved version

  Apply vendor and STIG recommended patches and hotfixes.

• Verify installed modules match STIG scope (LTM, APM, AFM, AWAF, DNS)

  Confirm only required modules are installed and licensed.

• Inventory and review virtual servers and applied policies

  List virtual servers, associated profiles, and policies for each application.

• Harden management interfaces

  Secure access to management plane and services.

• Restrict management access to trusted networks

  Use management VRF, ACLs, or trusted IP lists.

• Enable HTTPS and SSH with strong cipher suites

  Disable weak ciphers and enforce modern TLS versions.

• Disable unused management services (TELNET, FTP, SNMP v1)

  Turn off legacy protocols and unnecessary daemons.

• Change default admin account and enforce least privilege

  Remove or rename default accounts and assign minimal roles.

• Enable multi-factor authentication for administrative access

  Require MFA for GUI, SSH, and API administrators.

• Configure role-based access control (RBAC) and audit accounts

  Define roles, separate duties, and enable account auditing.

• Enforce TLS profiles and disable weak ciphers on virtual servers

  Apply approved TLS profiles to all client and server SSL objects.

• Configure secure SSL certificate management

  Use valid CAs, track expirations, and protect private keys.

• Apply AFM firewall policies to relevant virtual servers

  Attach application-specific AFM policies where required.

• Implement AWAF application security policies and tuning

  Enable protection rules, tune false positives, and test.

• Enable and centralize logging and syslog forwarding

  Forward audit, system, and WAF logs to a SIEM or syslog server.

• Configure monitoring and alerting for security events

  Create alerts for admin changes, failures, and critical logs.

• Perform vulnerability scan and remediate CVEs

  Scan device, review CVEs, and apply vendor mitigations.

• Backup configuration and save a STIG compliance snapshot

  Export configs and archive current state before/after changes.

• Document STIG deviations, exceptions, and obtain approvals

  Record justifications and authorized waivers for noncompliance.

• Schedule regular STIG compliance reviews and updates

  Plan periodic re-audits and track STIG version changes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.