MongoDB 7.x STIG Compliance Checklist

26 items · Security · Medium difficulty · 1 day

Essential steps to secure MongoDB 7.x to DISA STIG standards.

• Verify MongoDB Enterprise Advanced 7.x is installed and up-to-date

  Confirm version (7.x) and apply vendor security patches.

• Deploy MongoDB on a FIPS-compliant OS or enable FIPS mode

  Use an OS with CMVP-validated modules or enable FIPS mode where required.

• Ensure MongoDB uses FIPS-certified OpenSSL libraries or OS FIPS crypto

  Verify OpenSSL is FIPS 140-2/140-3 certified or provided by the OS.

• Harden and patch the host OS per relevant STIGs and remove unused services

  Apply RHEL/host STIG controls and disable unnecessary packages and daemons.

• Restrict network exposure by binding mongod to specific IP addresses

  Set net.bindIp in mongod.conf to only required interfaces.

• Configure firewall rules to restrict MongoDB ports to trusted hosts

  Allow only management, application and replication peers as needed.

• Create a dedicated administrative user with least-privilege roles

  Provision admin user(s) in the admin database; avoid shared/default accounts.

• Enable authentication

  Activate MongoDB authentication to require credentials for connections.

• Enable role-based authorization and revoke default privileges

  Assign least privilege roles and remove unneeded built-in privileges.

• Enforce SCRAM-SHA-256 and strong password policies

  Use SCRAM-SHA-256, enforce complexity, rotation, and lockout policies.

• Configure TLS/SSL for client-server and intra-cluster communication

  Encrypt in-transit traffic using TLS with approved ciphers.

• Obtain and install certificates from a trusted CA

  Use certificates with proper SANs and full chains for hostnames.

• Verify certificate chains and disable weak ciphers/protocols

  Disable TLS 1.0/1.1 and weak cipher suites; prefer FIPS-approved ciphers.

• Enable TLS in mongod configuration and restart the service

  Set net.tls or net.ssl settings in mongod.conf and validate connections.

• Configure internal cluster authentication (keyfile or x.509)

  Authenticate replica set and sharded members using keyfile or x.509 certs.

• Enable auditing and forward audit logs to SIEM

  Capture access, auth, and config changes and send to centralized logging.

• Define audit filters to capture privileged actions

  Focus audit events on admin, auth, and data-access operations.

• Rotate and retain audit logs per policy

  Implement log rotation, secure storage, and retention to meet compliance.

• Enable encryption at rest and manage keys via an approved KMS

  Use the Encrypted Storage Engine and store keys in KMIP or an approved KMS.

• Secure backups: encrypt backup data and restrict access

  Encrypt backup archives and limit access to authorized personnel/systems.

• Restrict filesystem permissions for MongoDB data and config files

  Set ownership and permissions so only the mongod user can access data files.

• Disable unused HTTP/REST endpoints and administrative web interfaces

  Turn off REST/status interfaces and any unnecessary listeners.

• Monitor vendor advisories and apply security patches promptly

  Subscribe to MongoDB advisories and patch systems for CVEs quickly.

• Perform regular vulnerability and STIG compliance scans

  Run automated scanners and rectify findings on a regular cadence.

• Test disaster recovery by validating backup restores regularly

  Perform full restores from backups to verify recovery procedures.

• Maintain incident response runbooks and practice log analysis

  Document procedures and run tabletop exercises for common incidents.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.