Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-222647	SRG-APP-000516	APSC-DV-003160	SV-222647r961863_rule	2025-02-12	6

Description
Secure state assurance cannot be accomplished without testing the system state at least annually to ensure the system remains in a secure state upon initialization, shutdown, and aborts.

ℹ️ Check
Review the process documentation and interview the admin staff. Identify if testing procedures exist and if they include annual testing to ensure the application remains in a secure state on initialization, shutdown, and aborts. Checks should include at a minimum, attempts to access the application and application configuration settings without credentials or with improper credentials both locally and remotely. Dates should be noted as to the last date of testing. If annual testing procedures do not exist, or if administrators are unable to provide testing dates that indicate the tests were conducted within the last year, this is a finding.

ℹ️ Check

Review the process documentation and interview the admin staff. Identify if testing procedures exist and if they include annual testing to ensure the application remains in a secure state on initialization, shutdown, and aborts. Checks should include at a minimum, attempts to access the application and application configuration settings without credentials or with improper credentials both locally and remotely. Dates should be noted as to the last date of testing. If annual testing procedures do not exist, or if administrators are unable to provide testing dates that indicate the tests were conducted within the last year, this is a finding.

✔️ Fix
Create test procedures to test the security state of the application and exercise test procedures annually.