HP M527dn

HP Inc.
HP LaserJet Enterprise MFP M527 Series,
Color LaserJet Enterprise MFP M577 Series, and
PageWide Enterprise Color MFP 586 Series
Firmware with Jetdirect Inside Security Target
Version: 2.0 Copyright © 2008-2016 by atsec information security corporation and HP Inc. Page 23 of 98
Last update: 2016-06-07 or its wholly owned subsidiaries
 Identification and authentication
 Data protection and access control
 Protection of the TSF (restricted forwarding, TSF self-testing, and timestamps)
 TOE access protection (inactivity timeout and automatic logout)
 Trusted channel communication and certificate management
 User and access management
Evaluated configuration 1.5.3.3
The following items will need to be adhered to in the evaluated configuration:
 HP Digital Sending Software (DSS) must be disabled
 Device Administrator Password must be set as per P.ADMIN.PASSWORD
 Only one Administrative Computer is used to manage the TOE
 HP and third-party applications cannot be installed on the TOE
 All non-fax stored jobs must be assigned a Job PIN or encrypted with a password
 All received faxes (excluding Fax Polling Receive jobs) must be stored in Job Storage
 PC Fax Send must be disabled
 Type A and B USB ports must be disabled
 Remote Firmware Upgrade through any means other than the EWS (e.g., PJL) and USB must be
disabled
 Jetdirect Inside management via telnet and FTP must be disabled
 Jetdirect XML Services must be disabled
 File System External Access must be disabled
 IPsec authentication using X.509v3 certificates must be enabled (IPsec authentication using
Kerberos or Pre-Shared Key is not supported)
 IPsec Authentication Headers (AH) must be disabled
 Full Authentication must be enabled (this disables the Guest role)
 SNMP support limited to:
o SNMPv1 read-only
o SNMPv2c read-only
o SNMPv3
 The Service PIN, used by a customer support engineer to access functions available to HP
support personnel, must be disabled
 Near Field Communication (NFC) must be disabled
 Wireless Direct Print must be disabled
 PJL device access commands must be disabled
 When using Windows Sign In, the Windows domain must reject Microsoft NT LAN Manager
(NTLM) connections