CISC-ND-000010 - The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-216522r531088_rule

STIG-ID|CISC-ND-000010

STIG-Legacy|SV-105509

STIG-Legacy|V-96371

Vuln-ID|V-216522

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - access-class deny

800-53|AC-4

CCI|CCI-001368

Rule-ID|SV-216523r539428_rule

STIG-ID|CISC-ND-000140

STIG-Legacy|SV-105517

STIG-Legacy|V-96379

Vuln-ID|V-216523

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - access-class permit

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line default

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - vty-pool

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - aaa auth

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-216524r531088_rule

STIG-ID|CISC-ND-000150

STIG-Legacy|SV-105519

STIG-Legacy|V-96381

Vuln-ID|V-216524

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - line console

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - line default

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes - server host

800-53|IA-2

CISC-ND-000160 - The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-216525r531088_rule

STIG-ID|CISC-ND-000160

STIG-Legacy|SV-105521

STIG-Legacy|V-96383

Vuln-ID|V-216525

CISC-ND-000250 - The Cisco router must be configured to generate audit records when successful/unsuccessful attempts to logon with access privileges occur.

800-53|AU-12

CCI|CCI-000172

Rule-ID|SV-216526r531088_rule

STIG-ID|CISC-ND-000250

STIG-Legacy|SV-105531

STIG-Legacy|V-96393

Vuln-ID|V-216526

CISC-ND-000280 - The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-216527r531088_rule

STIG-ID|CISC-ND-000280

STIG-Legacy|SV-105533

STIG-Legacy|V-96395

Vuln-ID|V-216527

CISC-ND-000290 - The Cisco router must produce audit records containing information to establish where the events occurred.

800-53|AU-3

CCI|CCI-000132

Rule-ID|SV-216528r531088_rule

STIG-ID|CISC-ND-000290

STIG-Legacy|SV-105535

STIG-Legacy|V-96397

Vuln-ID|V-216528

CISC-ND-000470 - The Cisco router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.

800-53|CM-7

CAT|I

CCI|CCI-000382

CSCv6|9.1

Rule-ID|SV-216529r531088_rule

STIG-ID|CISC-ND-000470

STIG-Legacy|SV-105541

STIG-Legacy|V-96403

Vuln-ID|V-216529

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa auth

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-216530r663917_rule

STIG-ID|CISC-ND-000490

STIG-Legacy|SV-105545

STIG-Legacy|V-96407

Vuln-ID|V-216530

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - username

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - username groups

800-53|AC-2

800-53|AC-2(7)

CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh version

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-216531r531088_rule

STIG-ID|CISC-ND-000530

STIG-Legacy|SV-105551

STIG-Legacy|V-96413

Vuln-ID|V-216531

CISC-ND-000720 - The Cisco router must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line console

800-53|AC-12

CCI|CCI-001133

CSCv6|16.4

Rule-ID|SV-216532r531088_rule

STIG-ID|CISC-ND-000720

STIG-Legacy|SV-105559

STIG-Legacy|V-96421

Vuln-ID|V-216532

CISC-ND-000720 - The Cisco router must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line default

800-53|SC-10

CISC-ND-000980 - The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - logging archive

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-216533r531088_rule

STIG-ID|CISC-ND-000980

STIG-Legacy|SV-105581

STIG-Legacy|V-96443

Vuln-ID|V-216533

CISC-ND-000980 - The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements - logging buffered

CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events - logging host

800-53|AU-4(1)

CCI|CCI-001858

Rule-ID|SV-216534r531088_rule

STIG-ID|CISC-ND-001000

STIG-Legacy|SV-105585

STIG-Legacy|V-96447

Vuln-ID|V-216534

CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - NTP_SERVER_1

800-53|AU-8(2)

CCI|CCI-000366

CCI|CCI-001893

CSCv6|6.1

Rule-ID|SV-216535r531088_rule

STIG-ID|CISC-ND-001030

STIG-Legacy|SV-105587

STIG-Legacy|V-96449

Vuln-ID|V-216535

CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources - NTP_SERVER_2

CISC-ND-001040 - The Cisco router must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

800-53|AU-8

CCI|CCI-001889

Rule-ID|SV-216536r531088_rule

STIG-ID|CISC-ND-001040

STIG-Legacy|SV-105589

STIG-Legacy|V-96451

Vuln-ID|V-216536

CISC-ND-001050 - The Cisco router must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) - clock timezone

CCI|CCI-001890

Rule-ID|SV-216537r531088_rule

STIG-ID|CISC-ND-001050

STIG-Legacy|SV-105591

STIG-Legacy|V-96453

Vuln-ID|V-216537

CISC-ND-001050 - The Cisco router must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) - service timestamps

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server group

CCI|CCI-001967

Rule-ID|SV-216538r531088_rule

STIG-ID|CISC-ND-001130

STIG-Legacy|SV-105601

STIG-Legacy|V-96463

Vuln-ID|V-216538

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server host

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server user

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server view V3READ

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC) - snmp-server view V3WRITE

CISC-ND-001140 - The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server group

CCI|CCI-000068

Rule-ID|SV-216539r531088_rule

STIG-ID|CISC-ND-001140

STIG-Legacy|SV-105603

STIG-Legacy|V-96465

Vuln-ID|V-216539

CISC-ND-001140 - The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm - snmp-server user

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp authenticate

800-53|IA-3(1)

Rule-ID|SV-216540r531088_rule

STIG-ID|CISC-ND-001150

STIG-Legacy|SV-105605

STIG-Legacy|V-96467

Vuln-ID|V-216540

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp authentication-key

CSCv6|3.1

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp NTP_SERVER_1 authentication-key

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp NTP_SERVER_2 authentication-key

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based - ntp trusted-key

CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-216541r531088_rule

STIG-ID|CISC-ND-001200

STIG-Legacy|SV-105611

STIG-Legacy|V-96473

Vuln-ID|V-216541

CISC-ND-001210 - The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

CCI|CCI-003123

Rule-ID|SV-216542r531088_rule

STIG-ID|CISC-ND-001210

STIG-Legacy|SV-105613

STIG-Legacy|V-96475

Vuln-ID|V-216542

CISC-ND-001310 - The Cisco router must be configured to off-load log records onto a different system than the system being audited.

CCI|CCI-001851

Rule-ID|SV-216543r531088_rule

STIG-ID|CISC-ND-001310

STIG-Legacy|SV-105615

STIG-Legacy|V-96477

Vuln-ID|V-216543

CISC-ND-001370 - The Cisco router must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access - aaa authentication login

Detections

Analytics

DISA STIG Cisco IOS-XR Router NDM v2r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.4 Aug 16, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.2 Jun 17, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Apr 28, 2021 Miscellaneous Metadata updated. References updated.