CISC-ND-000010 - The Cisco switch must be configured to limit the number of concurrent management sessions to an organization-defined number - ip http max connections

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-110473r1_rule

STIG-ID|CISC-ND-000010

Vuln-ID|V-101369

CISC-ND-000010 - The Cisco switch must be configured to limit the number of concurrent management sessions to an organization-defined number.

CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation.

800-53|AU-12

CCI|CCI-000018

Rule-ID|SV-110475r1_rule

STIG-ID|CISC-ND-000090

Vuln-ID|V-101371

CISC-ND-000100 - The Cisco switch must be configured to automatically audit account modification.

CCI|CCI-001403

Rule-ID|SV-110477r1_rule

STIG-ID|CISC-ND-000100

Vuln-ID|V-101373

CISC-ND-000110 - The Cisco switch must be configured to automatically audit account disabling actions.

CCI|CCI-001404

Rule-ID|SV-110497r1_rule

STIG-ID|CISC-ND-000110

Vuln-ID|V-101393

CISC-ND-000120 - The Cisco switch must be configured to automatically audit account removal actions.

CCI|CCI-001405

Rule-ID|SV-110499r1_rule

STIG-ID|CISC-ND-000120

Vuln-ID|V-101395

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line vty access-class

CCI|CCI-001368

Rule-ID|SV-110501r1_rule

STIG-ID|CISC-ND-000140

Vuln-ID|V-101397

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line vty ssh

800-53|SC-8(1)

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - management access-list

CISC-ND-000150 - The Cisco switch must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-110503r1_rule

STIG-ID|CISC-ND-000150

Vuln-ID|V-101399

CISC-ND-000160 - The Cisco switch must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-110505r1_rule

STIG-ID|CISC-ND-000160

Vuln-ID|V-101401

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - archive logging enable

CCI|CCI-000166

Rule-ID|SV-110507r1_rule

STIG-ID|CISC-ND-000210

Vuln-ID|V-101403

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - logging userinfo

800-53|AU-10

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-failure log

CCI|CCI-000172

Rule-ID|SV-110509r1_rule

STIG-ID|CISC-ND-000250

Vuln-ID|V-101405

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-success log

CISC-ND-000280 - The Cisco switch must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-110511r1_rule

STIG-ID|CISC-ND-000280

Vuln-ID|V-101407

CISC-ND-000290 - The Cisco switch must produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-110513r1_rule

STIG-ID|CISC-ND-000290

Vuln-ID|V-101409

CISC-ND-000330 - The Cisco switch must be configured to generate audit records containing the full-text recording of privileged commands.

CCI|CCI-000135

Rule-ID|SV-110515r1_rule

STIG-ID|CISC-ND-000330

Vuln-ID|V-101411

CISC-ND-000380 - The Cisco switch must be configured to protect audit information from unauthorized modification.

800-53|AU-9

CCI|CCI-000163

Rule-ID|SV-110517r1_rule

STIG-ID|CISC-ND-000380

Vuln-ID|V-101413

CISC-ND-000390 - The Cisco switch must be configured to protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-110519r1_rule

STIG-ID|CISC-ND-000390

Vuln-ID|V-101415

CISC-ND-000460 - The Cisco switch must be configured to limit privileges to change the software resident within software libraries.

CCI|CCI-001499

Rule-ID|SV-110521r1_rule

STIG-ID|CISC-ND-000460

Vuln-ID|V-101417

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - boot network

800-53|SI-7(9)

CAT|I

CCI|CCI-000382

Rule-ID|SV-110523r1_rule

STIG-ID|CISC-ND-000470

Vuln-ID|V-101419

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - ip boot server

800-53|CM-7

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa auth

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-110525r1_rule

STIG-ID|CISC-ND-000490

Vuln-ID|V-101421

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - account

CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ip ssh server algorithm

800-53|SC-13

CCI|CCI-001941

Rule-ID|SV-110527r1_rule

STIG-ID|CISC-ND-000530

Vuln-ID|V-101423

CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ip ssh version 2

CISC-ND-000550 - The Cisco switch must be configured to enforce a minimum 15-character password length.

800-53|IA-5(1)

CCI|CCI-000205

Rule-ID|SV-110529r1_rule

STIG-ID|CISC-ND-000550

Vuln-ID|V-101425

CISC-ND-000570 - The Cisco switch must be configured to enforce password complexity by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-110531r1_rule

STIG-ID|CISC-ND-000570

Vuln-ID|V-101427

CISC-ND-000580 - The Cisco switch must be configured to enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-110533r1_rule

STIG-ID|CISC-ND-000580

Vuln-ID|V-101429

CISC-ND-000590 - The Cisco switch must be configured to enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-110535r1_rule

STIG-ID|CISC-ND-000590

Vuln-ID|V-101431

CISC-ND-000600 - The Cisco switch must be configured to enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-110537r1_rule

STIG-ID|CISC-ND-000600

Vuln-ID|V-101433

CISC-ND-000610 - The Cisco switch must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-110539r1_rule

STIG-ID|CISC-ND-000610

Vuln-ID|V-101435

CISC-ND-000620 - The Cisco switch must only store cryptographic representations of passwords - enable secret

CCI|CCI-000196

CSCv6|16.13

CSCv6|16.14

Rule-ID|SV-110541r1_rule

STIG-ID|CISC-ND-000620

Vuln-ID|V-101437

CISC-ND-000620 - The Cisco switch must only store cryptographic representations of passwords - service password-encryption

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - ip http secure-server

CCI|CCI-001133

Rule-ID|SV-110543r1_rule

STIG-ID|CISC-ND-000720

Vuln-ID|V-101439

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - ip http timeout

800-53|SC-10

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line con

800-53|AC-12

CSCv6|16.4

CISC-ND-000720 - The Cisco switch must be configured to terminate all network connections associated with device management after 10 minutes of inactivity - line vty

CISC-ND-000880 - The Cisco switch must be configured to automatically audit account enabling actions.

CCI|CCI-002130

Rule-ID|SV-110545r1_rule

STIG-ID|CISC-ND-000880

Vuln-ID|V-101441

CISC-ND-000940 - The Cisco switch must be configured to audit the execution of privileged functions - logging enable

CCI|CCI-002234

Rule-ID|SV-110547r1_rule

STIG-ID|CISC-ND-000940

Vuln-ID|V-101443

CISC-ND-000940 - The Cisco switch must be configured to audit the execution of privileged functions - logging userinfo

CISC-ND-000980 - The Cisco switch must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-110549r1_rule

STIG-ID|CISC-ND-000980

Vuln-ID|V-101445

CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events - logging host

CCI|CCI-001858

Rule-ID|SV-110551r1_rule

STIG-ID|CISC-ND-001000

Vuln-ID|V-101447

CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events - logging trap

CISC-ND-001030 - The Cisco switch must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources.

800-53|AU-8(1)

CCI|CCI-000366

CCI|CCI-001893

Rule-ID|SV-110553r1_rule

STIG-ID|CISC-ND-001030

Vuln-ID|V-101449

CISC-ND-001040 - The Cisco switch must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

CCI|CCI-001889

Rule-ID|SV-110555r1_rule

STIG-ID|CISC-ND-001040

Vuln-ID|V-101451

CISC-ND-001050 - The Cisco switch must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) - clock timezone

Detections

Analytics

DISA STIG Cisco IOS XE Switch NDM v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous