CISC-ND-000010 - The Cisco switch must be configured to limit the number of concurrent management sessions to an organization-defined number - ip http max connections

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-220518r508500_rule

STIG-ID|CISC-ND-000010

STIG-Legacy|SV-110473

STIG-Legacy|V-101369

Vuln-ID|V-220518

CISC-ND-000010 - The Cisco switch must be configured to limit the number of concurrent management sessions to an organization-defined number - session-limit

CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation.

800-53|AU-12

CCI|CCI-000018

Rule-ID|SV-220519r508503_rule

STIG-ID|CISC-ND-000090

STIG-Legacy|SV-110475

STIG-Legacy|V-101371

Vuln-ID|V-220519

CISC-ND-000100 - The Cisco switch must be configured to automatically audit account modification.

CCI|CCI-001403

Rule-ID|SV-220520r508506_rule

STIG-ID|CISC-ND-000100

STIG-Legacy|SV-110477

STIG-Legacy|V-101373

Vuln-ID|V-220520

CISC-ND-000110 - The Cisco switch must be configured to automatically audit account disabling actions.

CCI|CCI-001404

Rule-ID|SV-220521r508509_rule

STIG-ID|CISC-ND-000110

STIG-Legacy|SV-110497

STIG-Legacy|V-101393

Vuln-ID|V-220521

CISC-ND-000120 - The Cisco switch must be configured to automatically audit account removal actions.

CCI|CCI-001405

Rule-ID|SV-220522r508512_rule

STIG-ID|CISC-ND-000120

STIG-Legacy|SV-110499

STIG-Legacy|V-101395

Vuln-ID|V-220522

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - access-class deny

CCI|CCI-001368

Rule-ID|SV-220523r569664_rule

STIG-ID|CISC-ND-000140

STIG-Legacy|SV-110501

STIG-Legacy|V-101397

Vuln-ID|V-220523

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line vty access-class

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - line vty ssh

800-53|SC-8(1)

CISC-ND-000140 - The Cisco switch must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies - management access-list

CISC-ND-000150 - The Cisco switch must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-220524r508518_rule

STIG-ID|CISC-ND-000150

STIG-Legacy|SV-110503

STIG-Legacy|V-101399

Vuln-ID|V-220524

CISC-ND-000160 - The Cisco switch must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-220525r508521_rule

STIG-ID|CISC-ND-000160

STIG-Legacy|SV-110505

STIG-Legacy|V-101401

Vuln-ID|V-220525

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - archive logging enable

CCI|CCI-000166

Rule-ID|SV-220526r539619_rule

STIG-ID|CISC-ND-000210

STIG-Legacy|SV-110507

STIG-Legacy|V-101403

Vuln-ID|V-220526

CISC-ND-000210 - The Cisco switch must be configured to protect against an individual falsely denying having performed organization-defined actions to be covered by non-repudiation - logging userinfo

800-53|AU-10

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-failure log

CCI|CCI-000172

Rule-ID|SV-220527r508527_rule

STIG-ID|CISC-ND-000250

STIG-Legacy|SV-110509

STIG-Legacy|V-101405

Vuln-ID|V-220527

CISC-ND-000250 - The Cisco switch must be configured to generate audit records when successful/unsuccessful attempts to log on with access privileges occur - login on-success log

CISC-ND-000280 - The Cisco switch must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-220528r508530_rule

STIG-ID|CISC-ND-000280

STIG-Legacy|SV-110511

STIG-Legacy|V-101407

Vuln-ID|V-220528

CISC-ND-000290 - The Cisco switch must produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-220529r508533_rule

STIG-ID|CISC-ND-000290

STIG-Legacy|SV-110513

STIG-Legacy|V-101409

Vuln-ID|V-220529

CISC-ND-000330 - The Cisco switch must be configured to generate audit records containing the full-text recording of privileged commands.

CCI|CCI-000135

Rule-ID|SV-220530r508536_rule

STIG-ID|CISC-ND-000330

STIG-Legacy|SV-110515

STIG-Legacy|V-101411

Vuln-ID|V-220530

CISC-ND-000380 - The Cisco switch must be configured to protect audit information from unauthorized modification.

800-53|AU-9

CCI|CCI-000163

Rule-ID|SV-220531r508539_rule

STIG-ID|CISC-ND-000380

STIG-Legacy|SV-110517

STIG-Legacy|V-101413

Vuln-ID|V-220531

CISC-ND-000390 - The Cisco switch must be configured to protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-220532r508542_rule

STIG-ID|CISC-ND-000390

STIG-Legacy|SV-110519

STIG-Legacy|V-101415

Vuln-ID|V-220532

CISC-ND-000460 - The Cisco switch must be configured to limit privileges to change the software resident within software libraries.

CCI|CCI-001499

Rule-ID|SV-220533r508545_rule

STIG-ID|CISC-ND-000460

STIG-Legacy|SV-110521

STIG-Legacy|V-101417

Vuln-ID|V-220533

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - boot network

800-53|SI-7(9)

CAT|I

CCI|CCI-000382

Rule-ID|SV-220534r508548_rule

STIG-ID|CISC-ND-000470

STIG-Legacy|SV-110523

STIG-Legacy|V-101419

Vuln-ID|V-220534

CISC-ND-000470 - The Cisco switch must be configured to prohibit the use of all unnecessary and nonsecure functions and services - ip boot server

800-53|CM-7

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - aaa auth

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-220535r802620_rule

STIG-ID|CISC-ND-000490

STIG-Legacy|SV-110525

STIG-Legacy|V-101421

Vuln-ID|V-220535

CISC-ND-000490 - The Cisco switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable - account

CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ip ssh server algorithm

800-53|SC-13

CCI|CCI-001941

Rule-ID|SV-220536r508554_rule

STIG-ID|CISC-ND-000530

STIG-Legacy|SV-110527

STIG-Legacy|V-101423

Vuln-ID|V-220536

CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ip ssh version 2

CISC-ND-000550 - The Cisco switch must be configured to enforce a minimum 15-character password length.

800-53|IA-5(1)

CCI|CCI-000205

Rule-ID|SV-220537r508557_rule

STIG-ID|CISC-ND-000550

STIG-Legacy|SV-110529

STIG-Legacy|V-101425

Vuln-ID|V-220537

CISC-ND-000570 - The Cisco switch must be configured to enforce password complexity by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-220538r508560_rule

STIG-ID|CISC-ND-000570

STIG-Legacy|SV-110531

STIG-Legacy|V-101427

Vuln-ID|V-220538

CISC-ND-000580 - The Cisco switch must be configured to enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-220539r508563_rule

STIG-ID|CISC-ND-000580

STIG-Legacy|SV-110533

STIG-Legacy|V-101429

Vuln-ID|V-220539

CISC-ND-000590 - The Cisco switch must be configured to enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-220540r508566_rule

STIG-ID|CISC-ND-000590

STIG-Legacy|SV-110535

STIG-Legacy|V-101431

Vuln-ID|V-220540

CISC-ND-000600 - The Cisco switch must be configured to enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-220541r508569_rule

STIG-ID|CISC-ND-000600

STIG-Legacy|SV-110537

STIG-Legacy|V-101433

Vuln-ID|V-220541

CISC-ND-000610 - The Cisco switch must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-220542r508572_rule

STIG-ID|CISC-ND-000610

STIG-Legacy|SV-110539

STIG-Legacy|V-101435

Vuln-ID|V-220542

CISC-ND-000620 - The Cisco switch must only store cryptographic representations of passwords - enable secret

CCI|CCI-000196

CSCv6|16.13

Detections

Analytics

DISA STIG Cisco IOS XE Switch NDM v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Sep 30, 2022 Miscellaneous Platform check updated. Variables updated.
Revision 1.2 Aug 17, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Apr 25, 2022 Miscellaneous References updated.