| 1.1.1.1 Ensure the Management VRF Exists | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.2 Control Plane ACL | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.3 Control Plane Policy Map | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.4 Network Time Protocol | AUDIT AND ACCOUNTABILITY |
| 1.1.6 DNS Configuration | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.7 Logging | AUDIT AND ACCOUNTABILITY |
| 1.1.8 VLAN Management | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2 Enable AES-GCM Encryption of EOS Secrets | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.1 Do not allow remote login without a password | IDENTIFICATION AND AUTHENTICATION |
| 2.1.2 Configure an enable password | IDENTIFICATION AND AUTHENTICATION |
| 2.1.3 Create a password complexity policy | IDENTIFICATION AND AUTHENTICATION |
| 2.1.4 Verify root login is disabled | ACCESS CONTROL |
| 2.3.1 Roles | ACCESS CONTROL |
| 2.4.1 Idle Timeout | CONFIGURATION MANAGEMENT |
| 2.4.2 Emergency Console Access | ACCESS CONTROL |
| 2.5.1 Configure TACACS+/RADIUS server | IDENTIFICATION AND AUTHENTICATION |
| 2.5.2 Server Groups | IDENTIFICATION AND AUTHENTICATION |
| 2.5.3 Authentication, Authorization, and Accounting | AUDIT AND ACCOUNTABILITY |
| 2.6.1 Limit SSH Access Only To The Network Management Segment | ACCESS CONTROL |
| 2.6.2 Set Idle Timeout for SSH to 10 Minutes or Less | CONFIGURATION MANAGEMENT |
| 2.7.1 Limit SNMP Access To Management VRF | ACCESS CONTROL |
| 2.7.2 Ensure SNMP Community | IDENTIFICATION AND AUTHENTICATION |
| 2.7.3 Use SNMPv3 Instead of Earlier Versions | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.8 Telnet access | CONFIGURATION MANAGEMENT |
| 2.9.1 Login Banner | ACCESS CONTROL |
