CISC-ND-000010 - The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.

CAT|II

CCI|CCI-000054

Rule-ID|SV-216522r960735_rule

STIG-ID|CISC-ND-000010

STIG-Legacy|SV-105509

STIG-Legacy|V-96371

Vuln-ID|V-216522

CISC-ND-000140 - The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies.

CCI|CCI-001368

CCI|CCI-004192

Rule-ID|SV-216523r991929_rule

STIG-ID|CISC-ND-000140

STIG-Legacy|SV-105517

STIG-Legacy|V-96379

Vuln-ID|V-216523

CISC-ND-000150 - The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes.

CCI|CCI-000044

Rule-ID|SV-216524r960840_rule

STIG-ID|CISC-ND-000150

STIG-Legacy|SV-105519

STIG-Legacy|V-96381

Vuln-ID|V-216524

CISC-ND-000160 - The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CCI|CCI-000048

Rule-ID|SV-216525r960843_rule

STIG-ID|CISC-ND-000160

STIG-Legacy|SV-105521

STIG-Legacy|V-96383

Vuln-ID|V-216525

CISC-ND-000250 - The Cisco router must be configured to generate audit records when successful/unsuccessful attempts to logon with access privileges occur.

CCI|CCI-000172

Rule-ID|SV-216526r960885_rule

STIG-ID|CISC-ND-000250

STIG-Legacy|SV-105531

STIG-Legacy|V-96393

Vuln-ID|V-216526

CISC-ND-000280 - The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-216527r960894_rule

STIG-ID|CISC-ND-000280

STIG-Legacy|SV-105533

STIG-Legacy|V-96395

Vuln-ID|V-216527

CISC-ND-000290 - The Cisco router must produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216528r960897_rule

STIG-ID|CISC-ND-000290

STIG-Legacy|SV-105535

STIG-Legacy|V-96397

Vuln-ID|V-216528

CISC-ND-000470 - The Cisco router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.

CAT|I

CCI|CCI-000382

Rule-ID|SV-216529r1043177_rule

STIG-ID|CISC-ND-000470

STIG-Legacy|SV-105541

STIG-Legacy|V-96403

Vuln-ID|V-216529

CISC-ND-000490 - The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-216530r1051115_rule

STIG-ID|CISC-ND-000490

STIG-Legacy|SV-105545

STIG-Legacy|V-96407

Vuln-ID|V-216530

CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

CCI|CCI-001941

Rule-ID|SV-216531r960993_rule

STIG-ID|CISC-ND-000530

STIG-Legacy|SV-105551

STIG-Legacy|V-96413

Vuln-ID|V-216531

CISC-ND-000720 - The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity.

CCI|CCI-001133

Rule-ID|SV-216532r961068_rule

STIG-ID|CISC-ND-000720

STIG-Legacy|SV-105559

STIG-Legacy|V-96421

Vuln-ID|V-216532

CISC-ND-000980 - The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-216533r961392_rule

STIG-ID|CISC-ND-000980

STIG-Legacy|SV-105581

STIG-Legacy|V-96443

Vuln-ID|V-216533

CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events.

CCI|CCI-001858

CCI|CCI-003831

Rule-ID|SV-216534r991930_rule

STIG-ID|CISC-ND-001000

STIG-Legacy|SV-105585

STIG-Legacy|V-96447

Vuln-ID|V-216534

CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources.

CCI|CCI-001893

CCI|CCI-004922

CCI|CCI-004923

CCI|CCI-004928

Rule-ID|SV-216535r1015296_rule

STIG-ID|CISC-ND-001030

STIG-Legacy|SV-105587

STIG-Legacy|V-96449

Vuln-ID|V-216535

CISC-ND-001040 - The Cisco router must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

CCI|CCI-001889

Rule-ID|SV-216536r961446_rule

STIG-ID|CISC-ND-001040

STIG-Legacy|SV-105589

STIG-Legacy|V-96451

Vuln-ID|V-216536

CISC-ND-001050 - The Cisco router must be configured to record time stamps for log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-216537r961443_rule

STIG-ID|CISC-ND-001050

STIG-Legacy|SV-105591

STIG-Legacy|V-96453

Vuln-ID|V-216537

CISC-ND-001130 - The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

CCI|CCI-001967

Rule-ID|SV-216538r961506_rule

STIG-ID|CISC-ND-001130

STIG-Legacy|SV-105601

STIG-Legacy|V-96463

Vuln-ID|V-216538

CISC-ND-001140 - The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm.

CCI|CCI-000068

Rule-ID|SV-216539r961506_rule

STIG-ID|CISC-ND-001140

STIG-Legacy|SV-105603

STIG-Legacy|V-96465

Vuln-ID|V-216539

CISC-ND-001150 - The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based.

Rule-ID|SV-216540r1107163_rule

STIG-ID|CISC-ND-001150

STIG-Legacy|SV-105605

STIG-Legacy|V-96467

Vuln-ID|V-216540

CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-216541r961554_rule

STIG-ID|CISC-ND-001200

STIG-Legacy|SV-105611

STIG-Legacy|V-96473

Vuln-ID|V-216541

CISC-ND-001210 - The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

CCI|CCI-003123

Rule-ID|SV-216542r961557_rule

STIG-ID|CISC-ND-001210

STIG-Legacy|SV-105613

STIG-Legacy|V-96475

Vuln-ID|V-216542

CISC-ND-001310 - The Cisco router must be configured to off-load log records onto a different system than the system being audited.

CCI|CCI-001851

Rule-ID|SV-216543r961860_rule

STIG-ID|CISC-ND-001310

STIG-Legacy|SV-105615

STIG-Legacy|V-96477

Vuln-ID|V-216543

CISC-ND-001370 - The Cisco router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

CCI|CCI-000370

Rule-ID|SV-216544r961863_rule

STIG-ID|CISC-ND-001370

STIG-Legacy|SV-105621

STIG-Legacy|V-96483

Vuln-ID|V-216544

CISC-ND-001410 - The Cisco router must be configured to back up the configuration when changes occur.

CCI|CCI-000366

CCI|CCI-000537

Rule-ID|SV-216545r1069525_rule

STIG-ID|CISC-ND-001410

STIG-Legacy|SV-105629

STIG-Legacy|V-96491

Vuln-ID|V-216545

CISC-ND-001440 - The Cisco router must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider.

CCI|CCI-001159

Rule-ID|SV-216546r961863_rule

STIG-ID|CISC-ND-001440

STIG-Legacy|SV-105633

STIG-Legacy|V-96495

Vuln-ID|V-216546

CISC-ND-001450 - The Cisco router must be configured to send log data to at least two syslog servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).

Rule-ID|SV-216547r961863_rule

STIG-ID|CISC-ND-001450

STIG-Legacy|SV-105635

STIG-Legacy|V-96497

Vuln-ID|V-216547

CISC-ND-001470 - The Cisco router must be running an IOS release that is currently supported by Cisco Systems.

Detections

Analytics

DISA Cisco IOS XR Router NDM STIG v3r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous