CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection.

800-53|IA-3

CAT|I

CCI|CCI-000778

Rule-ID|SV-220675r539671_rule

STIG-ID|CISC-L2-000020

STIG-Legacy|SV-110325

STIG-Legacy|V-101221

Vuln-ID|V-220675

CISC-L2-000030 - The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

800-53|IA-7

CAT|II

CCI|CCI-000803

Rule-ID|SV-220676r539671_rule

STIG-ID|CISC-L2-000030

STIG-Legacy|SV-110327

STIG-Legacy|V-101223

Vuln-ID|V-220676

CISC-L2-000060 - The Cisco switch must be configured for authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-220677r1082341_rule

STIG-ID|CISC-L2-000060

STIG-Legacy|SV-110329

STIG-Legacy|V-101225

Vuln-ID|V-220677

CISC-L2-000070 - The Cisco switch must be configured for authorized users to remotely view, in real time, all content related to an established user session from a component separate from The Cisco switch.

800-53|AU-14(3)

CCI|CCI-001920

Rule-ID|SV-220678r1082342_rule

STIG-ID|CISC-L2-000070

STIG-Legacy|SV-110331

STIG-Legacy|V-101227

Vuln-ID|V-220678

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection.

CCI|CCI-001958

Rule-ID|SV-220679r856488_rule

STIG-ID|CISC-L2-000080

STIG-Legacy|SV-110333

STIG-Legacy|V-101229

Vuln-ID|V-220679

CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-220680r940009_rule

STIG-ID|CISC-L2-000090

STIG-Legacy|SV-110335

STIG-Legacy|V-101231

Vuln-ID|V-220680

CISC-L2-000100 - The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220681r856490_rule

STIG-ID|CISC-L2-000100

STIG-Legacy|SV-110337

STIG-Legacy|V-101233

Vuln-ID|V-220681

CISC-L2-000110 - The Cisco switch must have STP Loop Guard enabled.

Rule-ID|SV-220682r856491_rule

STIG-ID|CISC-L2-000110

STIG-Legacy|SV-110339

STIG-Legacy|V-101235

Vuln-ID|V-220682

CISC-L2-000120 - The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

Rule-ID|SV-220683r856492_rule

STIG-ID|CISC-L2-000120

STIG-Legacy|SV-110341

STIG-Legacy|V-101237

Vuln-ID|V-220683

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

Rule-ID|SV-220684r856493_rule

STIG-ID|CISC-L2-000130

STIG-Legacy|SV-110343

STIG-Legacy|V-101239

Vuln-ID|V-220684

CISC-L2-000140 - The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220685r1156799_rule

STIG-ID|CISC-L2-000140

STIG-Legacy|SV-110345

STIG-Legacy|V-101241

Vuln-ID|V-220685

CISC-L2-000150 - The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.

Rule-ID|SV-220686r856495_rule

STIG-ID|CISC-L2-000150

STIG-Legacy|SV-110347

STIG-Legacy|V-101243

Vuln-ID|V-220686

CISC-L2-000160 - The Cisco switch must have Storm Control configured on all host-facing switchports.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-220687r539671_rule

STIG-ID|CISC-L2-000160

STIG-Legacy|SV-110349

STIG-Legacy|V-101245

Vuln-ID|V-220687

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs.

Rule-ID|SV-220688r539671_rule

STIG-ID|CISC-L2-000170

STIG-Legacy|SV-110351

STIG-Legacy|V-101247

Vuln-ID|V-220688

CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

Rule-ID|SV-220689r917685_rule

STIG-ID|CISC-L2-000190

STIG-Legacy|SV-110353

STIG-Legacy|V-101249

Vuln-ID|V-220689

CISC-L2-000210 - The Cisco switch must have all disabled switch ports assigned to an unused VLAN.

800-53|SC-7

CCI|CCI-004891

Rule-ID|SV-220690r991946_rule

STIG-ID|CISC-L2-000210

STIG-Legacy|SV-110355

STIG-Legacy|V-101251

Vuln-ID|V-220690

CISC-L2-000220 - The Cisco switch must not have the default VLAN assigned to any host-facing switch ports.

Rule-ID|SV-220691r991947_rule

STIG-ID|CISC-L2-000220

STIG-Legacy|SV-110357

STIG-Legacy|V-101253

Vuln-ID|V-220691

CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it.

Rule-ID|SV-220692r991948_rule

STIG-ID|CISC-L2-000230

STIG-Legacy|SV-110359

STIG-Legacy|V-101255

Vuln-ID|V-220692

CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic.

800-53|CP-8

CCI|CCI-004931

Rule-ID|SV-220693r991949_rule

STIG-ID|CISC-L2-000240

STIG-Legacy|SV-110361

STIG-Legacy|V-101257

Vuln-ID|V-220693

CISC-L2-000250 - The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

Rule-ID|SV-220694r991951_rule

STIG-ID|CISC-L2-000250

STIG-Legacy|SV-110363

STIG-Legacy|V-101259

Vuln-ID|V-220694

CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Rule-ID|SV-220695r991952_rule

STIG-ID|CISC-L2-000260

STIG-Legacy|SV-110365

STIG-Legacy|V-101261

Vuln-ID|V-220695

CISC-L2-000270 - The Cisco switch must not have any switchports assigned to the native VLAN.

Detections

Analytics

DISA Cisco NX OS Switch L2S STIG v3r3

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 7, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 May 15, 2026 Miscellaneous Metadata updated. See also link updated.

Detections

Analytics

DISA Cisco NX OS Switch L2S STIG v3r3 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Cisco NX OS Switch L2S STIG v3r3