STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
STIGs updated 2 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Cisco ISE NDM Security Technical Implementation Guide

Version

V2R3

Release Date

Dec 11, 2025

SCAP Benchmark ID

Cisco_ISE_NDM_STIG

Total Checks

53

Tags

network
CAT I: 9CAT II: 41CAT III: 3

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (53)

V-242607LOWThe Cisco ISE must limit the number of CLI and GUI sessions to an organization-defined number.V-242608MEDIUMThe Cisco ISE must change the password for the local CLI and web-based account when members who have access to the password leave the role and are no longer authorized access.V-242609MEDIUMFor the local web-based account of last resort, the Cisco ISE must automatically audit account creation.V-242610MEDIUMFor the local web-based account of last resort and the default local CLI account, the Cisco ISE must automatically audit account modification.V-242611MEDIUMFor the local web-based account of last resort, the Cisco ISE must automatically audit account disabling actions.V-242612MEDIUMFor the local account of last resort, the Cisco ISE must automatically audit account removal actions.V-242613LOWThe Cisco ISE must automatically audit account enabling actions.V-242614MEDIUMThe Cisco ISE must be configured with only one local web-based account to be used as the account of last resort in the event the authentication server is unavailable.V-242615HIGHThe Cisco ISE must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.V-242616MEDIUMThe Cisco ISE must audit the execution of privileged functions.V-242617MEDIUMThe Cisco ISE must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.V-242618MEDIUMFor the local account of last resort, the Cisco ISE must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.V-242619MEDIUMThe Cisco ISE must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.V-242620MEDIUMThe Cisco ISE must generate audit records when successful attempts to access privileges occur.V-242621MEDIUMThe Cisco ISE must generate audit records when successful attempts to modify administrator privileges occur.V-242622MEDIUMThe Cisco ISE must generate audit records when successful attempts to delete administrator privileges occur.V-242623MEDIUMThe Cisco ISE must generate audit records when successful logon attempts occur.V-242624MEDIUMThe Cisco ISE must generate audit records for privileged activities or other system-level access.V-242625MEDIUMThe Cisco ISE must generate audit records when concurrent logons from different workstations occur.V-242626MEDIUMThe Cisco ISE must limit audit record storage capacity for all locally stored logs.V-242627MEDIUMThe Cisco ISE must configure a remote syslog where audit records are stored on a centralized logging target that is different from the system being audited.V-242628MEDIUMThe Cisco ISE must send an alarm to one or more individuals when the monitoring collector process has an error or failure.V-242629MEDIUMThe Cisco ISE must be configured to synchronize internal information system clocks using redundant authoritative time sources.V-242630MEDIUMThe Cisco ISE must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).V-242632MEDIUMThe Cisco ISE must enforce access restrictions associated with changes to the firmware, OS, and hardware components.V-242633MEDIUMThe Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access.V-242634MEDIUMThe Cisco ISE must be running an operating system release that is currently supported by the vendor.V-242636MEDIUMThe Cisco ISE must generate log records for a locally developed list of auditable events.V-242638LOWThe Cisco ISE must conduct configuration and operational backups when changes are made or must schedule backups weekly, at a minimum.V-242639MEDIUMThe Cisco ISE must use DoD-approved PKI rather than proprietary or self-signed device certificates.V-242640HIGHThe Cisco ISE must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.V-242641HIGHThe Cisco ISE must be configured to disable Wireless Setup for production systems.V-242642MEDIUMFor accounts using password authentication, the Cisco ISE must implement replay-resistant authentication mechanisms for network access to privileged accounts.V-242643MEDIUMThe Cisco ISE must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).V-242644MEDIUMThe Cisco ISE must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.V-242645MEDIUMFor accounts using password authentication, the Cisco ISE must enforce a minimum 15-character password length.V-242646MEDIUMFor accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one uppercase character be used.V-242647MEDIUMFor accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one lowercase character be used.V-242648MEDIUMFor accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one digit be used.V-242649MEDIUMFor accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one special character be used.V-242651HIGHFor accounts using password authentication, the Cisco ISE must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.V-242652MEDIUMThe Cisco ISE must prohibit the use of cached authenticators after an organization-defined time period.V-242653HIGHThe Cisco ISE must use FIPS-validated SHA-2 (or greater) to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications.V-242654MEDIUMThe Cisco ISE must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.V-242655HIGHThe Cisco ISE must verify the checksum value of any software download, including install files (ISO or OVA), patch files, and upgrade bundles.V-242656HIGHThe Cisco ISE must be configured to implement cryptographic mechanisms using a FIPS 140-2 validated algorithm to protect the confidentiality of remote maintenance sessions.V-242657HIGHThe Cisco ISE must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after six minutes of inactivity, except to fulfill documented and validated mission requirements.V-242658MEDIUMThe Cisco ISE must generate unique session identifiers using a FIPS 140-2 approved Random Number Generator (RNG) using DRGB.V-242659HIGHThe Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored.V-242660MEDIUMThe Cisco ISE must configure the control plane to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself by configuring applicable system options and internet-options.V-242661MEDIUMThe Cisco ISE must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).V-242662MEDIUMThe Cisco ISE must initiate session auditing upon startup.V-242663MEDIUMThe Cisco ISE must generate audit records containing the full-text recording of privileged commands.