STIGQter: STIG Summary: Cisco IOS XE Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Apr 2026:

The Cisco device must be configured to audit all administrator activity.

DISA Rule

SV-220526r1186346_rule

Vulnerability Number

V-220526

Group Title

SRG-APP-000080-NDM-000220

Rule Version

CISC-ND-000210

Severity

CAT II

CCI(s)

CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
CCI-002234 - Log the execution of privileged functions.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

Fix Recommendation

Configure the switch to log administrator activity as shown in the example below:

SW1(config)#logging userinfo
SW1(config)#archive
SW1(config-archive)#log config
SW1(config-archive-log-cfg)#logging enable
SW1(config-archive-log-cfg)#logging size 1000
SW1(config-archive-log-cfg)#notify syslog contenttype plaintext
SW1(config-archive-log-cfg)#hidekeys
SW1(config-archive-log-cfg)#end

Check Contents

Review the Cisco switch configuration to verify that it is compliant with this requirement as shown in the example below:

hostname R1
!
logging userinfo
!
…
…
…
archive
log config
logging enable
!

Note: The logging userinfo global configuration command will generate a log when a user increases his or her privilege level.

If logging of administrator activity is not configured, this is a finding.

The Cisco device must be configured to audit all administrator activity.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key