STIGQter: STIG Summary: Cisco IOS XE Switch NDM Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 01 Apr 2026:

The Cisco switch must be configured to support organizational requirements to conduct backups of the configuration when changes occur.

DISA Rule

SV-220566r1186357_rule

Vulnerability Number

V-220566

Group Title

SRG-APP-000516-NDM-000340

Rule Version

CISC-ND-001410

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-000537 - Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives.

Weight

10

Fix Recommendation

Configure the Cisco switch to send the configuration to an SCP server when a configuration change occurs. The recommended and most secure method is to use public/private key authentication.

SW4(config)# ip scp server enable
SW4(config)# file prompt quiet
SW4(config)# event manager applet BACKUP_CONFIG
SW4(config-applet)# event syslog pattern "%SYS-5-CONFIG_I"
SW4(config-applet)# action 1 cli command "enable"
SW4(config-applet)# action 2 info type routername
SW4(config-applet)# action 3 cli command "copy running-config scp://<username>@<x.x.x.x>/<path_on_server>/$_info_routername-running-config"
SW4(config-applet)# action 4 syslog priority informational msg "Configuration backup executed for $_info_routername"
SW4(config-applet)# authorization bypass
SW4(config-applet)# end

Check Contents

Review the Cisco switch configuration to verify that it is configured to automatically back up its running configuration to a remote server when a change is made. The example configuration below will send the configuration to a SCP server when a configuration change occurs.

Verify that an Embedded Event Manager (EEM) applet is configured to trigger on the syslog message "%SYS-5-CONFIG_I".

Verify the EEM applet contains an action to copy the running configuration to a secure server (e.g., SCP).

Verify the command authorization bypass is present within the applet to ensure it executes correctly under AAA.

Verify the global command file prompt quiet is configured to prevent the applet from timing out.

Verify the authentication method used for the file transfer:

The command "copy running-config scp://<username>@<x.x.x.x>/<path_on_server>/$_info_routername-running-config".

Note: The absence of a password indicates the use of secure public/private key authentication.

If the Cisco switch is not configured to conduct automated backups of the configuration when changes occur, or if it does so using an insecure method like a cleartext password, this is a finding.

Vulnerability Number

V-220566

Documentable

False

Rule Version

CISC-ND-001410

Severity Override Guidance

Review the Cisco switch configuration to verify that it is configured to automatically back up its running configuration to a remote server when a change is made. The example configuration below will send the configuration to a SCP server when a configuration change occurs.

Verify that an Embedded Event Manager (EEM) applet is configured to trigger on the syslog message "%SYS-5-CONFIG_I".

Verify the EEM applet contains an action to copy the running configuration to a secure server (e.g., SCP).

Verify the command authorization bypass is present within the applet to ensure it executes correctly under AAA.

Verify the global command file prompt quiet is configured to prevent the applet from timing out.

Verify the authentication method used for the file transfer:

The command "copy running-config scp://<username>@<x.x.x.x>/<path_on_server>/$_info_routername-running-config".

Note: The absence of a password indicates the use of secure public/private key authentication.

If the Cisco switch is not configured to conduct automated backups of the configuration when changes occur, or if it does so using an insecure method like a cleartext password, this is a finding.

Check Content Reference

M

Target Key

4067