STIGQter: STIG Summary: Cisco IOS Switch NDM Security Technical Implementation Guide Version: 3 Release: 8 Benchmark Date: 01 Jul 2026:

The Cisco switch must be configured to terminate all network connections associated with device management after five minutes of inactivity.

DISA Rule

SV-220596r961068_rule

Vulnerability Number

V-220596

Group Title

SRG-APP-000190-NDM-000267

Rule Version

CISC-ND-000720

Severity

CAT I

CCI(s)

CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

Fix Recommendation

Set the idle timeout value to five minutes or less on all configured login classes as shown in the example below:

SW1(config)#line vty 0 1
SW1(config-line)#exec-timeout 5 0
SW1(config-line)#exit
SW1(config)#line con 0
SW1(config-line)#exec-timeout 5 0
SW1(config-line)#exit
SW2(config)#ip http timeout-policy idle 300 life nnnn requests nn

Check Contents

Review the Cisco switch configuration to verify that all network connections associated with a device management have an idle timeout value set to five minutes or less as shown in the example below:

ip http secure-server
ip http timeout-policy idle 300 life nnnn requests nn
…
…
…
line con 0
exec-timeout 5 0
line vty 0 1
exec-timeout 5 0

If the Cisco switch is not configured to terminate all network connections associated with a device management after five minutes of inactivity, this is a finding.

The Cisco switch must be configured to terminate all network connections associated with device management after five minutes of inactivity.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key