STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

DISA Rule

SV-239919r1043189_rule

Vulnerability Number

V-239919

Group Title

SRG-APP-000170-NDM-000329

Rule Version

CASA-ND-000580

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

Configure the ASA to enforce password complexity by requiring that when a password is changed, the characters are changed in at least eight of the positions within the password as shown in the example below.

ASA(config)# password-policy minimum-changes 8

Check Contents

Review the ASA configuration to verify it is compliant with this requirement as shown in the example below.

password-policy minimum-changes 8

If the Cisco router is not configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.

Vulnerability Number

V-239919

Documentable

False

Rule Version

CASA-ND-000580

Severity Override Guidance

Review the ASA configuration to verify it is compliant with this requirement as shown in the example below.

password-policy minimum-changes 8

If the Cisco router is not configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.

Check Content Reference

M

Target Key

5342