STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to authenticate Network Time Protocol (NTP) sources using authentication with FIPS-compliant algorithms.

DISA Rule

SV-239929r1167249_rule

Vulnerability Number

V-239929

Group Title

SRG-APP-000395-NDM-000347

Rule Version

CASA-ND-001080

Severity

CAT II

CCI(s)

CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

Fix Recommendation

Configure the Cisco ASA to authenticate NTP sources using authentication with FIPS-compliant algorithms as shown in the example below:

ASA(config)# ntp authenticate
ASA(config)# ntp trusted-key 1
ASA(config)# ntp authentication-key 1 sha256 xxxxxx
ASA(config)# ntp server 10.1.12.2 key 1 prefer
ASA(config)# ntp server 10.1.48.10 key 1
ASA(config)# end

Check Contents

Review the Cisco ASA configuration to verify it authenticates NTP sources using authentication with FIPS-compliant algorithms as shown in the configuration example below:

ntp authenticate
ntp trusted-key 1
ntp authentication-key 1 sha256 xxxxxx
ntp server 10.1.12.2 key 1 prefer
ntp server 10.1.48.10 key 1

Note: For ASAs running on Firepower Chassis hardware, the NTP settings are visible in the FXOS web UI only (not in the ASA CLI or ASDM web UI).

If the Cisco ASA is not configured to authenticate NTP sources using authentication with FIPS-compliant algorithms, this is a finding.

The Cisco ASA must be configured to authenticate Network Time Protocol (NTP) sources using authentication with FIPS-compliant algorithms.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key