STIGQter: STIG Summary: Cisco ISE NAC Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

For endpoints that require automated remediation, the Cisco ISE must be configured to redirect endpoints to a logically separate VLAN for remediation services. This is required for compliance with C2C Step 4.

DISA Rule

SV-242581r1146389_rule

Vulnerability Number

V-242581

Group Title

SRG-NET-000015-NAC-000040

Rule Version

CSCO-NC-000070

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

If required by the NAC SSP, configure the "Posture NonCompliant" authorization policy so that the result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Create an authorization policy for "Posture NonCompliant".
5. Assign the remediation VLAN result.

Check Contents

If DoD is not at C2C Step 4 or higher, this is not a finding.
If not required by the NAC SSP, this is not a finding.

Verify that the authorization policies for "Posture NonCompliant" have a result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Scan for Authorization policies with "Posture NonCompliant" condition.
5. Verify the result assigned to the authorization policy will assign the remediation VLAN.

If the result is the remediation VLAN, this is not a finding.

If posture is not mandated by the Information System Security Manager (ISSM), this is not a finding.

Vulnerability Number

V-242581

Documentable

False

Rule Version

CSCO-NC-000070

Severity Override Guidance

If DoD is not at C2C Step 4 or higher, this is not a finding.
If not required by the NAC SSP, this is not a finding.

Verify that the authorization policies for "Posture NonCompliant" have a result that will assign the remediation VLAN.

1. Work Centers >> Network Access >> Policy Sets.
2. Choose ">" on the desired policy set.
3. Expand Authorization Policy.
4. Scan for Authorization policies with "Posture NonCompliant" condition.
5. Verify the result assigned to the authorization policy will assign the remediation VLAN.

If the result is the remediation VLAN, this is not a finding.

If posture is not mandated by the Information System Security Manager (ISSM), this is not a finding.

Check Content Reference

M

Target Key

5383