STIGQter: STIG Summary: Cisco ISE NDM Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco ISE must use FIPS-validated SHA-2 (or greater) to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications.

DISA Rule

SV-242653r961050_rule

Vulnerability Number

V-242653

Group Title

SRG-APP-000179-NDM-000265

Rule Version

CSCO-NM-000480

Severity

CAT I

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Enable FIPS Mode in Cisco ISE to ensure FIPS 140-2/3 algorithms are used in all security functions requiring cryptographic functions.

1. Choose Administration >> System >> Settings >> FIPS Mode.
2. Choose the "Enabled" option from the FIPS Mode drop-down list.
3. Click "Save" and restart the node.

NOTE: Configuring FIPS mode is the required DoD configuration. However, this requirement can be lowered to a CAT 2 if the alternative manual configuration is used to configure SHA-2 or higher hash function to protect the integrity of HMAC, KDFs, Random Bit Generation, and hash-only applications.

Check Contents

Navigate to Administration >> System >> Settings >> FIPS Mode.

Verify FIPS Mode is enabled.

If FIPS Mode is enabled, this is not a finding.

If FIPS mode is not configured, but the Cisco ISE is configured using an alternative manual method to configure SHA-2 (or greater) to protect the integrity of HMAC, KDFs, Random Bit Generation, and hash-only applications, this can be lowered to a CAT 2 finding.

Vulnerability Number

V-242653

Documentable

False

Rule Version

CSCO-NM-000480

Severity Override Guidance

Navigate to Administration >> System >> Settings >> FIPS Mode.

Verify FIPS Mode is enabled.

If FIPS Mode is enabled, this is not a finding.

If FIPS mode is not configured, but the Cisco ISE is configured using an alternative manual method to configure SHA-2 (or greater) to protect the integrity of HMAC, KDFs, Random Bit Generation, and hash-only applications, this can be lowered to a CAT 2 finding.

Check Content Reference

M

Target Key

5384