STIGQter: STIG Summary: Cisco ISE NDM Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco ISE must be configured to implement cryptographic mechanisms using a FIPS 140-2 validated algorithm to protect the confidentiality of remote maintenance sessions.

DISA Rule

SV-242656r961557_rule

Vulnerability Number

V-242656

Group Title

SRG-APP-000412-NDM-000331

Rule Version

CSCO-NM-000510

Severity

CAT I

CCI(s)

• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Enable FIPS Mode in Cisco ISE to ensure FIPS 140-2/3 algorithms are used in all security functions requiring cryptographic functions.

1. Choose Administration >> System >> Settings >> FIPS Mode.
2. Choose the "Enabled" option from the FIPS Mode drop-down list.
3. Click "Save" and restart the node.

NOTE: Configuring FIPS mode is the required DoD configuration. However, this requirement can be lowered to a CAT 2 if the alternative manual configuration is used to configure a FIPS 140-2/3 validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.

Check Contents

Navigate to Administration >> System >> Settings >> FIPS Mode.

Verify FIPS Mode is enabled.

If FIPS Mode is enabled, this is not a finding.

If FIPS mode is not configured, but the Cisco ISE is configured using an alternative manual method to configure to configure configure a FIPS 140-2/3 validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this can be lowered to a CAT 2 finding.

Vulnerability Number

V-242656

Documentable

False

Rule Version

CSCO-NM-000510

Severity Override Guidance

Navigate to Administration >> System >> Settings >> FIPS Mode.

Verify FIPS Mode is enabled.

If FIPS Mode is enabled, this is not a finding.

If FIPS mode is not configured, but the Cisco ISE is configured using an alternative manual method to configure to configure configure a FIPS 140-2/3 validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this can be lowered to a CAT 2 finding.

Check Content Reference

M

Target Key

5384