STIGQter: STIG Summary: Cisco ACI NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Cisco ACI must use DOD-approved Network Time Protocol (NTP) sources that use authentication that is cryptographically based.

DISA Rule

SV-271923r1114182_rule

Vulnerability Number

V-271923

Group Title

SRG-APP-000395-NDM-000347

Rule Version

CACI-ND-000008

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure NTP servers.

Create an NTP policy:
1. Navigate to Fabric >> Quickstart, and then click "Create an NTP Policy Link".
2. Fill out the form.
- Provide a name for the policy.
- Set the State to "Enabled".
3. Click "Next" to define the NTP Sources.
4. Define at least two DOD-approved time servers. Leave all the default options and click "OK". Refer to the note below.
5. Navigate to Fabric >> Fabric Policies sub menu >> Pods >> Policy Groups folder to add the NTP Policy to the appropriate Fabric Pod Policy or group to assign to one or more Pods in the fabric.
6. Right-click on the Policy Groups folder. Select an existing Pod Policy Group or create a new group.
7. Select the policy for NTP created in the previous step.
8. Navigate to Fabric >> Fabric Policies sub menu >> Pods >> Profiles >> Pod Profile >> default. If needed, with the default Pod Selector selected in the navigation pane, change the Fabric Policy Group to the one created in the previous step.

Note: DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); USNO time servers; and/or the GPS. The secondary time source must be located in a different geographic region than the primary time source.

Check Contents

Review the NTP configuration to verify it is compliant:
1. Navigate to Fabric >> Fabric Policies >> Fabric Security.
2. Expand "Policies".
3. Expand "Pod".
4. Expand "Date and Time".
5. Expand each "Date and Time Policy".
6. Verify at least two DOD-approved time sources are configured.

Note: DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

If Cisco ACI fabric does not use DOD-approved NTP sources that use authentication that is cryptographically based, this is a finding.

Vulnerability Number

V-271923

Documentable

False

Rule Version

CACI-ND-000008

Severity Override Guidance

Review the NTP configuration to verify it is compliant:
1. Navigate to Fabric >> Fabric Policies >> Fabric Security.
2. Expand "Policies".
3. Expand "Pod".
4. Expand "Date and Time".
5. Expand each "Date and Time Policy".
6. Verify at least two DOD-approved time sources are configured.

Note: DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

If Cisco ACI fabric does not use DOD-approved NTP sources that use authentication that is cryptographically based, this is a finding.

Check Content Reference

M

Target Key

5682