STIGQter: STIG Summary: Cisco ACI NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The Cisco ACI must be configured to assign appropriate user roles or access levels to authenticated users.

DISA Rule

SV-271927r1168428_rule

Vulnerability Number

V-271927

Group Title

SRG-APP-000033-NDM-000212

Rule Version

CACI-ND-000012

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

10

Fix Recommendation

View the SSP to determine the required organization-defined roles and the least privilege policies required for each role. For example, audit administrator, crypto administrator, system administrator, etc. Assign remote users to roles based on SSP and least privileges. Carefully assign capabilities to each role based on SSP role assignments. Remote authentication server is required, but roles can be created, deleted, or associated access privileges to nodes and resources update in the APIC. To create a new role with reduced permissions, do the following:

To create or modify roles:
1. From the GUI, navigate to Admin >> AAA >> Security >> Roles.
2. Create custom roles with appropriate privileges (e.g., read-write access to specific objects).
3. Associate users with these roles, allowing them to perform specific tasks within the ACI fabric.

Note: This procedure may use preconfigured rules and privileges. Security Domains, Rules, and Custom Roles may also be used depending on the desired architecture and complexity of the implementation. Refer to the vendor documentation to create custom rules, privileges combinations, Rules, and Security domains. These roles are assigned to the remote users in the external authentication server.

Check Contents

Verify users are assigned roles based on the SSP. This requirement does not apply to the account of last resort.

From the GUI, navigate to Admin >> AAA >> Security >> Roles or have the site demonstrate the method used for role and privilege separation.

Verify that the roles are associated with the users in compliance with the SSP required roles and privileges. Read and write access rights must match the level of granularity required by the SSP.

If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.

Vulnerability Number

V-271927

Documentable

False

Rule Version

CACI-ND-000012

Severity Override Guidance

Verify users are assigned roles based on the SSP. This requirement does not apply to the account of last resort.

From the GUI, navigate to Admin >> AAA >> Security >> Roles or have the site demonstrate the method used for role and privilege separation.

Verify that the roles are associated with the users in compliance with the SSP required roles and privileges. Read and write access rights must match the level of granularity required by the SSP.

If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.

Check Content Reference

M

Target Key

5682