| Checked | Name | Title |
|---|
| ☐ | SV-242607r714131_rule | For the account of last resort, the Cisco ISE must limit the number of concurrent sessions to one. |
| ☐ | SV-242608r714134_rule | The Cisco ISE must change the password for the local CLI and web-based account when members who have access to the password leave the role and are no longer authorized access. |
| ☐ | SV-242609r714137_rule | For the local web-based account of last resort, the Cisco ISE must automatically audit account creation. |
| ☐ | SV-242610r714140_rule | For the local web-based account of last resort and the default local CLI account, the Cisco ISE must automatically audit account modification. |
| ☐ | SV-242611r714143_rule | For the local web-based account of last resort, the Cisco ISE must automatically audit account disabling actions. |
| ☐ | SV-242612r714146_rule | For the local account of last resort, the Cisco ISE must automatically audit account removal actions. |
| ☐ | SV-242613r714149_rule | The Cisco ISE must automatically audit account enabling actions. |
| ☐ | SV-242614r714152_rule | The Cisco ISE must be configured with only one local web-based account to be used as the account of last resort in the event the authentication server is unavailable. |
| ☐ | SV-242615r714155_rule | The Cisco ISE must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
| ☐ | SV-242616r714158_rule | The Cisco ISE must audit the execution of privileged functions. |
| ☐ | SV-242617r714161_rule | The Cisco ISE must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes. |
| ☐ | SV-242618r714164_rule | For the local account of last resort, the Cisco ISE must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. |
| ☐ | SV-242619r714167_rule | The Cisco ISE must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. |
| ☐ | SV-242620r714170_rule | The Cisco ISE must generate audit records when successful attempts to access privileges occur. |
| ☐ | SV-242621r714173_rule | The Cisco ISE must generate audit records when successful attempts to modify administrator privileges occur. |
| ☐ | SV-242622r714176_rule | The Cisco ISE must generate audit records when successful attempts to delete administrator privileges occur. |
| ☐ | SV-242623r714179_rule | The Cisco ISE must generate audit records when successful logon attempts occur. |
| ☐ | SV-242624r714182_rule | The Cisco ISE must generate audit records for privileged activities or other system-level access. |
| ☐ | SV-242625r714185_rule | The Cisco ISE must generate audit records when concurrent logons from different workstations occur. |
| ☐ | SV-242626r714188_rule | The Cisco ISE must limit audit record storage capacity for all locally stored logs. |
| ☐ | SV-242627r714191_rule | The Cisco ISE must configure a remote syslog where audit records are stored on a centralized logging target that is different from the system being audited. |
| ☐ | SV-242628r714194_rule | The Cisco ISE must send an alarm to one or more individuals when the monitoring collector process has an error or failure. |
| ☐ | SV-242629r714197_rule | The Cisco ISE must be configured to synchronize internal information system clocks using redundant authoritative time sources. |
| ☐ | SV-242630r714200_rule | The Cisco ISE must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC). |
| ☐ | SV-242631r714203_rule | The Cisco ISE must audit the enforcement actions used to restrict access associated with changes to the device. |
| ☐ | SV-242632r714206_rule | The Cisco ISE must enforce access restrictions associated with changes to the firmware, OS, and hardware components. |
| ☐ | SV-242633r714209_rule | The Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access. |
| ☐ | SV-242634r714212_rule | The Cisco ISE must be running an operating system release that is currently supported by the vendor. |
| ☐ | SV-242635r714215_rule | The Cisco ISE local uses must use role-based access control and role-based access control policies over defined subjects and objects. |
| ☐ | SV-242636r714218_rule | The Cisco ISE must generate log records for a locally developed list of auditable events. |
| ☐ | SV-242637r714221_rule | The Cisco ISE must be configured to conduct backups of system level information contained in the information system when changes occur. |
| ☐ | SV-242638r714224_rule | The Cisco ISE must conduct backups of information system documentation, including security-related configuration files when changes occur or weekly, whichever is sooner. |
| ☐ | SV-242639r714227_rule | The Cisco ISE must use DoD-approved PKI rather than proprietary or self-signed device certificates. |
| ☐ | SV-242640r714230_rule | The Cisco ISE must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. |
| ☐ | SV-242641r714233_rule | The Cisco ISE must be configured to disable Wireless Setup for production systems. |
| ☐ | SV-242642r714236_rule | For accounts using password authentication, the Cisco ISE must implement replay-resistant authentication mechanisms for network access to privileged accounts. |
| ☐ | SV-242643r714239_rule | The Cisco ISE must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). |
| ☐ | SV-242644r714242_rule | The Cisco ISE must authenticate Network Time Protocol sources using authentication that is cryptographically based. |
| ☐ | SV-242645r714245_rule | For accounts using password authentication, the Cisco ISE must enforce a minimum 15-character password length. |
| ☐ | SV-242646r714248_rule | For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one upper-case character be used. |
| ☐ | SV-242647r714251_rule | For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one lower-case character be used. |
| ☐ | SV-242648r714254_rule | For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one digit be used. |
| ☐ | SV-242649r714257_rule | For accounts using password authentication, the Cisco ISE must enforce password complexity by requiring that at least one special character be used. |
| ☐ | SV-242650r714260_rule | For accounts using password authentication, the Cisco ISE must require that when a password is changed, the characters are changed in at least eight of the positions within the password. |
| ☐ | SV-242651r714263_rule | For accounts using password authentication, the Cisco ISE must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process. |
| ☐ | SV-242652r714266_rule | The Cisco ISE must prohibit the use of cached authenticators after an organization-defined time period. |
| ☐ | SV-242653r714269_rule | The Cisco ISE must use FIPS-validated SHA-2 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, and hash-only applications. |
| ☐ | SV-242654r714272_rule | The Cisco ISE must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications. |
| ☐ | SV-242655r714275_rule | The Cisco ISE must verify the checksum value of any software download, including install files (ISO or OVA), patch files, and upgrade bundles. |
| ☐ | SV-242656r714278_rule | The Cisco ISE must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions. |
| ☐ | SV-242657r714281_rule | The Cisco ISE must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements. |
| ☐ | SV-242658r714284_rule | The Cisco ISE must generate unique session identifiers using a FIPS 140-2 approved Random Number Generator (RNG) using DRGB. |
| ☐ | SV-242659r720805_rule | The Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored. |
| ☐ | SV-242660r714290_rule | The Cisco ISE must configure the control plane to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself by configuring applicable system options and internet-options. |
| ☐ | SV-242661r714293_rule | The Cisco ISE must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO. |
| ☐ | SV-242662r714296_rule | The Cisco ISE must initiate session auditing upon startup. |
| ☐ | SV-242663r714299_rule | The Cisco ISE must generate audit records containing the full-text recording of privileged commands. |
STIGQter: STIG Summary: