STIGQter STIGQter: STIG Summary:

Network Device Management Security Requirements Guide

Version: 5

Release: 5 Benchmark Date: 01 Jul 2026

CheckedNameTitle
☐SV-202013r960777_ruleThe network device must automatically audit account creation.
☐SV-202014r960780_ruleThe network device must automatically audit account modification.
☐SV-202015r960783_ruleThe network device must automatically audit account disabling actions.
☐SV-202016r960786_ruleThe network device must automatically audit account removal actions.
☐SV-202017r1137874_ruleThe network device must be configured to assign appropriate user roles or access levels to authenticated users.
☐SV-202018r1137875_ruleThe network device must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.
☐SV-202019r960840_ruleThe network device must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
☐SV-202020r960843_ruleThe network device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.
☐SV-202021r960846_ruleThe network device must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
☐SV-202025r960864_ruleThe network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
☐SV-202028r960885_ruleThe network device must generate audit records when successful/unsuccessful attempts to access privileges occur.
☐SV-202029r960888_ruleThe network device must initiate session auditing upon startup.
☐SV-202030r960891_ruleThe network device must produce audit log records containing sufficient information to establish what type of event occurred.
☐SV-202031r960894_ruleThe network device must produce audit records containing information to establish when (date and time) the events occurred.
☐SV-202032r960897_ruleThe network device must produce audit records containing information to establish where the events occurred.
☐SV-202033r960900_ruleThe network device must produce audit log records containing information to establish the source of events.
☐SV-202034r960903_ruleThe network device must produce audit records that contain information to establish the outcome of the event.
☐SV-202035r960906_ruleThe network device must generate audit records containing information that establishes the identity of any individual or process associated with the event.
☐SV-202036r960909_ruleThe network device must generate audit records containing the full-text recording of privileged commands.
☐SV-202039r960927_ruleThe network device must use internal system clocks to generate time stamps for audit records.
☐SV-202040r960933_ruleThe network device must protect audit information from unauthorized modification.
☐SV-202041r960936_ruleThe network device must protect audit information from unauthorized deletion.
☐SV-202042r960939_ruleThe network device must protect audit tools from unauthorized access.
☐SV-202043r960942_ruleThe network device must protect audit tools from unauthorized modification.
☐SV-202044r960945_ruleThe network device must protect audit tools from unauthorized deletion.
☐SV-202047r984089_ruleThe network device must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
☐SV-202048r960960_ruleThe network device must limit privileges to change the software resident within software libraries.
☐SV-202049r1043177_ruleThe network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services
☐SV-202051r1051115_ruleThe network device must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
☐SV-202054r984091_ruleThe network device must be configured to authenticate each administrator prior to authorizing privileges based on assignment of group or role.
☐SV-202055r960993_ruleThe network device must implement replay-resistant authentication mechanisms for network access to privileged accounts.
☐SV-202057r984092_ruleThe network device must enforce a minimum 15-character password length.
☐SV-202059r984095_ruleThe network device must enforce password complexity by requiring that at least one uppercase character be used.
☐SV-202060r984098_ruleThe network device must enforce password complexity by requiring that at least one lowercase character be used.
☐SV-202061r984099_ruleThe network device must enforce password complexity by requiring that at least one numeric character be used.
☐SV-202062r984100_ruleThe network device must enforce password complexity by requiring that at least one special character be used.
☐SV-202063r1043189_ruleThe network device must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
☐SV-202064r984103_ruleThe network device must be configured to store passwords using an approved salted key derivation function, preferably using a keyed hash for password-based authentication.
☐SV-202065r961029_ruleThe network device must transmit only encrypted representations of passwords.
☐SV-202071r961047_ruleThe network device must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
☐SV-202072r961050_ruleThe network device must use FIPS 140-2 approved algorithms for authentication to a cryptographic module.
☐SV-202074r961068_ruleThe network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements.
☐SV-202075r1043179_ruleThe network device must invalidate session identifiers upon administrator logout or other session termination.
☐SV-202076r1043180_ruleThe network device must recognize only system-generated session identifiers.
☐SV-202077r1043181_ruleThe network device must generate unique session identifiers using a FIPS 140-2 approved random number generator.
☐SV-202078r961128_ruleThe network device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
☐SV-202085r961224_ruleThe network device must be configured to provide a logout mechanism for administrator-initiated communication sessions.
☐SV-202086r961227_ruleThe network device must display an explicit logout message to administrators indicating the reliable termination of authenticated communications sessions.
☐SV-202087r984107_ruleThe network device must terminate shared/group account credentials when members leave the group.
☐SV-202088r961290_ruleThe network device must automatically audit account enabling actions.
☐SV-202091r961317_ruleIf the network device uses discretionary access control, the network device must enforce organization-defined discretionary access control policies over defined subjects and objects.
☐SV-202092r1137878_ruleIf the network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.
☐SV-202093r961353_ruleThe network device must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
☐SV-202094r961362_ruleThe network device must audit the execution of privileged functions.
☐SV-202098r961392_ruleThe network device must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.
☐SV-202100r961401_ruleThe network device must generate an immediate real-time alert of all audit failure events requiring real-time alerts.
☐SV-202102r961443_ruleThe network device must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
☐SV-202103r961446_ruleThe network device must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.
☐SV-202105r984110_ruleThe network device must prohibit installation of software without explicit privileged status.
☐SV-202106r961461_ruleThe network device must enforce access restrictions associated with changes to device configuration.
☐SV-202107r984111_ruleThe network device must audit the enforcement actions used to restrict access associated with changes to the device.
☐SV-202111r961506_ruleThe network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
☐SV-202112r961506_ruleThe network device must authenticate Network Time Protocol sources using authentication that is cryptographically based.
☐SV-202115r961521_ruleThe network device must prohibit the use of cached authenticators after an organization-defined time period.
☐SV-202116r961545_ruleNetwork devices performing maintenance functions must restrict use of these functions to authorized personnel only.
☐SV-202117r961554_ruleThe network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.
☐SV-202118r961557_ruleThe network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions
☐SV-202119r961620_ruleThe network device must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.
☐SV-202120r987719_ruleIf the network device uses mandatory access control, the network device must enforce organization-defined mandatory access control policies over all subjects and objects.
☐SV-202121r961800_ruleThe network device must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur.
☐SV-202122r961812_ruleThe network device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur.
☐SV-202123r961824_ruleThe network device must generate audit records when successful/unsuccessful logon attempts occur.
☐SV-202124r961827_ruleThe network device must generate audit records for privileged activities or other system-level access.
☐SV-202125r961830_ruleThe network device must generate audit records showing starting and ending time for administrator access to the system.
☐SV-202126r961833_ruleThe network device must generate audit records when concurrent logons from different workstations occur.
☐SV-202127r961860_ruleThe network device must off-load audit records onto a different system or media than the system being audited.
☐SV-202131r961863_ruleThe network device must enforce access restrictions associated with changes to the system components.
☐SV-202132r1137887_ruleThe network device must be configured to use at least one authentication server for the purpose of authenticating users prior to granting administrative access. For boundary devices, two authentication servers are required.
☐SV-202136r961863_ruleThe network device must be configured to conduct backups of system level information contained in the information system when changes occur.
☐SV-202137r961863_ruleThe network device must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.
☐SV-202139r961863_ruleThe network device must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
☐SV-202140r960735_ruleThe network device must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type.
☐SV-213467r1137890_ruleThe network device must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required.
☐SV-216508r961863_ruleThe network device must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
☐SV-237779r1007840_ruleThe network device must be configured to use DoD PKI as multi-factor authentication (MFA) for interactive logins.
☐SV-237780r961038_ruleThe network device must be configured to use DoD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication.
☐SV-237781r961044_ruleThe network device, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
☐SV-256777r1137881_ruleThe network device must install security-relevant firmware updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).
☐SV-264293r984120_ruleThe network device must be configured to alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
☐SV-264294r984123_ruleThe network device must be configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.
☐SV-264295r984126_ruleThe network device must be configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements.
☐SV-264299r1067634_ruleThe network device must be configured to verify, when users create or update passwords, the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-5 (1) (a) for password-based authentication.
☐SV-264301r984144_ruleThe network device must be configured to allow user selection of long passwords and passphrases, including spaces and all printable characters for password-based authentication.
☐SV-264303r1067639_ruleThe network device must be configured to implement certificate revocation checking to support path discovery and validation for public key-based authentication.
☐SV-264304r984153_ruleThe network device must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.
☐SV-264305r984156_ruleThe network device must be configured to include only approved trust anchors in trust stores or certificate stores managed by the organization.
☐SV-264307r984162_ruleThe network device must be configured to synchronize system clocks within and between systems or system components.
☐SV-264308r984165_ruleThe network device must be configured to compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.
☐SV-278996r1207746_ruleThe network device hardware and software must be a version supported by the vendor.