# stig_rules

vuln_id: V-259417
rule_id: SV-259417r961155_rule
severity: CAT II
title: Windows DNS response rate limiting (RRL) must be enabled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting can prevent someone from sending a denial-of-service attack using the DNS servers. For instance, a bot net can send requests to the DNS server using the IP address of a third computer as the requestor. Without RRL, the DNS servers might respond to all the requests, flooding the third computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  As an administrator, run PowerShell and enter the command "Set-DnsServerResponseRateLimiting" to apply default values or "Set-DnsServerResponseRateLimiting -WindowInSec 7 -LeakRate 4 -TruncateRate 3 -ErrorsPerSec 8 -ResponsesPerSec 8". 

  These settings are just an example. For more information, go to:
  https://learn.microsoft.com/en-us/powershell/module/dnsserver/set-dnsserverresponseratelimiting?view=windowsserver2022-ps

check_text:
  As an administrator, run PowerShell and enter the following command: 
  "Get-DnsServerResponseRateLimiting". 

  If "Mode" is not set to "Enable", this is a finding.


vuln_id: V-243466
rule_id: SV-243466r959010_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Membership to the Enterprise Admins group must be restricted to accounts used only to manage the Active Directory Forest.

description:
  <VulnDiscussion>The Enterprise Admins group is a highly privileged group.  Personnel who are system administrators must log on to Active Directory systems only using accounts with the level of authority necessary. Only system administrator accounts used exclusively to manage the Active Directory Forest may be members of the Enterprise Admins group. A separation of administrator responsibilities helps mitigate the risk of privilege escalation resulting from credential theft attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create the necessary documentation that identifies the members of the Enterprise Admins group.  Ensure that each member has a separate unique account that can only be used to manage the Active Directory Forest.  Remove any Enterprise Admin accounts from other administrator groups.

check_text:
  Review the Enterprise Admins group in Active Directory Users and Computers.  Any accounts that are members of the Enterprise Admins group must be documented with the IAO.  Each Enterprise Administrator must have a separate unique account specifically for managing the Active Directory forest.  

  If any account listed in the Enterprise Admins group is a member of other administrator groups including the Domain Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding.


vuln_id: V-243467
rule_id: SV-243467r959010_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Membership to the Domain Admins group must be restricted to accounts used only to manage the Active Directory domain and domain controllers.

description:
  <VulnDiscussion>The Domain Admins group is a highly privileged group.  Personnel who are system administrators must log on to Active Directory systems only using accounts with the level of authority necessary. Only system administrator accounts used exclusively to manage an Active Directory domain and domain controllers may be members of the Domain Admins group. A separation of administrator responsibilities helps mitigate the risk of privilege escalation resulting from credential theft attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create the necessary documentation that identifies the members of the Domain Admins group.  Ensure that each member has a separate unique account that can only be used to manage the Active Directory domain and domain controllers.  Remove any Domain Admin accounts from other administrator groups.

check_text:
  Review the Domain Admins group in Active Directory Users and Computers.  Any accounts that are members of the Domain Admins group must be documented with the IAO.  Each Domain Administrator must have a separate unique account specifically for managing the Active Directory domain and domain controllers.  

  If any account listed in the Domain Admins group is a member of other administrator groups including the Enterprise Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding.


vuln_id: V-243468
rule_id: SV-243468r959010_rule
severity: CAT II
title: Administrators must have separate accounts specifically for managing domain member servers.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Personnel who are system administrators must log on to domain systems only using accounts with the minimum level of authority necessary. Only system administrator accounts used exclusively to manage domain member servers may be members of an administrator group for domain member servers. A separation of administrator responsibilities helps mitigate the risk of privilege escalation resulting from credential theft attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create the necessary documentation that identifies the members of domain member server administrator groups.  Ensure that each member has a separate unique account that can only be used to manage domain member servers.  Remove any domain member server accounts from other administrator groups.

check_text:
  Review the membership groups in Active Directory Users and Computers.  Membership groups must be designated at the domain level specifically for domain member server administrators. Domain member server administrator groups and any accounts that are members of the groups must be documented with the IAO.  Each member server administrator must have a separate unique account specifically for managing member servers.  

  If any account listed in a domain member server administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain workstation administrator groups, this is a finding.


vuln_id: V-243469
rule_id: SV-243469r959010_rule
severity: CAT II
title: Administrators must have separate accounts specifically for managing domain workstations.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Personnel who are system administrators must log on to domain systems only using accounts with the minimum level of authority necessary. Only system administrator accounts used exclusively to manage domain workstations may be members of an administrators group for domain workstations. A separation of administrator responsibilities helps mitigate the risk of privilege escalation resulting from credential theft attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Create the necessary documentation that identifies the members of domain workstation administrator groups.  Ensure that each member has a separate unique account that can only be used to manage domain workstations.  Remove any domain workstation administrator accounts from other administrator groups.

check_text:
  Review the membership groups in Active Directory Users and Computers.  Membership groups must be designated at the domain level specifically for domain workstation administrators. Domain workstation administrator groups and any accounts that are members of the groups must be documented with the IAO.  Each domain workstation administrator must have a separate unique account specifically for managing domain workstations.  

  If any account listed in a domain workstation administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain member server administrator groups, this is a finding.


vuln_id: V-243470
rule_id: SV-243470r959010_rule
severity: CAT I
title: Delegation of privileged accounts must be prohibited.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Privileged accounts such as those belonging to any of the administrator groups must not be trusted for delegation. Allowing privileged accounts to be trusted for delegation provides a means for privilege escalation from a compromised system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open Active Directory Users and Computers. View the properties of all privileged accounts. Under the Account tab, select "Account is sensitive and cannot be delegated" in the Account Options section.

check_text:
  Review the properties of all privileged accounts in Active Directory Users and Computers. Under the Account tab, verify "Account is sensitive and cannot be delegated" is selected in the Account Options section. If delegation is not prohibited for any  privileged account, this is a finding.


vuln_id: V-243471
rule_id: SV-243471r958494_rule
severity: CAT II
title: Local administrator accounts on domain systems must not share the same password.
cci: CCI-001941
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Local administrator accounts on domain systems must use unique passwords. In the event a domain system is compromised, sharing the same password for local administrator accounts on domain systems will allow an attacker to move laterally and compromise multiple domain systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set unique passwords for all local administrator accounts on domain systems. 

  It is highly recommended to use Microsoft's LAPS, which provides an automated solution for maintaining and regularly changing a local administrator password for domain-joined systems. If additional local administrator accounts exist across systems, the organization must have a process to require unique passwords on each system for the additional accounts.

  The AO may approve other automated solutions that provide this capability.

  See Microsoft Security Advisory 3062591 for additional information and download of LAPS.
  https://www.microsoft.com/en-us/download/details.aspx?id=46899

check_text:
  Verify local administrator accounts on domain systems are using unique passwords. If local administrator accounts on domain systems are sharing a password, this is a finding.

  It is highly recommended to use Microsoft's Local Administrator Password Solution (LAPS), which provides an automated solution for maintaining and regularly changing a local administrator password for domain-joined systems. LAPS can manage a single local administrator account. The default is the built-in administrator account; however, it can be configured to manage an administrator account of a different name. If additional local administrator accounts exist across systems, the organization must have a process to require unique passwords on each system for the additional accounts.

  The AO may approve other automated solutions that provide this capability.

  If LAPS has been installed and enabled in the domain, the following PowerShell query will return a list of systems that do not have a local administrator password managed by LAPS. (The LAPS PowerShell module requires PowerShell 2.0 or higher and .NET Framework 4.0.)

  Open "Windows PowerShell".
  If the LAPS PowerShell module has not been previously imported, execute the following first: "Import-Module AdmPwd.ps".
  Execute "Get-AdmPwdPassword -ComputerName * | Where-object {$_.password -eq $null}"

  Review the returned list for validity.

  Exclude computers with "OU=Domain Controllers" in the DistinguishedName field.  Other possible exceptions include but are not limited to non-Windows computers in Active Directory.

  If any active/deployed Windows systems that are not managed by another process to ensure unique passwords for local administrator accounts are listed, this is a finding.

  If the query fails, the organization must demonstrate that passwords for local administrator accounts are properly managed to ensure unique passwords for each. If not, this is a finding.


vuln_id: V-243472
rule_id: SV-243472r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Separate smart cards must be used for Enterprise Admin (EA) and Domain Admin (DA) accounts from smart cards used for other accounts.

description:
  <VulnDiscussion>A separate smart card for Enterprise Admin and Domain Admin accounts eliminates the automatic exposure of the private keys for the EA/DA accounts to less secure user platforms when the other accounts are used.  Having different certificates on one card does not provide the necessary separation.  The same smart card may be used by an administrator for both EA and DA accounts.  </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Use separate smart cards for EA and DA accounts from smart cards used for other accounts.  EA and DA accounts may be on the same smart card but must be separate from any other accounts.

check_text:
  Verify separate smart cards are used for EA and DA accounts from smart cards used for other accounts.  EA and DA accounts may be on the same smart card but must be separate from any other accounts.  If separate smart cards for EA and DA accounts from other accounts are not used, this is a finding.


vuln_id: V-243473
rule_id: SV-243473r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Separate domain accounts must be used to manage public facing servers from any domain accounts used to manage internal servers.

description:
  <VulnDiscussion>Public facing servers should be in DMZs with separate Active Directory forests.  If, because of operational necessity, this is not possible, lateral movement from these servers must be mitigated within the forest.  Having different domain accounts for administering domain joined public facing servers, from domain accounts used on internal servers, protects against an attacker's lateral movement from a compromised public facing server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the domain does not have any public facing servers, this is NA.

  Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.

  For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers.

check_text:
  If the domain does not have any public facing servers, this is NA.

  Review the local Administrators group on public facing servers.  Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

  For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers.

  If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.


vuln_id: V-243475
rule_id: SV-243475r959010_rule
severity: CAT II
title: Domain controllers must be blocked from Internet access.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion> Domain controllers provide access to highly privileged areas of a domain.  Such systems with Internet access may be exposed to numerous attacks and compromise the domain.  Restricting Internet access for domain controllers will aid in protecting these privileged areas from being compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Block domain controllers from internet access.  This can be accomplished with various methods, such as restrictions at boundary firewalls, proxy services, host based firewalls, or IPsec.   

  If a critical function requires Internet access, this must be documented and approved by the organization.

check_text:
  Verify domain controllers are blocked from Internet access.  Various methods may be employed to accomplish this, such as restrictions at boundary firewalls, through proxy services, host based firewalls or IPsec.

  Review the Internet access restrictions with the administrator.  If Internet access is not prevented, this is a finding.

  If a critical function requires Internet access, this must be documented and approved by the organization.


vuln_id: V-243476
rule_id: SV-243476r1026173_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  All accounts, privileged and unprivileged, that require smart cards must have the underlying NT hash rotated at least every 60 days.

description:
  <VulnDiscussion>When a smart card is required for a domain account, a long password, unknown to the user, is generated. This password and associated NT hash are not changed as are accounts with passwords controlled by the maximum password age. Disabling and reenabling the "Smart card is required for interactive logon" (SCRIL) replaces the NT hash of the account with a newly randomized hash. Otherwise, the existing NT hash could be reused for Pass-the-Hash in the future.

  Windows Server 2016 includes a built-in feature for SCRIL hash rolling that will automatically reset NT hashes in accordance with the existing maximum password age policy. This requires the domain functional level to be Windows Server 2016.

  In Active Directory with a domain functional level below Windows Server 2016, scripts can be used to reset the NT hashes of all domain accounts. Associated documentation should be reviewed for potential issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Windows Server 2016 with domain functional levels of Windows Server 2016:

  Open "Active Directory Administrative Center".

  Right-click on the domain name and select "Properties".

  Select "Enable rolling of expiring NTLM secrets during sign on, for users who are required to use Microsoft Passport or smart card for interactive sign on".

  Active Directory domains not at a Windows Server 2016 domain functional level:

  Rotate the NT hash for smart card-enforced accounts every 60 days.

  This can be accomplished with the use of scripts.

  DOD PKI-PKE has provided a script under PKI and PKE Tools at https://cyber.mil/pki-pke/tools-configuration-files/. Refer to the User Guide for additional information.

  NSA has also provided a PowerShell script with Pass-the-Hash guidance at https://github.com/nsacyber/Pass-the-Hash-Guidance. Running the "Invoke-SmartcardHashRefresh" cmdlet in the "PtHTools" module will trigger a change of the underlying NT hash. Refer to the site for additional information.

  Manually rolling the NT hash requires disabling and reenabling the "Smart Card required for interactive logon" option for each smart card-enforced account, which is not practical for large groups of users.

check_text:
  Windows Server 2016 with a domain functional level of Windows Server 2016:

  Open "Active Directory Administrative Center".

  Right-click on the domain name and select "Properties".

  If the "Domain functional level:" is not "Windows Server 2016", another method must be used to reset the NT hashes. See below for other options.

  If the "Domain functional level:" is "Windows Server 2016" and "Enable rolling of expiring NTLM secrets during sign on, for users who are required to use Microsoft Passport or smart card for interactive sign on" is not checked, this is a finding.

  Active Directory domains with a domain functional level below Windows Server 2016:

  Verify the organization rotates the NT hash for smart card-enforced accounts every 60 days.  

  This can be accomplished with the use of scripts.  

  DOD PKI-PKE has provided a script under PKI and PKE Tools at https://cyber.mil/pki-pke/tools-configuration-files/. Refer to the User Guide for additional information.

  NSA has also provided a PowerShell script with Pass-the-Hash guidance at https://github.com/nsacyber/Pass-the-Hash-Guidance. Running the "Invoke-SmartcardHashRefresh" cmdlet in the "PtHTools" module will trigger a change of the underlying NT hash. Refer to the site for additional information.

  Manually rolling the NT hash requires disabling and reenabling the "Smart Card required for interactive logon" option for each smart card-enforced account, which is not practical for large groups of users.

  If NT hashes for smart card-enforced accounts are not rotated every 60 days, this is a finding.


vuln_id: V-243477
rule_id: SV-243477r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  User accounts with domain level administrative privileges must be members of the Protected Users group in domains with a domain functional level of Windows 2012 R2 or higher.

description:
  <VulnDiscussion>User accounts with domain level administrative privileges are highly prized in Pass-the-Hash/credential theft attacks.  The Protected Users group provides extra protections to accounts such as preventing authentication using NTLM.

  These accounts include Enterprise and Domain Admins as well as other accounts that may have domain level privileges.

  The Protected Users group requires a domain functional level of at least Windows 2012 R2 to provide domain level protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Add user accounts from the local domain that are members of the domain level administrative groups listed below to the Protected Users group. One account may excluded to ensure availability if there are issues with Kerberos.

  Enterprise Admins (Users node)
  Domain Admins (Users node)
  Schema Admins (Users node)
  Administrators (Builtin node)
  Account Operators (Builtin node)
  Backup Operators (Builtin node)

  The use of the Protected Users group should be thoroughly tested before fully implementing.

check_text:
  If the domain functional level is not at least Windows 2012 R2, this is NA.

  Open "Windows PowerShell".

  Enter "Get-ADDomain | FL DomainMode" to determine the domain functional level.

  Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). 

  Compare membership of the Protected Users group to membership of the following groups. By default, the groups are under the node referenced; however, it is possible to move those under "Users" to another location.
  Enterprise Admins (Users node)
  Domain Admins (Users node)
  Schema Admins (Users node)
  Administrators (Builtin node)
  Account Operators (Builtin node)
  Backup Operators (Builtin node)

  It is recommended that one account be excluded to ensure availability if there are issues with Kerberos.

  Excluding the account left out for availability, if all user accounts from the local domain that are members of the domain level groups above are not also members of the Protected Users group, this is a finding. (User accounts is referring to accounts for personnel, not service accounts.)


vuln_id: V-243478
rule_id: SV-243478r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Domain-joined systems (excluding domain controllers) must not be configured for unconstrained delegation.

description:
  <VulnDiscussion>Unconstrained delegation enabled on a computer can allow the computer account to be impersonated without limitation. If delegation is required, it must be limited/constrained to the specific services and accounts required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove unconstrained delegation from computers in the domain. 

  Select "Properties" for the computer object.

  Select the "Delegation" tab.

  De-select "Trust this computer for delegation to any service (Kerberos only)"

  Configured constrained delegation for specific services where required.

check_text:
  Open "Windows PowerShell" on a domain controller.

  Enter "Get-ADComputer -Filter {(TrustedForDelegation -eq $True) -and (PrimaryGroupID -eq 515)} -Properties TrustedForDelegation, TrustedToAuthForDelegation, ServicePrincipalName, Description, PrimaryGroupID".

  If any computers are returned, this is a finding. 
  (TrustedForDelegation equaling True indicates unconstrained delegation.)

  PrimaryGroupID 515 = Domain computers (excludes DCs)
  TrustedForDelegation = Unconstrained Delegation
  TrustedToAuthForDelegation = Constrained delegation
  ServicePrincipalName = Service Names
  Description = Computer Description


vuln_id: V-243479
rule_id: SV-243479r959010_rule
severity: CAT II
title: The Directory Service Restore Mode (DSRM) password must be changed at least annually.
fix_text: Change the DSRM password at least annually.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Directory Service Restore Mode (DSRM) password, used to log on to a domain controller (DC) when rebooting into the server recovery mode, is very powerful.  With a weak or known password, someone with local access to the DC can reboot the server and copy or modify the Active Directory database without leaving any trace of the activity.

  Failure to change the DSRM password periodically could allow compromised of the Active Directory.  It could also allow an unknown (lost) password to go undetected. If not corrected during a periodic review, the problem might surface during an actual recovery operation and delay or prevent the recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Verify the organization has a process that addresses DSRM password change frequency.

  If DSRM passwords are not changed at least annually, this is a finding.


vuln_id: V-243480
rule_id: SV-243480r959010_rule
severity: CAT II
title: The domain functional level must be at a Windows Server version still supported by Microsoft.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Domains operating at functional levels below Windows Server versions no longer supported by Microsoft reduce the level of security in the domain and forest as advanced features of the directory are not available.  This also prevents the addition of domain controllers to the domain using Windows Server versions prior to the current domain functional level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Raise the domain functional level to Windows Server 2016.  Using the highest domain functional level supported by the domain controllers is recommended.

  Raising the domain functional level needs to be carefully planned and implemented.  This prevents the addition of domain controllers to the domain using Windows versions prior to the current domain functional level. 

  Refer to Microsoft documentation for the process and requirements of raising the domain functional level.

check_text:
  Open "Active Directory Domains and Trusts" (run "domain.msc") or "Active Directory Users and Computers" (run "dsa.msc").
  Right-click in the left pane on the name of the Domain being reviewed.
  Select "Raise domain functional level..."
  The current domain functional level will be displayed (as well as the option to raise the domain functional level).
  Select "Cancel" to exit.

  Alternately, using PowerShell (Windows Server 2016):
  Select "Active Directory Module for Windows PowerShell", available in Administrative Tools or the Start Screen.
  Run "Get-ADDomain".
  View the value for "DomainMode:"

  If the domain functional level is not Windows Server 2016, this is a finding.

  Using the highest domain functional level supported by the domain controllers is recommended.


vuln_id: V-243481
rule_id: SV-243481r959010_rule
severity: CAT II
title: Access to need-to-know information must be restricted to an authorized community of interest.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Because trust relationships effectively eliminate a level of authentication in the trusting domain or forest, they represent less stringent access control at the domain or forest level in which the resource resides. To mitigate this risk, trust relationships must be documented so that they can be readily verified during periodic inspections designed to validate only approved trusts are configured in AD.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Delete the unneeded trust relationship or document the access requirement or mission need for the trust.

check_text:
  1. Before performing this check, perform V-243494, which validates the trusts within the documentation are current within AD.

  2. Obtain documentation of the site's approved trusts from the site representative.  

  3. For each of the identified trusts, verify the documentation includes a justification or explanation of the need-to-know basis of the trust. 

  4. If the need for the trust is not documented, this is a finding.


vuln_id: V-243482
rule_id: SV-243482r959010_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Interconnections between DoD directory services of different classification levels must use a cross-domain solution that is approved for use with inter-classification trusts.

description:
  <VulnDiscussion>If a robust cross-domain solution is not used, then it could permit unauthorized access to classified data. To support secure access between resources of different classification levels, the solution must meet discretionary access control requirements. There are currently, no DOD- approved solutions. 

  Further Policy Details: Do not define trust relationships between domains, forests, or realms with resources at different classification levels. The configuration of a trust relationship is one of the steps used to allow users in one AD domain to access resources in another domain, forest, or Kerberos realm. (This check does not apply to trusts with non-DoD organizations since these trusts are examined in a previous check.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Delete the trust relationship that is defined between entities with resources at different DoD classification levels.

check_text:
  1. Refer to the list of identified trusts and the trust documentation provided by the site representative. (Obtained in V-8530)

  2. For each of the identified trusts between DoD organizations, compare the classification level (unclassified, confidential, secret, and top secret) of the domain being reviewed with the classification level of the other trust party as noted in the documentation.

  3. If the classification level of the domain being reviewed is different than the classification level of any of the entities for which a trust relationship is defined, then this is a finding.


vuln_id: V-243483
rule_id: SV-243483r959010_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  A controlled interface must have interconnections among DoD information systems operating between DoD and non-DoD systems or networks.

description:
  <VulnDiscussion>The configuration of an AD trust relationship is one of the steps used to allow users in one domain to access resources in another domain, forest, or Kerberos realm. When a trust is defined between a DoD organization and a non-DoD organization, the security posture of the two organizations might be significantly different. If the non-DoD organization maintained a less secure environment and that environment were compromised, the presence of the AD trust might allow the DoD environment to be compromised also.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Obtain DAA approval and document external, forest, or realm trust relationship. Or obtain documentation of the network connection approval and explicit trust approval by the DAA.

check_text:
  1. Refer to the list of identified trusts obtained in a previous check (V8530).

  2. For each of the identified trusts, determine if the other trust party is a non-DoD entity. For example, if the fully qualified domain name of the other party does not end in ".mil", the other party is probably not a DoD entity.

  3. Review the local documentation approving the external network connection and documentation indicating explicit approval of the trust by the DAA.

  4. The external network connection documentation is maintained by the IAO\NSO for compliance with the Network Infrastructure STIG.

  5. If any trust is defined with a non-DoD system and there is no documentation indicating approval of the external network connection and explicit DAA approval of the trust, then this is a finding.


vuln_id: V-243484
rule_id: SV-243484r958482_rule
severity: CAT II
cci: CCI-000764
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Security identifiers (SIDs) must be configured to use only authentication data of directly trusted external or forest trust.

description:
  <VulnDiscussion>Under some circumstances it is possible for attackers or rogue administrators that have compromised a domain controller in a trusted domain to use the SID history attribute (sIDHistory) to associate SIDs with new user accounts, granting themselves unauthorized rights. To help prevent this type of attack, SID filter quarantining is enabled by default on all external trusts. However, it is possible for an administrator to change this setting or the trust may have been created in an older version of AD. 

  SID filtering causes SID references that do not refer to the directly trusted domain or forest to be removed from inbound access requests in the trusting domain. Without SID filtering, access requests could contain spoofed SIDs, permitting unauthorized access.  

  In cases where access depends on SID history or Universal Groups, failure to enable SID filtering could result in operational problems, including denial of access to authorized users.

  When the quarantine switch is applied to external or forest trusts, only those SIDs from the single, directly trusted domain are valid. In effect, enabling /quarantine on a trust relationship will break the transitivity of that trust so that only the specific domains on either side of the trust are considered participants in the trust.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure SID filtering is enabled on all external trusts.  You can enable SID filtering only from the trusting side of the trust.  Enter the following line from a command line:

  netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes
  /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>

  Ensure SID history is disabled for all forest trusts.  You can disable SID history only from the trusting side of the trust.  Enter the following line from a command line:

  netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No
  /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>

check_text:
  Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)

  Right-click the domain in the left pane and select "Properties".

  Select the "Trusts" tab.

  Note any existing trusts and the type.

  If no trusts exist, this is NA.

  Access a command line and run the following command on the trusting domain:
  "netdom trust <trusting domain> /d:<trusted domain> /quarantine"

  If the result does not specify the following, this is a finding.

  "SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed."

  If the trust type is Forest, run the following command on the trusting domain:
  "netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory"

  If the result does not specify "SID history is disabled for this trust", this is a finding.


vuln_id: V-243485
rule_id: SV-243485r958472_rule
severity: CAT II
title: Selective Authentication must be enabled on outgoing forest trusts.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Enabling Selective Authentication on outbound Active Directory (AD) forest trusts significantly strengthens access control by requiring explicit authorization (through the Allowed to Authenticate permission) on resources in the trusting forest.  When Selective Authentication is not enabled, less secure resource access permissions (such as those that specify Authenticated Users) might permit unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Enable Selective Authentication on outgoing forest trust.   
  Open "Active Directory Domains and Trusts".  (Available from various menus or run "domain.msc".)
  Right click the domain name in the left pane and select "Properties".
  Select the "Trusts" tab.
  For each outgoing forest trust, right-click the trust item and select "Properties". 
  Select the "Authentication" tab.  
  Select the "Selective Authentication" option.
  (It may be necessary to configure the "Allowed to Authenticate" permission on resources in the trusting domain.)

check_text:
  Open "Active Directory Domains and Trusts".  (Available from various menus or run "domain.msc".)
  Right click the domain name in the left pane and select "Properties".
  Select the "Trusts" tab.
  For each outgoing forest trust, right-click the trust item and select "Properties".
  Select the "Authentication" tab.

  If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding.


vuln_id: V-243486
rule_id: SV-243486r958504_rule
severity: CAT II
cci: CCI-000804
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Anonymous Logon and Everyone groups must not be members of the Pre-Windows 2000 Compatible Access group.

description:
  <VulnDiscussion>The Pre-Windows 2000 Compatible Access group was created to allow Windows NT domains to interoperate with AD domains by allowing unauthenticated access to certain AD data. The default permissions on many AD objects are set to allow access to the Pre-Windows 2000 Compatible Access group.

  When the Anonymous Logon or Everyone groups are members of the Pre-Windows 2000 Compatible Access group, anonymous access to many AD objects is enabled.

  Anonymous access to AD data could provide valuable account or configuration information to an intruder trying to determine the most effective attack strategies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the "Anonymous Logon" and "Everyone" groups are not members of the "Pre-Windows 2000 Compatible Access group". (By default, these groups are not included in current Windows versions.)

  Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").
  Expand the domain being reviewed in the left pane and select the "Builtin" container.
  Double-click on the "Pre-Windows 2000 Compatible Access" group in the right pane.
  Select the "Members" tab.
  If the "Anonymous Logon" or "Everyone" groups are members, select each and click "Remove".

check_text:
  Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").
  Expand the domain being reviewed in the left pane and select the "Builtin" container.
  Double-click on the "Pre-Windows 2000 Compatible Access" group in the right pane.
  Select the "Members" tab.

  If the "Anonymous Logon" or "Everyone" groups are members, this is a finding.
  (By default, these groups are not included in current Windows versions.)


vuln_id: V-243487
rule_id: SV-243487r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Membership in the Group Policy Creator Owners and Incoming Forest Trust Builders groups must be limited.

description:
  <VulnDiscussion>Membership in the Group Policy Creator Owners and Incoming Forest Trust Builders groups assigns a high privilege level for AD functions.  Unnecessary membership increases the risk from compromise or unintended updates.  Members of these groups must specifically require those privileges and be documented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document membership of the Group Policy Creator Owners and Incoming Forest Trust Builders groups.  Remove any accounts that do not require the privileges these groups assign.

check_text:
  Start "Active Directory Users and Computers" (Available from various menus or run "dsa.msc").

  Review the membership of the "Incoming Forest Trust Builders" group.

  Navigate to the "Built-in" container.

  Right-click on the "Incoming Forest Trust Builders", select "Properties" and then the "Members" tab.

  If any accounts are not documented as necessary with the ISSO, this is a finding.

  Review the membership of the "Group Policy Creator Owner" group.

  Navigate to the "Users" container.

  Right-click on the "Group Policy Creator Owner", select "Properties" and then the "Members" tab.

  If any accounts are not documented as necessary with the ISSO, this is a finding.

  It is possible to move some system-defined groups from their default locations.  If a group is not in the location noted, review other containers to locate.


vuln_id: V-243488
rule_id: SV-243488r959010_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.

description:
  <VulnDiscussion>In AD it is possible to delegate account and other AD object ownership and administration tasks. (This is commonly done for help desk or other user support staff.) This is done to avoid the need to assign users to Windows groups with more widely ranging privileges. If a user with delegated authority to user accounts in a specific OU is also a member of the Administrators group, that user has the ability to reconfigure a wide range of domain security settings and change user accounts outside of the OU to which s/he is a delegated authority. A lack of specific baseline documentation of accounts with delegated privileges makes it impossible to determine if the configured privileges are consistent with the intended security policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Remove user accounts with delegated authority from Windows built-in administrative groups or remove the delegated authority from the accounts. 

  2. Document all user accounts with delegated AD object ownership or update authority. 

  3. Annotate the account list with a statement such as, "The high number of privileged accounts is required to address site operational requirements."

  4. Reduce the number of user accounts with delegated AD object ownership or update authority.

check_text:
  1. Interview the IAM or site representative and obtain the list of accounts that have been delegated AD object ownership or update permissions and that are not members of Windows built-in administrative groups.
  (This includes accounts for help desk or support personnel who are not Administrators, but have authority in AD to maintain user accounts or printers.)

  2. If accounts with delegated authority are defined and there is no list, then this is a finding.

  3. Count the number of accounts on the list.

  4. If the number of accounts with delegated authority is greater than 10, review the site documentation that justifies this number.  Validate that the IAM explicitly acknowledges the need to have a high number of privileged users.

  5. If the number of accounts with delegated authority is greater than 10 and there is no statement in the documentation that justifies the number, then this is a finding.


vuln_id: V-243489
rule_id: SV-243489r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Read-only Domain Controller (RODC) architecture and configuration must comply with directory services requirements.

description:
  <VulnDiscussion>The RODC role provides a unidirectional replication method for selected information from your internal network to the DMZ. If not properly configured so that the risk footprint is minimized, the interal domain controller or forest can be compromised.

  RODC is considered part of the site's Forest or Domain installation since it is not a standalone product, but rather a role of the the Windows AD DS full installation or Server Core installation. It is possible to have Windows 2003 clients authenticated using RODC, however, compatibility packs are needed. 

  Note that RODC is not authorized for use across the site's perimeter firewall.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure compliance with VPN and IPSec requirements in the Network Insfrastucture STIG. 

  2. Ensure IPSec and other communications and security configurations for the management and replication of the RODC uses the minimum required Group Policy Objects (GPOs) to provide the required functionality.

  3. Replicate only the information needed to provide the functionality required. If full replication of all directory data is not needed, then replicated selective ID and authentication information as needed to the RODC.

  4. Include an inspection of the RODC server in the DMZ when inspection for least privilege.

check_text:
  1. Verify that the site has applied the Network Infrastucture STIG to configure the VPN and IPSec. 

  2. Verify that IPSec and other communications and security configurations for the management and replication of the RODC will be managed by use of the minimum required Group Policy Objects (GPOs).

  3. Include an inspection of the RODC server in the DMZ when inspection for least privilege.

  4. Verify that required patches and compatibility packs are installed if RODC is used with Windows 2003 (or earlier) clients.

  5. If RODC server and configuration does not comply with requirements, then this is a finding.


vuln_id: V-243490
rule_id: SV-243490r959010_rule
severity: CAT II
title: Usage of administrative accounts must be monitored for suspicious and anomalous activity.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Monitoring the usage of administrative accounts can alert on suspicious behavior and anomalous account usage that would be indicative of potential malicious credential reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Monitor account usage events for administrative accounts.  This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups.  Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools.

  Monitor for the events listed below, at minimum.

  Account Lockouts (Subcategory: User Account Management)
  4740 - A user account is locked out.
  User Added to Privileged Group (Subcategory: Security Group Management)
  4728 - A member was added to a security-enabled global group.
  4732 - A member was added to a security-enabled local group.
  4756 - A member was added to a security-enabled universal group.
  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.
  Failed User Account Login (Subcategory: Logon)
  4625 - An account failed to log on.
  Account Login with Explicit Credentials (Subcategory: Logon)
  4648 - A logon was attempted using explicit credentials.

  The "Account Usage" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides additional information.
  https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm.

check_text:
  Verify account usage events for administrative accounts are being monitored.  This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups.  Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools.

  Monitor for the events listed below, at minimum.  If these events are not monitored, this is a finding.

  Account Lockouts (Subcategory: User Account Management)
  4740 - A user account is locked out.
  User Added to Privileged Group (Subcategory: Security Group Management)
  4728 - A member was added to a security-enabled global group.
  4732 - A member was added to a security-enabled local group.
  4756 - A member was added to a security-enabled universal group.
  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.
  Failed User Account Login (Subcategory: Logon)
  4625 - An account failed to log on.
  Account Login with Explicit Credentials (Subcategory: Logon)
  4648 - A logon was attempted using explicit credentials.


vuln_id: V-243491
rule_id: SV-243491r959010_rule
severity: CAT II
title: Systems must be monitored for attempts to use local accounts to log on remotely from other systems.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Monitoring for the use of local accounts to log on remotely from other systems may indicate attempted lateral movement in a Pass-the-Hash attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Monitor for attempts to use local accounts to log on remotely from other systems.  Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools.

  Monitor for the events listed below.

  More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs.
  Search for the event IDs listed with the following additional attributes:
  Logon Type = 3 (Network)
  Authentication Package Name = NTLM
  Not a domain logon and not the ANONYMOUS LOGON account

  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.
  Failed User Account Login (Subcategory: Logon)
  4625 - An account failed to log on.

  The "Pass the Hash Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering.
  https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm.

check_text:
  Verify attempts to use local accounts to log on remotely from other systems are being monitored.  Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools.

  Monitor for the events listed below.  If these events are not monitored, this is a finding.

  More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs.
  Search for the event IDs listed with the following additional attributes:
  Logon Type = 3 (Network)
  Authentication Package Name = NTLM
  Not a domain logon and not the ANONYMOUS LOGON account

  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.
  Failed User Account Login (Subcategory: Logon)
  4625 - An account failed to log on.


vuln_id: V-243492
rule_id: SV-243492r959010_rule
severity: CAT II
title: Systems must be monitored for remote desktop logons.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Remote Desktop activity for administration should be limited to specific administrators, and from limited management workstations.  Monitoring for any Remote Desktop logins outside of expected activity can alert on suspicious behavior and anomalous account usage that could be indicative of potential malicious credential reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs.
  Search for the event IDs listed with the following additional attributes:
  Logon Type = 10 (RemoteInteractive)
  Authentication Package Name = Negotiate

  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.

  The "Remote Desktop Logon Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering.
  https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm.

check_text:
  Verify Remote Desktop logins are being monitored.  Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools.

  Monitor for the events listed below.  If these events are not monitored, this is a finding.

  More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs.
  Search for the event IDs listed with the following additional attributes:
  Logon Type = 10 (RemoteInteractive)
  Authentication Package Name = Negotiate

  Successful User Account Login (Subcategory: Logon)
  4624 - An account was successfully logged on.


vuln_id: V-243493
rule_id: SV-243493r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Active Directory data must be backed up daily for systems with a Risk Management Framework categorization for Availability of moderate or high.  Systems with a categorization of low must be backed up weekly.

description:
  <VulnDiscussion>Failure to maintain a current backup of directory data could make it difficult or impossible to recover from incidents including hardware failure or malicious corruption.  A failure to recover from the loss of directory data used in identification and authentication services (i.e., Active Directory) could result in an extended loss of availability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the organization's procedures for the backing up active directory data.
  Ensure the frequency at which active directory data is backed up is as follows:
  If the Availability categorization of the domain is low, this must be at least weekly.
  If the Availability categorization of the domain is moderate or high, this must be at least daily.
  Ensure the type of backup is appropriate to capturing the directory data.  For AD domain controllers, this must include a System State data backup.

check_text:
  Review the organization's procedures for the backing up active directory data.
  Verify the frequency at which active directory data is backed up.
  If the Availability categorization of the domain is low, this must be at least weekly.
  If the Availability categorization of the domain is moderate or high, this must be at least daily.
  Verify the type of backup is appropriate to capturing the directory data.  For AD domain controllers, this must include a System State data backup.

  If any of these conditions are not met, this is a finding.


vuln_id: V-243494
rule_id: SV-243494r959010_rule
severity: CAT III
title: Each cross-directory authentication configuration must be documented.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Active Directory (AD) external, forest, and realm trust configurations are designed to extend resource access to a wider range of users (those in other directories).  If specific baseline documentation of authorized AD external, forest, and realm trust configurations is not maintained, it is impossible to determine if the configurations are consistent with the intended security policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Develop documentation for each AD external, forest, and realm trust configuration. At a minimum this must include:
  Type (external, forest, or realm)
  Name of the other party
  Confidentiality, Availability, and Integrity categorization
  Classification level of the other party
  Trust direction (inbound and/or outbound)
  Transitivity
  Status of the Selective Authentication option
  Status of the SID filtering option

check_text:
  Start "Active Directory Domains and Trusts" (Available from various menus or run "domain.msc").
  Select the left pane item that matches the name of the domain being reviewed.
  Right-click the domain name and select "Properties".
  Select the "Trusts" tab.

  For each outbound and inbound external, forest, and realm trust, record the name of the other party (domain name), the trust type, transitivity, and the trust direction. (Keep this trust information for use in subsequent checks.)

  Compare the list of trusts identified with documentation maintained by the ISSO.  

  For each trust, the documentation must contain the following:
  Type (external, forest, or realm)
  Name of the other party
  Confidentiality, Availability, and Integrity categorization
  Classification level of the other party
  Trust direction (inbound and/or outbound)
  Transitivity
  Status of the Selective Authentication option
  Status of the SID filtering option

  If an identified trust is not listed in the documentation or if any of the required items are not documented, this is a finding.


vuln_id: V-243495
rule_id: SV-243495r958908_rule
severity: CAT II
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  A VPN must be used to protect directory network traffic for directory service implementation spanning enclave boundaries.

description:
  <VulnDiscussion>The normal operation of AD requires the use of IP network ports and protocols to support queries, replication, user authentication, and resource authorization services. At a minimum, LDAP or LDAPS is usually required for communication with every domain controller. DoD Ports, Protocols, and Services Management (PPSM) policy restricts the use of LDAP, LDAPS, and many of the AD-related protocols across enclave boundaries because vulnerabilities exist in the protocols or service implementations. To comply with the restrictions and address the vulnerabilities, a VPN implementation may be used. If AD data traverses enclave network boundaries using a vulnerable protocol or service without the protection provided by a VPN, that data might be subject to tampering or interception.

  Further Policy Details: Implement a VPN or other network protection solution in accordance with the Network Infrastructure STIG that protects AD data in transit across DoD enclave boundaries. VPN requirements will include registering the VPN and connection points with the PPSM. Current guidance is available in the Network Infrastructure STIG and from the PPSM.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Implement a VPN or other network protection solution in accordance with the Network Infrastructure STIG that protects AD data in transit across DoD enclave boundaries.

check_text:
  1. Review the site's network diagram(s) to determine if domain controllers for the domain are located in multiple enclaves. The object is to determine if network traffic is traversing enclave network boundaries.

  2. Request information about RODC or ADAM instances are installed. In particular, request details of Active Diretory functionality installed or extended into the DMZ or configured/allowed to cross the sites outbound firewall boundary. Ensure communications and replication traffic is encrypted.

  3. If domain controllers are not located in multiple enclaves, then this check is not applicable.

  4. If domain controllers are located in multiple enclaves, verify that a VPN is used to transport the network traffic (replication, user logon, queries, etc.).

  5. If a VPN solution is not used to transport directory network traffic across enclave boundaries, then this is a finding.

  6. If the ADAM mode is in use and a migration plan for converting to RODC is not in place, then this is a finding.


vuln_id: V-243496
rule_id: SV-243496r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Accounts from outside directories that are not part of the same organization or are not subject to the same security policies must be removed from all highly privileged groups.

description:
  <VulnDiscussion>Membership in certain default directory groups assigns a high privilege level for access to the directory. In AD, membership in the following groups enables high privileges relative to AD and the Windows OS: Domain Admins, Enterprise Admins, Schema Admins, Group Policy Creator Owners, and Incoming Forest Trust Builders. 

  When accounts from an outside directory are members of highly privileged groups in the directory being reviewed, less rigorous security policies or compromises of accounts in the outside directory could increase the risk to the directory where the privileged groups are defined. A compromise to the outside directory would allow unauthorized, privileged access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove accounts from outside directories that are not part of the same organization or are not subject to the same security policies from the highly privileged groups.

check_text:
  1. Start the Active Directory Users and Computers console (Start, Run, "dsa.msc").

  2. Select and expand the left pane item that matches the name of the domain being reviewed.

  3. Select the Built-in container. 
  a. If the Incoming Forest Trust Builders group is defined, double-click on the group, and select the Members tab
  b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed.

  4. Select the Users container
  a. For each group (Domain Admins, Enterprise Admins, Schema Admins, and Group Policy Creator Owners), double-click on the group, and select the Members tab.
  b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed.

  5. If any account in a privileged group is from a domain outside the forest being reviewed and that outside forest is not maintained by the same organization (e.g., enclave) or subject to the same security policies, then this is a finding.

  Supplementary Notes:
  Note: An account that is from an outside domain appears in the format "outside-domain-NetBIOSname\account" or "account@outside-domain-fully-qualified-name". Examples are "AOFN21\jsmit" or "jsmith@AOFN21.OST.COM". It may be necessary to use the AD Domains and Trusts (domain.msc) console to determine if the domain is from another AD forest.

  Note:  It is possible to move the highly privileged AD security groups out of the AD Users container. If the Domain Admins, Enterprise Admins, Schema Admins, or Group Policy Creator Owners groups are not in the AD Users container, ask the SA for the new location and use that location for this check.


vuln_id: V-243497
rule_id: SV-243497r959010_rule
severity: CAT II
title: Inter-site replication must be enabled and configured to occur at least daily.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Timely replication makes certain that directory service data is consistent across all servers that support the same scope of data for their clients. In AD implementation using AD Sites, domain controllers defined to be in different AD Sites require Site links to specify properties for replication scheduling.

  If AD Site link schedule and replication interval properties are configured improperly, AD data replication may not occur frequently enough and updates to identification, authentication, or authorization data may not be current on all domain controllers. If this data is not current, access to resources may be incorrectly granted or denied. The default for inter-site replication is to occur every 180 minutes, 24 hours a day.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Maintain an Active Directory replication schedule that allows inter-site replication to occur at least on a daily basis.
  Open "Active Directory Sites and Services". (Available from various menus or run "dssite.msc".)
  Expand "Sites" in the left pane.
  Expand "Inter-Site Transports" and select "IP".
  For each site link that is defined in the right pane perform the following:
  Right click the site link item and select "Properties".	
  Select an interval in the "Replicate every" field less than "1440".  (By default this is 180.)
  Click the Change Schedule button.
  Select time frames for "Replication Available" to allow for replication to occur at least daily.

check_text:
  Open "Active Directory Sites and Services".  (Available from various menus or run "dssite.msc".)
  Expand "Sites" in the left pane.
  If only a single site exists, this is NA.  By default the first site in a domain is named "Default-First-Site-Name" but may have been changed.
  If more than one site exists, expand "Inter-Site Transports" and select "IP".
  For each site link that is defined in the right pane perform the following:
  Right click the site link item and select "Properties".

  If the interval on the "General" tab for the "Replicate every" field is greater than "1440", this is a finding.

  Click the "Change Schedule" button.

  If the time frames selected for "Replication Available" do not allow for replication to occur at least daily, this is a finding.

  Click the Cancel buttons to exit.


vuln_id: V-243498
rule_id: SV-243498r958406_rule
severity: CAT II
cci: CCI-000067
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  If a VPN is used in the AD implementation, the traffic must be inspected by the network Intrusion detection system (IDS).

description:
  <VulnDiscussion>To provide data confidentiality, a VPN is configured to encrypt the data being transported. While this protects the data, some implementations do not allow that data to be processed through an intrusion detection system (IDS) that could detect data from a compromised system or malicious client.

  Further policy details:Replace the VPN solution or reconfigure it so that directory data is processed by a network or host-based intrusion detection system (IDS). </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Replace the VPN solution or reconfigure it so that directory data is inspected by a network or host-based IDS.

check_text:
  1. Interview the site representative. Ask about the location of the domain controllers. 

  2. If domain controllers are not located in multiple enclaves, then this check is not applicable.

  3. If domain controllers are located in multiple enclaves and a VPN is not used, then this check is not applicable.

  4. If domain controllers are located in multiple enclaves and a VPN is used, review the site network diagram(s) with the SA, NSO, or network reviewer as required to determine if the AD network traffic is visible to a network or host IDS.

  5. If the AD network traffic is not visible to a network or host IDS, then this is a finding.


vuln_id: V-243499
rule_id: SV-243499r959010_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Active Directory implementation information must be added to the organization contingency plan where the Risk Management Framework categorization for Availability is moderate or high.

description:
  <VulnDiscussion>When an incident occurs that requires multiple Active Directory (AD) domain controllers to be rebuilt, it is critical to understand the AD hierarchy and replication flow so that the correct recovery sequence and configuration values can be selected.  Without appropriate AD forest, tree and domain structural documentation, it may be impossible or very time consuming to reconstruct the original configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the disaster recovery plans to include the AD hierarchy structure for domains with an Availability categorization of moderate or high.

check_text:
  Determine the Availability categorization information for the domain.
  If the Availability categorization of the domain is low, this is NA.
  If the Availability categorization of the domain is moderate or high, verify the organization's disaster recovery plans includes documentation on the AD hierarchy (forest, tree and domain structure).
   (A chart showing forest hierarchy and domain names is the minimum suggested.)

  If the disaster recovery plans do not include directory hierarchy information, this is a finding.


vuln_id: V-243500
rule_id: SV-243500r959010_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Active Directory must be supported by multiple domain controllers where the Risk Management Framework categorization for Availability is moderate or high.

description:
  <VulnDiscussion>In Active Directory (AD) architecture, multiple domain controllers provide availability through redundancy.  If an AD domain or servers within it have an Availability categorization of medium or high and the domain is supported by only a single domain controller, an outage of that machine can prevent users from accessing resources on servers in that domain and in other AD domains.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Implement multiple domain controllers in domains with an Availability categorization of moderate or high.

check_text:
  Determine the Availability categorization information for the domain.
  If the Availability categorization of the domain is low, this is NA.
  If the Availability categorization of the domain is moderate or high, verify the domain is supported by more than one domain controller.
  Start "Active Directory Users and Computers" (Available from various menus or run "dsa.msc").
  Expand the left pane item that matches the domain being reviewed.
  Select the Domain Controllers Organizational Unit (OU) in the left pane.

  If there is only one domain controller in the OU, this is a finding.


vuln_id: V-243501
rule_id: SV-243501r1016334_rule
severity: CAT III
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The impact of CPCON changes on the cross-directory authentication configuration must be considered and procedures documented.

description:
  <VulnDiscussion>When incidents occur that require a change in the Cyber Protection Conditions (CPCON) with the release of USSCI 5200-13 status, it may be necessary to take action to restrict or disable certain types of access based on a directory outside the Component's control. Cross-directory configurations (such as trusts and pass-through authentication) are specifically designed to enable resource access across directories. If conditions indicate an outside directory is at increased risk of compromise in the immediate or near future, actions to avoid a spread of the effects of the compromise must be taken. A trusted outside directory that is compromised could allow an unauthorized user to access resources in the trusting directory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Evaluate cross-directory configurations (such as trusts and pass-through authentication) and provide documentation that indicates: 
  1. An evaluation was performed. 
  2. The specific AD trust configurations, if any, that must be disabled during changes in CPCON status because they could represent increased risk.

check_text:
  1. Refer to the list of actual manual AD trusts (cross-directory configurations) collected from the site representative.

  2. If there are no manual AD trusts (cross-directory configurations) defined, this check is not applicable.
  For AD, this includes external, forest, or realm trust relationship types.

  3. Obtain a copy of the site's supplemental CPCON procedures as required by Strategic Command Directive (SD) 527-1.

  4. Verify that it has been determined by the IAM whether CPCON response actions need to include procedures to disable manual AD trusts (cross-directory configurations). The objective is to determine if the need has been explicitly evaluated.

  5. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) are not necessary, then this check is not applicable.

  6. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) are necessary, verify that the policy to implement these actions has been documented.

  7. If actions to disable manual AD trusts (cross-directory configurations) are needed and no policy has been documented, then this is a finding.


vuln_id: V-269097
rule_id: SV-269097r1026170_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Windows Server domain controllers must have Kerberos logging enabled with servers hosting Active Directory Certificate Services (AD CS).

description:
  <VulnDiscussion>Although Kerberos logging can be used for troubleshooting, it can also provide security information for successful and failed login attempts. If a malicious actor uses a forged or unauthorized certificate to complete Kerberos PKINIT authentication, the Kerberos Authentication Service success audit in event 4768 can be used to detect the specific fraudulent certificate that was used to authenticate to then revoke the certificate. Kerberos Service Ticket operation events can be used in an investigation to discover which services were accessed by a malicious actor or to detect if an SCHANNEL-based authentication was abused by a malicious actor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon.

  Configure "Audit Kerberos Authentication Service" and the "Audit Kerberos Service Ticket Operations" to be set to "Success and Failure".

check_text:
  This applies to domain controllers only. It is not applicable for other systems. Verify the following is configured on the domain controller. 

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon.

  If "Audit Kerberos Authentication Service" and "Audit Kerberos Ticket Operations" are not set to "Success and Failure", this is a finding.


vuln_id: V-243502
rule_id: SV-243502r1026198_rule
severity: CAT II
title: Membership to the Schema Admins group must be limited.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Schema Admins group is a privileged group in a forest root domain. Members of the Schema Admins group can make changes to the schema, which is the framework for the Active Directory forest. Changes to the schema are not frequently required. This group only contains the Built-in Administrator account by default. Additional accounts must only be added when changes to the schema are necessary and then must be removed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Limit membership in the Schema Admins group to only those accounts necessary during a schema update. Remove accounts when the updates are complete. Document accounts necessary during schema updates with the ISSO.

check_text:
  Open "Active Directory Users and Computers" on a domain controller in the forest root domain.

  Navigate to the "Users" container.

  Right-click on "Schema Admins" and select "Properties", and then select the "Members" tab.

  If any accounts other than the built-in Administrators group are members, verify their necessity with the ISSO.

  If any accounts are members of the group when schema changes are not being made, this is a finding.


vuln_id: V-243503
rule_id: SV-243503r1026201_rule
severity: CAT II
title: Anonymous Access to AD forest data above the rootDSE level must be disabled.
fix_text: Disable anonymous access to AD forest data above the rootDSE level.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>For Windows Server 2003 or above, the dsHeuristics option can be configured to override the default restriction on anonymous access to AD data above the rootDSE level. Anonymous access to AD data could provide valuable account or configuration information to an intruder trying to determine the most effective attack strategies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  1. At the command line prompt enter (on a single line): 
  dsquery * "cn=Directory Service,
  cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -scope base -attr * 

  (Where dc=[forest-name] is the fully qualified LDAP name of the root of the domain being reviewed.)

  Example:
  The following is an example of the dsquery command for the vcfn.ost.com forest.

  dsquery * "cn=Directory Service,cn=Windows  NT,cn=Services,cn=Configuration,  dc=vcfn,dc=ost,dc=com -scope base -attr * 

  2. If the dsHeuristics attribute is listed, note the assigned value.

  3. If the dsHeuristics attribute is defined and has a "2" as the 7th character, then this is a finding.

  Examples of values that would be a finding as follows:
   "0000002", "0010002", "0000002000001".
  (The 7th character controls anonymous access.)

  Supplementary Notes:
  Domain controllers have this option disabled by default. However, this check verifies that the option has not been enabled.

  The dsHeuristics option can be configured with the Windows Support Tools Active Directory Service Interfaces Editor (ADSI Edit) console (adsiedit.msc).


vuln_id: V-243504
rule_id: SV-243504r1026204_rule
severity: CAT II
cci: CCI-001891
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Windows Time Service on the forest root PDC Emulator must be configured to acquire its time from an external time source.

description:
  <VulnDiscussion>When the Windows Time service is used to synchronize time on client computers (workstations and servers) throughout an AD forest, the forest root domain PDC Emulator is the normal default to provide the authoritative time source for the entire forest. To obtain an accurate time for itself, the forest root domain PDC Emulator acts as a client to an external time source.

  If the Windows Time service on the forest root domain PDC Emulator is not configured to acquire the time from a proper source, it may cause time service clients throughout the forest to operate with the inaccurate time setting.

  When a Windows computer operates with an inaccurate time setting, access to resources on computers with the accurate time might be denied. This is notably true when Kerberos authentication is utilized. Operation with an inaccurate time setting can reduce the value of audit data and invalidate it as a source of forensic evidence in an incident investigation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the forest root PDC Emulator to acquire its time from an external time source.

  The Windows Time Service can be configured by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configuring the "NtpServer" field to point to an authorized time server.

check_text:
  This applies to the domain controller with the PDC Emulator role in forest root domain; it is NA for other domain controllers in the forest.

  Determine the domain controller with the PDC Emulator role in the forest root domain:

  Windows 2016 or later: 

  Open "Windows PowerShell".

  Enter "Get-ADDomain -Identity [Forest Root Domain] | FT PDCEmulator", where [Forest Root Domain] is the forest root domain name, such as "example.mil". (This can also be entered without the -Identity parameter if running within the forest root domain.)

  Windows 2016:

  Open "Active Directory Users and Computers" from a domain controller in or connected to the forest root (available from various menus or run "dsa.msc").

  Select "Action" in the menu, then All Tasks >> Operations Masters.

  Select the "PDC" tab.

  On the system with the PDC Emulator role, open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator).

  Enter "W32tm /query /configuration".

  Under the "NtpClient" section:

  If the value for "Type" is not "NTP", this is a finding.

  If the value for "NtpServer" is not an external DOD time source, this is a finding.

  If an alternate time synchronization tool is used and is not enabled or not configured to a synchronize with an external DOD time source, this is a finding.

  The US Naval Observatory operates stratum 1 time servers, identified at https://www.cnmoc.usff.navy.mil/Our-Commands/United-States-Naval-Observatory/Precise-Time-Department/Network-Time-Protocol-NTP/. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.


vuln_id: V-243505
rule_id: SV-243505r1026206_rule
severity: CAT III
title: Changes to the AD schema must be subject to a documented configuration management process.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Poorly planned or implemented changes to the AD schema could cause the applications that rely on AD (such as web and database servers) to operate incorrectly or not all.

  Improper changes to the schema could result in changes to AD objects that are incompatible with correct operation of the Windows domain controller and the domain clients. This could cause outages that prevent users from logging on or accessing Windows server resources across multiple hosts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Document and implement a policy to ensure that changes to the AD schema are subject to a configuration management process.

check_text:
  1. Interview the ISSO.

  2. Obtain a copy of the site's configuration management procedures documentation.

  3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema.

  4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.


vuln_id: V-243506
rule_id: SV-243506r1026208_rule
severity: CAT I
title: Update access to the directory schema must be restricted to appropriate accounts.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A failure to control update access to the AD Schema object could result in the creation of invalid directory objects and attributes. Applications that rely on AD could fail as a result of invalid formats and values. The presence of invalid directory objects and attributes could cause failures in Windows AD client functions and improper resource access decisions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below.

  Authenticated Users:
  Read
  Special Permissions
  The Special permissions for Authenticated Users are List and Read type.  If detailed permissions include any additional Permissions or Properties this is a finding.

  System:
  Full Control

  Enterprise Read-only Domain Controllers:
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set

  Schema Admins:
  Read
  Write
  Create all child objects
  Change schema master
  Manage replication topology
  Monitor active directory replication
  Read only replication secret synchronization
  Reanimate tombstones
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication synchronization
  Update schema cache
  Special permissions
  (Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

  Administrators:
  Manage replication topology
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication Synchronization

  Enterprise Domain Controllers:
  Manage replication topology
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication Synchronization

check_text:
  Start a Schema management console. (See supplemental notes.)
  Select and then right-click on the Active Directory Schema entry in the left pane.
  Select Permissions.

  If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding. 

  The permissions shown are at the summary level.  More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button.

  Authenticated Users:
  Read
  Special Permissions
  The Special permissions for Authenticated Users are List and Read type.  If detailed permissions include any additional Permissions or Properties this is a finding.

  System:
  Full Control

  Enterprise Read-only Domain Controllers:
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set

  Schema Admins:
  Read
  Write
  Create all child objects
  Change schema master
  Manage replication topology
  Monitor active directory replication
  Read only replication secret synchronization
  Reanimate tombstones
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication synchronization
  Update schema cache
  Special permissions
  (Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

  Administrators:
  Manage replication topology
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication Synchronization

  Enterprise Domain Controllers:
  Manage replication topology
  Replicating Directory Changes
  Replicating Directory Changes All
  Replicating Directory Changes In Filtered Set
  Replication Synchronization

  Supplemental Notes:
  If the Schema management console has not already been configured on the computer, create a console by using the following:

  The steps for adding the snap-in may vary depending on the Windows version.
  Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll".
  Run "mmc.exe" to start a Microsoft Management Console. 
  Select Add/Remove Snap-in from the File menu.
  From the Available Standalone Snap-ins list, select Active Directory Schema
  Select the Add button.
  Select the OK button.

  When done using the console, select Exit from the File (or Console) menu.
  Select the No button to the Save console settings... prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.


vuln_id: V-269098
rule_id: SV-269098r1106505_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Windows Server hosting Active Directory Certificate Services (AD CS) must enforce Certificate Authority (CA) certificate management approval for certificate requests.

description:
  <VulnDiscussion>When users are requesting new certificates through AD CS, there must be management approval and awareness for these requests. Without this, a user or bad actor could request certificates they should not have or should not have access to.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In the AD CS web server properties, select "VulnerableCertTemplate" properties and then select "Subject Name" and "Supply in the request".

  Certificate templates with the following extended key usages must require manual approval in all cases:
    i. Smart Card Logon (1.3.6.1.4.1.311.20.2.2).
   ii. Any Purpose EKU (2.5.29.37.0).
  iii. No EKU set. i.e., this is a (subordinate) CA certificate.

  Certificate templates with the following extended key usages AND that allow a requestor to supply the subject name in the request must require manual approval:
    i. Client Authentication (1.3.6.1.5.5.7.3.2).
   ii. PKINIT Client Authentication (1.3.6.1.5.2.3.4).
  iii. Supply in request" setting:  VulnerableCertTemplate Properties.

check_text:
  Certificate templates with the following extended key usages AND that allow a requestor to supply the subject name in the request require manual approval. In the AD CS web server properties, select "VulnerableCertTemplate" properties. Verify that "Subject Name" and "Supply in the request" are selected.

  If "Subject Name" AND "Supply in the request" are selected and if manual approval is not required, this is a finding. 

  If the "Supply in Request" is NOT selected, and the Enroll Permissions for the template have been limited to a select group of users/administrators, this is not a finding.


vuln_id: V-269099
rule_id: SV-269099r1026184_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.

description:
  <VulnDiscussion>Verify that a site has set aside one or more PAWs for remote management of AD CS. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure and set aside one or more PAWs for configuration and management of AD CS. 

  For AD, multiple configuration items could enable anonymous access.

  Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources.

check_text:
  Verify that a site has set aside one or more PAWs for remote management of AD CS. 

  A dedicated AD CS/CA Admin account that is only usable on tier 0 PAW or the ADCS server must be used to manage the certificate authority and approve requests.

  Review any available site documentation.

  Verify that any PAW used to manage high-value IT resources of a specific tier are used exclusively for managing high-value IT resources assigned to only one tier.

  If the site has not set aside one or more PAWs for remote management of AD CS, this is a finding.


vuln_id: V-213117
rule_id: SV-213117r766511_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous Enhanced Security for standalone mode must be enabled.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Enhanced Security (ES) is a sandbox capability that restricts access to system resources. ES can be configured in two modes: Standalone mode is when Acrobat opens the desktop PDF client. ES Browser mode is when a PDF is opened via the browser plugin. When Enhanced Security is enabled and a PDF file tries to complete a restricted action from an untrusted location, a security warning must appear.Enhanced Security “hardens” the application against risky actions. It prevents cross domain access, prohibits script and data injection, blocks stream access to XObjects, silent printing, and execution of high privilege JavaScript.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnhancedSecurityStandalone
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous  > Preferences > Security (Enhanced) > 'Enable Enhanced Security Standalone' to 'Enabled'.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnhancedSecurityStandalone
  Type: REG_DWORD
  Value: 1

  If the value for bEnhancedSecurityStandalone is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Security (Enhanced) > In the 'Enhanced Security' section> Verify 'Enable Enhanced Security' checkbox is checked and greyed out (locked).  If the box is not checked nor greyed out (locked), this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Enable Enhanced Security Standalone' must be set to 'Enabled'.


vuln_id: V-213118
rule_id: SV-213118r766514_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous Enhanced Security for browser mode must be enabled.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Enhanced Security (ES) is a sandbox capability that restricts access to system resources and prevents PDF cross domain access. ES can be configured in two modes: Standalone mode is when Acrobat opens the desktop PDF client. ES Browser mode is when a PDF is opened via the browser plugin. When Enhanced Security is enabled and a PDF file tries to complete a restricted action from an untrusted location, a security warning must appear.Enhanced Security “hardens” the application against risky actions. It prevents cross domain access, prohibits script and data injection, blocks stream access to XObjects, silent printing, and execution of high privilege JavaScript.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnhancedSecurityInBrowser
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Enable Enhanced Security In Browser' to 'Enabled'.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnhancedSecurityInBrowser
  Type: REG_DWORD
  Value: 1

  If the value for bEnhancedSecurityInBrowser is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Enable Enhanced Security In Browser' must be set to 'Enabled'.


vuln_id: V-213119
rule_id: SV-213119r766517_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous PDF file attachments must be blocked.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Acrobat Pro allows for files to be attached to PDF documents. Attachments represent a potential security risk because they can contain malicious content, open other dangerous files, or launch applications.This feature prevents users from opening or launching file types other than PDF or FDF and disables the menu option to re-enable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: iFileAttachmentPerms
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Allow opening of non-PDF file attachments with external applications' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: iFileAttachmentPerms
  Type: REG_DWORD
  Value: 1

  If the value for iFileAttachmentPerms is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Trust Manager > In the 'PDF File Attachments' section > Verify  'Allow opening of non-PDF file attachments with external applications' checkbox is unchecked and greyed out (locked).  If the box is checked and not greyed out (locked), this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Allow opening of non-PDF file attachments with external applications' must be set to 'Disabled'.


vuln_id: V-213120
rule_id: SV-213120r766520_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous access to unknown websites must be restricted.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Acrobat provides the ability for the user to store a list of websites with an associated behavior of allow, ask, or block. Websites that are not in this list are unknown. PDF files can contain URLs that will initiate connections to unknown websites in order to share or get information. That access must be restricted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cDefaultLaunchURLPerms\

  Value Name: iUnknownURLPerms
  Type: REG_DWORD
  Value: 3

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Access to unknown websites' to 'Enabled' and select 'Block access' in the drop down box.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following:
  HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cDefaultLaunchURLPerms\

  Value Name: iUnknownURLPerms
  Type: REG_DWORD
  Value: 3

  If the value for iUnknownURLPerms is not set to “3” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Trust Manager > In the 'Internet Access from PDF Files outside the web browser' section > Select 'Change Settings' option >  In the 'PDF Files may connect to web sites to share or get information' section, if 'Block PDF files access to all web sites' is selected and greyed out (locked), then this is not a finding. If 'Custom setting' is checked, then in the 'Default behavior for web sites that are not in the above list' section,  verify the radio button 'Block access'  is checked and greyed out (locked) .  If the box is not checked nor greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Access to unknown websites' must be set to 'Enabled' and 'Block access' selected in the drop down box.


vuln_id: V-213121
rule_id: SV-213121r766523_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous access to websites must be blocked.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>PDF files can contain URLs that initiate connections to websites in order to share or get information. Any Internet access introduces a security risk as malicious websites can transfer harmful content or silently gather data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cDefaultLaunchURLPerms\

  Value Name: iURLPerms
  Type: REG_DWORD
  Value: 1

  The setting may be set to "0" if a documented risk acceptance approving the websites is approved by the ISSO/AO.

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Access to websites' to 'Enabled' and select 'Block PDF files access to all web sites' in the drop down box.  Select 'Custom setting' if needed and provide a documented risk acceptance approved by the ISSO/AO approving the websites.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following:
  HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cDefaultLaunchURLPerms\

  Value Name: iURLPerms
  Type: REG_DWORD
  Value: 1

  If the value for iURLPerms is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Setting the value for iURLPerms to "0" means that a custom settings has been selected.  Custom setting allows for specific websites to be used for PDF workflows.  These websites must be approved by the ISSO/AO otherwise the setting must be "1" which blocks access to all websites.  If the iURLPerms setting is "0" and a documented risk acceptance approving the websites is provided, this is not a finding.

  GUI path: Edit > Preferences > Trust Manager > In the 'Internet Access from PDF Files outside the web browser' section > Select 'Change Settings' option > In the 'PDF Files may connect to web sites to share or get information' section > Verify the radio button 'Block PDF files access to all web sites' is selected and greyed out (locked).    If 'Custom setting' is checked, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided and then this is not a finding. 

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Access to websites' must be set to 'Enabled' and 'Block PDF files access to all web sites' selected in the drop down box. If 'Custom setting' is selected, a documented risk acceptance approved by the ISSO/AO approving the websites must be provided and then this is not a finding.


vuln_id: V-213122
rule_id: SV-213122r766526_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous must be configured to block Flash Content.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Flash has a long history of vulnerabilities.  Although Flash is no longer provided with Acrobat, if the system has Flash installed, a malicious PDF could execute code on the system.  Configuring Flash to run from a privileged location limits the execution capability of untrusted Flash content that may be embedded in the PDF.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnableFlash
  Type: REG_DWORD
  Value: 0

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Enable Flash' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bEnableFlash
  Type: REG_DWORD
  Value: 0

  If the value for bEnableFlash is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Enable Flash' must be set to 'Disabled'.


vuln_id: V-213123
rule_id: SV-213123r766529_rule
severity: CAT II
title: The Adobe Acrobat Pro DC Continuous Send and Track plugin for Outlook must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When enabled, the Adobe Send and Track button appears in Outlook. When an email is composed it enables the ability to send large files as public links through Outlook. The attached files can be uploaded to the Adobe Document Cloud and public links to the files are inserted in the email body.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cCloud" is not created by default in the Acrobat Pro DC install and must be created.

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cCloud

  Value Name: bAdobeSendPluginToggle
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Send and Track plugin' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cCloud" is not created by default in the Acrobat Pro DC install and must be created.

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cCloud

  Value Name: bAdobeSendPluginToggle
  Type: REG_DWORD
  Value: 1

  If the value for bAdobeSendPluginToggle is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Send and Track plugin' must be set to 'Disabled'.


vuln_id: V-213124
rule_id: SV-213124r766532_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous privileged file and folder locations must be disabled.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Privileged Locations are the primary method Acrobat uses to allow users and admins to specify trusted content that should be exempt from security restrictions, such as when Enhanced Security is enabled.   A Privileged Location may be a file, folder, or a host.  If the user is allowed to set a Privileged Location, they could bypass security protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisableTrustedFolders
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Privileged folder locations' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisableTrustedFolders
  Type: REG_DWORD
  Value: 1

  If the value for bDisableTrustedFolders is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Security (Enhanced) > In the 'Privileged Locations' section, verify 'Add Folder Path' option is greyed out (locked).  If this option is not greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Privileged folder locations' must be set to 'Disabled'.


vuln_id: V-213126
rule_id: SV-213126r766535_rule
severity: CAT III
cci: CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Adobe Acrobat Pro DC Continuous periodic downloading of Adobe European certificates must be disabled.

description:
  <VulnDiscussion>By default, the user can update Adobe European certificates from an Adobe server through the GUI.   When updating Adobe European certificates is disabled, it prevents the automatic download and installation of certificates and disables and locks the end user's ability to download those certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cEUTLDownload" is not created by default in the Acrobat Pro DC install and must be created.

  Registry Hive:
  HKEY_CURRENT_USER
  Registry Path:
  \Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload

  Value Name: bLoadSettingsFromURL
  Type: REG_DWORD
  Value: 0

  Configure the policy value for User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe EUTL server' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cEUTLDownload" is not created by default in the Acrobat Pro DC install and must be created.

  Using the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload

  Value Name: bLoadSettingsFromURL
  Type: REG_DWORD
  Value: 0

  If the value for bLoadSettingsFromURL is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Trust Manager > In the 'Automatic European Union Trusted Lists (EUTL) updates' section > Verify the 'Load trusted certificates from an Adobe EUTL server' is not checked.  If the box is checked, this is a finding.

  Admin Template path: User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe EUTL server' must be set to 'Disabled'.


vuln_id: V-213127
rule_id: SV-213127r766538_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous Protected Mode must be enabled.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Protected Mode is a “sandbox” that is essentially a read-only mode.  When enabled, Acrobat allows the execution environment of untrusted PDF's and the processes the PDF may invoke but also presumes all PDFs are potentially malicious and confines processing to a restricted sandbox.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bProtectedMode
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Protected Mode' to 'Enabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bProtectedMode
  Type: REG_DWORD
  Value: 1

  If the value for bProtectedMode is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Protected Mode' must be set to 'Enabled'.


vuln_id: V-213128
rule_id: SV-213128r766541_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous Protected View must be enabled.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Protected View is a “super-sandbox” that is essentially a read-only mode. When enabled, Acrobat strictly confines the execution environment of untrusted PDF's and the processes the PDF may invoke. Acrobat also assumes all PDFs are potentially malicious and confines processing to a restricted sandbox. When the PDF is opened, the user is presented with the option to trust the document. When the user chooses to trust the document, all features are enabled, this action assigns trust to the document and adds the document to the users’ list of Privileged Locations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: iProtectedView
  Type: REG_DWORD
  Value: 2

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Protected View' to 'Enabled' and select 'All files' in the drop down box.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: iProtectedView
  Type: REG_DWORD
  Value: 2

  If the value for iProtectedView is not set to “2” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Security (Enhanced) > In the 'Protected View' section, verify the radio button for 'All files' is checked and greyed out (locked). If the button is not checked nor greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Protected View' must be set to 'Enabled' and 'All files' selected in the drop down box.


vuln_id: V-213129
rule_id: SV-213129r400525_rule
severity: CAT I
title: The Adobe Acrobat Pro DC Continuous latest security-related software updates must be installed.
fix_text: Apply the latest security-related software updates to the Adobe Acrobat Pro DC application.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open Adobe Acrobat Pro DC.

  Navigate to and click on Help >> About Adobe Acrobat Pro DC.

  Verify that the latest security-related software updates by Adobe are being applied.

  If the latest security-related software updates by Adobe are not being applied, this is a finding.


vuln_id: V-213130
rule_id: SV-213130r766544_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous Default Handler changes must be disabled.
cci: CCI-001499
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Acrobat Pro allows users to change the version of Acrobat Pro that is used to read PDF files. This is a risk if multiple versions of Acrobat are installed on the system and the other version has dissimilar security configurations or known vulnerabilities. When the Default PDF Handler is disabled, the end users will not be able to change the default PDF viewer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisablePDFHandlerSwitching
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > General > 'Disable PDF handler switching' to 'Enabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisablePDFHandlerSwitching
  Type: REG_DWORD
  Value: 1

  If the value for bDisablePDFHandlerSwitching is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > General > Verify the 'Select As Default PDF Handler' option is greyed out (locked).  If the option is not greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > General > 'Disable PDF handler switching' must be set to 'Enabled'.


vuln_id: V-213131
rule_id: SV-213131r766547_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous must disable the ability to store files on Acrobat.com.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Adobe Acrobat Pro DC provides the ability to store PDF files on Adobe.com servers. Allowing users to store files on non-DoD systems introduces risk of data compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cCloud" is not created by default in the Acrobat Pro DC install and must be created.

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cCloud

  Value Name: bDisableADCFileStore
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Store files on Adobe.com' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cCloud" is not created by default in the Acrobat Pro DC install and must be created.

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cCloud

  Value Name: bDisableADCFileStore
  Type: REG_DWORD
  Value: 1

  If the value for bDisableADCFileStore is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Store files on Adobe.com' must be set to 'Disabled'.


vuln_id: V-213132
rule_id: SV-213132r766550_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous Cloud Synchronization must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, Adobe online services are tightly integrated in Adobe Acrobat. When the Adobe Cloud synchronization is disabled it prevents the synchronization of desktop preferences across devices on which the user is signed in with an Adobe ID (including phones).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cServices

  Value Name: bTogglePrefsSync
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Cloud Synchronization' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cServices

  Value Name: bTogglePrefsSync
  Type: REG_DWORD
  Value: 1

  If the value for bTogglePrefsSync is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Cloud Synchronization' must be set to 'Disabled'.


vuln_id: V-213133
rule_id: SV-213133r766553_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous Repair Installation must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When Repair Installation is disabled the user does not have the option (Help Menu) or ability to repair an Adobe Acrobat Pro DC install. Ability to repair includes the risk that established security settings could be overwritten.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  For 32 bit:
  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Adobe\Adobe Acrobat\DC\Installer

  For 64 bit:
  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \SOFTWARE\Wow6432Node\Adobe\Adobe Acrobat\DC\Installer

  Value Name: DisableMaintenance
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > Help > 'Repair Installation on 32/64 bit' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: 

  For 32 bit:
  HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Acrobat\DC\Installer

  For 64 bit:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe Acrobat\DC\Installer

  Value Name: DisableMaintenance
  Type: REG_DWORD
  Value: 1

  If the value for DisableMaintenance is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Help > Verify the option 'Repair Installation' is greyed out (locked). If the option is not greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > Help > 'Repair Installation on 32/64 bit' must be set to 'Disabled'.


vuln_id: V-213134
rule_id: SV-213134r766556_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous third-party web connectors must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Third-party connectors include services such as Dropbox and Google Drive. When third-party web connectors are disabled, it prevents access to third-party services for file storage. Allowing access to online storage services introduces the risk of data loss or data exfiltration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cServices

  Value Name: bToggleWebConnectors
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Third-party web connectors' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cServices

  Value Name: bToggleWebConnectors
  Type: REG_DWORD
  Value: 1

  If the value for bToggleWebConnectors is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Third-party web connectors' must be set to 'Disabled'.


vuln_id: V-213135
rule_id: SV-213135r766559_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous Webmail must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Acrobat Pro DC provides a Webmail capability. This allows users to send PDFs as email attachments using any mail account that supports SMTP/IMAP protocols. In addition to existing desktop email clients, users can now configure these mail accounts by providing User Name, Password, IMAP and SMTP details. The capability allows users to utilize Gmail and Yahoo mail accounts to send PDF files directly from within the Acrobat application. This capability allows the user to by-pass existing email protections provided by DoD email services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles

  Value Name: bDisableWebmail
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'WebMail' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles

  Value Name: bDisableWebmail
  Type: REG_DWORD
  Value: 1

  If the value for bDisableWebmail is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'WebMail' must be set to 'Disabled'.


vuln_id: V-213136
rule_id: SV-213136r766562_rule
severity: CAT III
title: The Adobe Acrobat Pro DC Continuous Welcome Screen must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Adobe Welcome screen can be distracting. It provides marketing material and also has online links to the Adobe quick tips website, tutorials, blogs, and community forums. When the Adobe Welcome screen is disabled, the Welcome screen will not be populated on application startup.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cWelcomeScreen" is not created by default in the Acrobat Pro DC install and must be created.

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWelcomeScreen

  Value Name: bShowWelcomeScreen
  Type: REG_DWORD
  Value: 0

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Welcome Screen' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cWelcomeScreen" is not created by default in the Acrobat Pro DC install and must be created.

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWelcomeScreen

  Value Name: bShowWelcomeScreen
  Type: REG_DWORD
  Value: 0

  If the value for bShowWelcomeScreen is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'Welcome Screen' must be set to 'Disabled'.


vuln_id: V-213137
rule_id: SV-213137r766565_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous SharePoint and Office365 access must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Both SharePoint and Office365 configurations are shared in one setting. Disabling this setting removes the user’s ability to use both SharePoint and Office365 cloud features and functions. If the user is allowed to store files on public cloud services, there is a risk of data compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cSharePoint" is not created by default in the Acrobat Pro DC install and must be created.

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cSharePoint

  Value Name: bDisableSharePointFeatures
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'SharePoint and Office 365 access' to 'Disabled'.

check_text:
  NOTE: If configured to an approved DoD SharePoint Server, this is NA.

  Verify the following registry configuration:

  Note: The Key Name "cSharePoint" is not created by default in the Acrobat Pro DC install and must be created.

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cSharePoint

  Value Name: bDisableSharePointFeatures
  Type: REG_DWORD
  Value: 1

  If the value for bDisableSharePointFeatures is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: Computer Configuration > Administrative Template > Adobe Acrobat Pro DC Continuous > Preferences > 'SharePoint and Office 365 access' must be set to 'Disabled'.


vuln_id: V-213138
rule_id: SV-213138r766568_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous Periodic downloading of Adobe certificates must be disabled.
cci: CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, the user can update Adobe certificates from an Adobe server through the GUI. When updating Adobe certificates is disabled, it prevents the automatic download and installation of certificates and disables and locks the end user's ability to download those certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_CURRENT_USER
  Registry Path:
  \Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cAdobeDownload

  Value Name: bLoadSettingsFromURL
  Type: REG_DWORD
  Value: 0

  Configure the policy value for User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe AATL server' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cAdobeDownload

  Value Name: bLoadSettingsFromURL
  Type: REG_DWORD
  Value: 0

  If the value for bLoadSettingsFromURL is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Trust Manager > In the 'Automatic Adobe Approved Trust List (AATL) Updates' section > verify the 'Load trusted certificates from an Adobe AATL server' is not checked.  If the box is checked, this is a finding.

  Admin Template path: User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe AATL server' must be set to 'Disabled'.


vuln_id: V-213139
rule_id: SV-213139r766571_rule
severity: CAT III
title: Adobe Acrobat Pro DC Continuous privileged host locations must be disabled.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Privileged Locations are the primary method Acrobat uses to allow users and admins to specify trusted content that should be exempt from security restrictions, such as when Enhanced Security is enabled.  A Privileged Location may be a file, folder, or a host. If the user is allowed to set a Privileged Location, they could bypass security protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisableTrustedSites
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Privileged host locations' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

  Value Name: bDisableTrustedSites
  Type: REG_DWORD
  Value: 1

  If the value for bDisableTrustedSites is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  GUI path: Edit > Preferences > Security (Enhanced) > In the 'Privileged Locations' section, verify 'Add Host' option is greyed out (locked).  If the option is not greyed out, this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Security (Enhanced) > 'Privileged host locations' must be set to 'Disabled'.


vuln_id: V-245874
rule_id: SV-245874r766580_rule
severity: CAT II
title: Adobe Acrobat Pro DC Continuous FIPS mode must be enabled.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive:
  HKEY_CURRENT_USER
  Registry Path:
  \Software\Adobe\Adobe Acrobat\DC\AVGeneral

  Value Name: bFIPSMode
  Type: REG_DWORD
  Value: 1
  Configure the policy value for User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Enable FIPS' to 'Enabled'.

check_text:
  Verify the following registry configuration:

  Using the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\AVGeneral

  Value Name: bFIPSMode
  Type: REG_DWORD
  Value: 1

  If the value for bFIPSMode is not set to “1” and Type is not configured to REG_DWORD or does not exist, this is a finding.

  Admin Template path: User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > 'Enable FIPS' must be set to 'Enabled'.


vuln_id: V-213168
rule_id: SV-213168r395811_rule
severity: CAT II
title: Adobe Reader DC must enable Enhanced Security in a Standalone Application.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>PDFs have evolved from static pages to complex documents with features such as interactive forms, multimedia content, scripting, and other capabilities. These features leave PDFs vulnerable to malicious scripts or actions that can damage the computer or steal data. The Enhanced security feature protects the computer against these threats by blocking or selectively permitting actions for trusted locations and files.

  Enhanced Security determines if a PDF is viewed within a standalone application. A threat to users of Adobe Reader DC is opening a PDF file that contains malicious executable content.

  Enhanced Security “hardens” the application against risky actions: prevents cross domain access, prohibits script and data injection, blocks stream access to XObjects, silent printing, and execution of high privilege JavaScript.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnhancedSecurityStandalone
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnhancedSecurityStandalone
  Type: REG_DWORD
  Value: 1

  If the value for bEnhancedSecurityStandalone is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213169
rule_id: SV-213169r395811_rule
severity: CAT II
title: Adobe Reader DC must enable Enhanced Security in a Browser.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>PDFs have evolved from static pages to complex documents with features such as interactive forms, multimedia content, scripting, and other capabilities. These features leave PDFs vulnerable to malicious scripts or actions that can damage the computer or steal data. The Enhanced security feature protects the computer against these threats by blocking or selectively permitting actions for trusted locations and files.

  Enhanced Security determines if a PDF is viewed within a browser application. A threat to users of Adobe Reader DC is opening a PDF file that contains malicious executable content.

  Enhanced Security “hardens” the application against risky actions: prevents cross domain access, prohibits script and data injection, blocks stream access to XObjects, silent printing, and execution of high privilege JavaScript.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnhancedSecurityInBrowser
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnhancedSecurityInBrowser
  Type: REG_DWORD 
  Value: 1

  If the value for bEnhancedSecurityInBrowser is not set to “1” and Type configured to REG_DWORD  or does not exist, then this is a finding.


vuln_id: V-213170
rule_id: SV-213170r395811_rule
severity: CAT II
title: Adobe Reader DC must enable Protected Mode.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A threat to users of Adobe Reader DC is opening a PDF file that contains malicious executable content.

  Protected mode provides a sandbox capability that prevents malicious PDF files from launching arbitrary executable files, writing to system directories or the Windows registry.

  This isolation of the PDFs reduces the risk of security breaches in areas outside the sandbox.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bProtectedMode
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown 

  Value Name: bProtectedMode
  Type: REG_DWORD
  Value: 1

  If the value for bProtectedMode is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213171
rule_id: SV-213171r395811_rule
severity: CAT II
title: Adobe Reader DC must enable Protected View.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A threat to users of Adobe Reader DC is opening a PDF file that contains malicious executable content.

  Protected view restricts Adobe Reader DC functionality, within a sandbox, when a PDF is opened from an untrusted source.

  This isolation of the PDFs reduces the risk of security breaches in areas outside the sandbox.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: iProtectedView
  Type: REG_DWORD
  Value: 2

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: iProtectedView
  Type: REG_DWORD
  Value: 2

  If the value for iProtectedView is not set to “2” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213172
rule_id: SV-213172r395811_rule
severity: CAT II
title: Adobe Reader DC must Block Websites.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Clicking any link to the Internet poses a potential security risk. Malicious websites can transfer harmful content or silently gather data. Acrobat Reader documents can connect to websites which can pose a potential threat to DoD systems and that functionality must be blocked. However, PDF document workflows that are trusted (e.g., DoD-created) can benefit from leveraging legitimate website access with minimal risk. Therefore, the ISSO may approve of website access and accept the risk if the access provides benefit and is a trusted site or the risk associated with accessing the site has been mitigated.

  Adobe Reader must block access to all websites that are not specifically allowed by ISSO risk acceptance.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path:
  \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cDefaultLaunchURLPerms

  Value Name: iURLPerms
  Type: REG_DWORD
  Value: 1

  If configuring system to allow access to websites, obtain documented ISSO approvals and risk acceptance and set “iURLPerms” to “0”.

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cDefaultLaunchURLPerms

  Value Name: iURLPerms
  Type: REG_DWORD
  Value: 1

  Value: 0 - only with a documented ISSO risk acceptance

  If the value for “iURLPerms” is set to “0” and a documented ISSO risk acceptance approving access to websites is provided, this is not a finding.

  If the value for “iURLPerms” is not set to “1” and “Type” configured to “REG_DWORD” or does not exist, this is a finding.


vuln_id: V-213173
rule_id: SV-213173r395811_rule
severity: CAT II
title: Adobe Reader DC must block access to Unknown Websites.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Because Internet access is a potential security risk, clicking any unknown website link to the Internet poses a potential security risk.

  Malicious websites can transfer harmful content or silently gather data.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cDefaultLaunchURLPerms

  Value Name: iUnknownURLPerms
  Type: REG_DWORD
  Value: 3

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cDefaultLaunchURLPerms

  Value Name: iUnknownURLPerms
  Type: REG_DWORD
  Value: 3

  If the value for iUnknownURLPerms is not set to “3” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213174
rule_id: SV-213174r395811_rule
severity: CAT II
title: Adobe Reader DC must prevent opening files other than PDF or FDF.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attachments represent a potential security risk because they can contain malicious content, open other dangerous files, or launch applications. Certainly file types such as .bin, .exe, .bat, and so on will be recognized as threats.

  This feature prevents users from opening or launching file types other than PDF or FDF and disables the menu option.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: iFileAttachmentPerms
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: iFileAttachmentPerms
  Type: REG_DWORD
  Value: 1

  If the value for iFileAttachmentPerms is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213175
rule_id: SV-213175r395811_rule
severity: CAT II
title: Adobe Reader DC must block Flash Content.
cci: CCI-001166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Flash content is commonly hosted on a web page, but it can also be embedded in PDF and other documents. Flash could be used to surreptitious install malware on the end-users computer.

  Flash Content restricts Adobe Reader DC not to play Flash content within a PDF.

  Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnableFlash
  Type: REG_DWORD
  Value: 0

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bEnableFlash
  Type: REG_DWORD
  Value: 0

  If the value for bEnableFlash is not set to “0” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213176
rule_id: SV-213176r395850_rule
severity: CAT III
title: Adobe Reader DC must disable the ability to change the Default Handler.
cci: CCI-001499
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Allowing user to make changes to an application case cause a security risk.

  When the Default PDF Handler is disabled, the end users will not be able to change the default PDF viewer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisablePDFHandlerSwitching
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisablePDFHandlerSwitching
  Type: REG_DWORD
  Value: 1

  If the value for bDisablePDFHandlerSwitching is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213177
rule_id: SV-213177r766574_rule
severity: CAT III
title: Adobe Reader DC must disable the Adobe Send and Track plugin for Outlook.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When enabled, Adobe Send and Track button appears in Outlook. When an email is composed it enables the ability to send large files as public links through Outlook. The attached files can be uploaded to the Adobe Document Cloud and public links to the files are inserted in the email body.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cCloud" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cCloud

  Value Name: bAdobeSendPluginToggle
  Type: REG_DWORD
  Value: 1

  Configure the policy value for Computer Configuration > Administrative Templates > Adobe Reader DC Continuous > Preferences > 'Send and Track plugin' to 'Disabled'.

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cCloud" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cCloud

  Value Name: bAdobeSendPluginToggle
  Type: REG_DWORD
  Value: 1

  If the value for bAdobeSendPluginToggle is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.

  Admin Template path: Computer Configuration > Administrative Templates > Adobe Reader DC Continuous > Preferences > 'Send and Track plugin' must be set to 'Disabled'.


vuln_id: V-213178
rule_id: SV-213178r395853_rule
severity: CAT II
title: Adobe Reader DC must disable all service access to Document Cloud Services.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, Adobe online services are tightly integrated in Adobe Reader DC. With the integration of Adobe Document Cloud, disabling this feature prevents the risk of additional attack vectors.

  Within Adobe Reader DC, the Adobe Cloud resources require a paid subscription for each service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleAdobeDocumentServices
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleAdobeDocumentServices
  Type: REG_DWORD
  Value: 1

  If the value for bToggleAdobeDocumentServices is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213179
rule_id: SV-213179r395853_rule
severity: CAT II
title: Adobe Reader DC must disable Cloud Synchronization.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, Adobe online services are tightly integrated in Adobe Reader DC. When the Adobe Cloud synchronization is disabled it prevents the synchronization of desktop preferences across devices on which the user is signed in with an Adobe ID (including phones).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bTogglePrefsSync
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bTogglePrefsSync
  Type: REG_DWORD
  Value: 1

  If the value for bTogglePrefsSync is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213180
rule_id: SV-213180r395853_rule
severity: CAT III
title: Adobe Reader DC must disable the Adobe Repair Installation.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When Repair Installation is disabled the user does not have the option (Help Menu) or functional to repair an Adobe Reader DC install.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  "Configure the following registry value:

  For 32 bit:
  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Adobe\Acrobat Reader\DC\Installer 

  For 64 bit:
  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\DC\Installer

  Value Name: DisableMaintenance
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: 

  For 32 bit:
  HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\DC\Installer

  For 64 bit:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\DC\Installer

  Value Name: DisableMaintenance
  Type: REG_DWORD
  Value: 1

  If the value for DisableMaintenance is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213181
rule_id: SV-213181r395853_rule
severity: CAT II
title: Adobe Reader DC must disable 3rd Party Web Connectors.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When 3rd Party Web Connectors are disabled it prevents the configuration of Adobe Reader DC access to third party services for file storage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleWebConnectors
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleWebConnectors
  Type: REG_DWORD
  Value: 1

  If the value for bToggleWebConnectors is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213182
rule_id: SV-213182r395853_rule
severity: CAT III
title: Adobe Reader DC must disable Acrobat Upsell.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Products that don't provide the full set of features by default provide the user the opportunity to upgrade. Acrobat Upsell displays message which encourage the user to upgrade the product. For example, Reader users can purchase additional tools and features, and Acrobat Reader users can upgrade to Acrobat Professional.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE

  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bAcroSuppressUpsell
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following:

  HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bAcroSuppressUpsell
  Type: REG_DWORD
  Value: 1   

  If the value for bAcroSuppressUpsell is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213183
rule_id: SV-213183r395853_rule
severity: CAT III
title: Adobe Reader DC must disable Adobe Send for Signature.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Adobe Document Cloud sign service allows users to send documents online for signature and sign from anywhere or any device. The signed documents are stored in the Adobe Cloud. The Adobe Document Cloud sign service is a paid subscription.

  When Adobe Send for Signature is disabled users will not be allowed to utilize the Adobe Document Cloud sign function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleAdobeSign
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bToggleAdobeSign
  Type: REG_DWORD
  Value: 1

  If the value for bToggleAdobeSign is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213184
rule_id: SV-213184r395853_rule
severity: CAT II
title: Adobe Reader DC must disable access to Webmail.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When Webmail is disabled the user cannot configure a webmail account to send an open PDF document as an attachment. Users should have the ability to send documents as Microsoft Outlook attachments. The difference is that Outlook must be configured by the administrator on the local machine.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cWebmailProfiles" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles

  Value Name: bDisableWebmail
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cWebmailProfiles" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles

  Value Name: bDisableWebmail
  Type: REG_DWORD
  Value: 1

  If the value for bDisableWebmail is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213185
rule_id: SV-213185r395853_rule
severity: CAT II
title: Adobe Reader DC must disable Online SharePoint Access.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Disabling SharePoint disables or removes the user’s ability to add a SharePoint account access controls the application's ability to detect that a file came from a SharePoint server, and disables the check-out prompt.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cSharePoint" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint

  Value Name: bDisableSharePointFeatures
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  If configured to an approved DoD SharePoint Server, this is NA.

  Note: The Key Name "cSharePoint" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint

  Value Name: bDisableSharePointFeatures
  Type: REG_DWORD
  Value: 1

  If the value for bDisableSharePointFeatures is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213186
rule_id: SV-213186r395853_rule
severity: CAT III
title: Adobe Reader DC must disable the Adobe Welcome Screen.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Adobe Reader DC Welcome screen can be distracting and also has online links to the Adobe quick tips website, tutorials, blogs and community forums.

  When the Adobe Reader DC Welcome screen is disabled the Welcome screen will not be populated on application startup.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cWelcomeScreen" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWelcomeScreen

  Value Name: bShowWelcomeScreen
  Type: REG_DWORD
  Value: 0

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cWelcomeScreen" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWelcomeScreen

  Value Name: bShowWelcomeScreen
  Type: REG_DWORD
  Value: 0

  If the value for bShowWelcomeScreen is not set to “0” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213187
rule_id: SV-213187r395853_rule
severity: CAT III
title: Adobe Reader DC must disable Service Upgrades.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, Adobe online services are tightly integrated into Adobe Reader DC. Disabling Service Upgrades disables both updates to the product's web-plugin components as well as all services without exception, including any online sign-in screen.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bUpdater
  Type: REG_DWORD
  Value: 0

check_text:
  Verify the following registry configuration:

  Note: The Key Name "cServices" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices

  Value Name: bUpdater
  Type: REG_DWORD
  Value: 0

  If the value for bUpdater is not set to “0” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213188
rule_id: SV-213188r400006_rule
severity: CAT II
title: Adobe Reader DC must disable the ability to add Trusted Files and Folders.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Privileged Locations allow the user to selectively trust files, folders, and hosts to bypass some security restrictions, such as enhanced security and protected view. By default, the user can create privileged locations through the GUI.

  Disabling Trusted Files and Folders disables and locks the end user's ability to add folders and files as a privileged location prevents them from assigning trust and thereby exempting that location from enhanced security restrictions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisableTrustedFolders
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisableTrustedFolders
  Type: REG_DWORD
  Value: 1

  If the value for bDisableTrustedFolders is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213189
rule_id: SV-213189r400006_rule
severity: CAT II
title: Adobe Reader DC must disable the ability to elevate IE Trusts to Privileged Locations.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Privileged Locations allow the user to selectively trust files, folders, and hosts to bypass some security restrictions, such as enhanced security and protected view. By default, the user can create privileged locations through the GUI.

  Disabling IE Trusts to Privileged Locations disables and locks the end user's ability to treat IE trusted sites as a privileged location prevents them from assigning trust and thereby exempting that location from enhanced security restrictions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisableTrustedSites
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Utilizing the Registry Editor, navigate to the following: HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown

  Value Name: bDisableTrustedSites
  Type: REG_DWORD
  Value: 1

  If the value for bDisableTrustedSites is not set to “1” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213190
rule_id: SV-213190r400378_rule
severity: CAT III
title: Adobe Reader DC must disable periodical uploading of European certificates.
cci: CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, the user can update European certificates from an Adobe server through the GUI.

  When uploading European certificates is disabled, it prevents the automatic download and installation of certificates and disables and locks the end user's ability to upload those certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Names "cDigSig" and "cEUTLDownload" are not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \Software\Adobe\Acrobat Reader\DC\Security\cDigSig\cEUTLDownload

  Value Name: bLoadSettingsFromURL 
  Type: REG_DWORD
  Value: 0

check_text:
  Verify the following registry configuration:

  Note: The Key Names "cDigSig" and "cEUTLDownload" are not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Security\cDigSig\cEUTLDownload

  Value Name: bLoadSettingsFromURL 
  Type: REG_DWORD
  Value: 0

  If the value for bLoadSettingsFromURL is not set to “0” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213191
rule_id: SV-213191r400378_rule
severity: CAT III
title: Adobe Reader DC must disable periodical uploading of Adobe certificates.
cci: CCI-002470
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By default, the user can update Adobe certificates from an Adobe server through the GUI.

  When uploading Adobe certificates is disabled, it prevents the automatic download and installation of certificates and disables and locks the end user's ability to upload those certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Names "cDigSig" and "cAdobeDownload" are not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \Software\Adobe\Acrobat Reader\DC\Security\cDigSig\cAdobeDownload

  Value Name: bLoadSettingsFromURL 
  Type: REG_DWORD
  Value: 0

check_text:
  Verify the following registry configuration:

  Note: The Key Names "cDigSig" and "cAdobeDownload" are not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Security\cDigSig\cAdobeDownload

  Value Name: bLoadSettingsFromURL 
  Type: REG_DWORD
  Value: 0

  If the value for bLoadSettingsFromURL is not set to “0” and Type configured to REG_DWORD or does not exist, then this is a finding.


vuln_id: V-213192
rule_id: SV-213192r400525_rule
severity: CAT I
title: Adobe Reader DC must have the latest Security-related Software Updates installed.
fix_text: Apply the latest security-related software updates to the Adobe Acrobat Reader application.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.

  Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw).

  This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process.

  The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Determine the method for doing this (e.g., connection to a WSUS server, local procedure, auto update, etc.).

  Open Adobe Acrobat Reader DC.

  Navigate to and click on Help >> About Adobe Acrobat Reader DC.

  Verify that the latest security-related software updates by Adobe are being applied.

  If the latest security-related software updates by Adobe are not being applied, this is a finding.


vuln_id: V-213193
rule_id: SV-213193r400876_rule
severity: CAT II
title: Adobe Reader DC must enable FIPS mode.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the following registry value:

  Note: The Key Names "bFIPSMode" is not created by default in the Adobe Reader DC install and must be created.

  Registry Hive: HKEY_CURRENT_USER
  Registry Path: \Software\Adobe\Acrobat Reader\DC\AVGeneral

  Value Name: bFIPSMode 
  Type: REG_DWORD
  Value: 1

check_text:
  Verify the following registry configuration:

  Note: The Key Names "bFIPSMode" is not created by default in the Adobe Reader DC install and must be created.

  Utilizing the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral

  Value Name: bFIPSMode 
  Type: REG_DWORD
  Value: 1

  If the value for bFIPSMode is not set to “1” and Type configured to REG_DWORD does not exist, then this is a finding.


vuln_id: V-215807
rule_id: SV-215807r960735_rule
severity: CAT II
cci: CCI-000054
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.

description:
  <VulnDiscussion>Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DoS) attacks.

  This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to limit the number of concurrent management sessions to an organization-defined number as shown in the example below.

  R4(config)#ip http max-connections 2 
  R4(config)#line vty 0 1 
  R4(config-line)#transport input ssh
  R4(config-line)#exit
  R4(config)#line vty 2 4 
  R4(config-line)# transport input none  
  R4(config-line)#end

check_text:
  Note: This requirement is not applicable to file transfer actions such as FTP, SCP, and SFTP.

  Review the router configuration to determine if concurrent management sessions are limited as shown in the example below:

  ip http secure-server 
  ip http max-connections 2 
  … 
  … 
  … 
  line vty 0 1 
  transport input ssh 
  line vty 2 4 
  transport input none 

  If the router is not configured to limit the number of concurrent management sessions, this is a finding.


vuln_id: V-215808
rule_id: SV-215808r960777_rule
severity: CAT II
title: The Cisco router must be configured to automatically audit account creation.
cci: CCI-000018
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notification of account creation helps to mitigate this risk. Auditing account creation provides the necessary reconciliation that account management procedures are being followed. Without this audit trail, personnel without the proper authorization may gain access to critical network nodes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log account creation using the following commands:

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the router configuration to determine if it automatically audits account creation. The configuration should look similar to the example below:

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If account creation is not automatically audited, this is a finding.


vuln_id: V-215809
rule_id: SV-215809r960780_rule
severity: CAT II
title: The Cisco router must be configured to automatically audit account modification.
cci: CCI-001403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Since the accounts in the network device are privileged or system-level accounts, account management is vital to the security of the network device. Account management by a designated authority ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel with the appropriate and necessary privileges. Auditing account modification along with an automatic notification to appropriate individuals will provide the necessary reconciliation that account management procedures are being followed. If modifications to management accounts are not audited, reconciliation of account management procedures cannot be tracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log account modification using the following commands:

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the router configuration to determine if it automatically audits account modification. The configuration should look similar to the example below:

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If account modification is not automatically audited, this is a finding.


vuln_id: V-215810
rule_id: SV-215810r960783_rule
severity: CAT II
title: The Cisco router must be configured to automatically audit account disabling actions.
cci: CCI-001404
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account disabling actions will support account management procedures. When device management accounts are disabled, user or service accessibility may be affected. Auditing also ensures authorized active accounts remain enabled and available for use when required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log account disabling using the following commands:

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the router configuration to determine if it automatically audits account disabling. The configuration should look similar to the example below:

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If account disabling is not automatically audited, this is a finding.


vuln_id: V-215811
rule_id: SV-215811r960786_rule
severity: CAT II
title: The Cisco router must be configured to automatically audit account removal actions.
cci: CCI-001405
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account removal actions will support account management procedures. When device management accounts are terminated, user or service accessibility may be affected. Auditing also ensures authorized active accounts remain enabled and available for use when required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log account removal using the following commands:

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the router configuration to determine if it automatically audits account removal. The configuration should look similar to the example below:

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If account removal is not automatically audited, this is a finding.


vuln_id: V-215812
rule_id: SV-215812r991874_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies.

description:
  <VulnDiscussion>A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If management information flow is not enforced based on approved authorizations, the network device may become compromised. Information flow control regulates where management information is allowed to travel within a network device. The flow of all management information must be monitored and controlled so it does not introduce any unacceptable risk to the network device or data. 

  Application-specific examples of enforcement occur in systems that employ rule sets or establish configuration settings that restrict information system services or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics).

  Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of management information within the system in accordance with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to restrict management access to specific IP addresses via SSH as shown in the example below.

  SW2(config)#ip access-list standard MANAGEMENT_NET 
  SW2(config-std-nacl)#permit x.x.x.0 0.0.0.255 
  SW2(config-std-nacl)#exit 
  SW2(config)#line vty 0 1 
  SW2(config-line)#transport input ssh 
  SW2(config-line)#access-class MANAGEMENT_NET in 
  SW2(config-line)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement. 

  Step 1: Verify that the line vty has an ACL inbound applied as shown in the example below.

  line vty 0 1
   access-class MANAGEMENT_NET in
   transport input ssh

  Step 2: Verify that the ACL permits only hosts from the management network to access the router.

  ip access-list extended MANAGEMENT_NET 
  permit ip x.x.x.0 0.0.0.255 any
  deny   ip any any log-input

  If the Cisco router is not configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies, this is a finding.


vuln_id: V-215813
rule_id: SV-215813r960840_rule
severity: CAT II
cci: CCI-000044
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.

description:
  <VulnDiscussion>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce the limit of three consecutive invalid logon attempts as shown in the example below.

  R2(config)#login block-for 900 attempts 3 within 120

check_text:
  Review the Cisco router configuration to verify that it enforces the limit of three consecutive invalid logon attempts as shown in the example below.

  login block-for 900 attempts 3 within 120

  Note: The configuration example above will block any login attempt for 15 minutes after three consecutive invalid logon attempts within a two-minute period.

  If the Cisco router is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.


vuln_id: V-215814
rule_id: SV-215814r960843_rule
severity: CAT II
cci: CCI-000048
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

description:
  <VulnDiscussion>Display of the DoD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

  System use notifications are required only for access via logon interfaces with human users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to display the Standard Mandatory DoD Notice and Consent Banner before granting access as shown in the following example:

  R1(config)#banner login #
  Enter TEXT message. End with the character '#'.
  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

  By using this IS (which includes any device attached to this IS), you consent to the following conditions:

  -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

  -At any time, the USG may inspect and seize data stored on this IS.

  -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

  -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

  -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. #
  R1(config)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  banner login ^C
  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

  By using this IS (which includes any device attached to this IS), you consent to the following conditions:

  -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

  -At any time, the USG may inspect and seize data stored on this IS.

  -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

  -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

  -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
  ^C

  If the Cisco router is not configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device, this is a finding.


vuln_id: V-215815
rule_id: SV-215815r960864_rule
severity: CAT II
title: The Cisco device must be configured to audit all administrator activity.
cci: CCI-000166
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement.

  To meet this requirement, the network device must log administrator access and activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log administrator activity as shown in the example below.

  R1(config)#logging userinfo
  R1(config)#archive
  R1(config-archive)#log config
  R1(config-archive-log-cfg)#logging enable
  R1(config-archive-log-cfg)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  hostname R1
  !
  logging userinfo
  !
  …
  …
  …
  archive
   log config
   logging enable
  !

  Note: The logging userinfo global configuration command will generate a log when a user increases his or her privilege level.

  If logging of administrator activity is not configured, this is a finding.


vuln_id: V-215817
rule_id: SV-215817r960894_rule
severity: CAT II
cci: CCI-000131
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.

description:
  <VulnDiscussion>It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Logging the date and time of each detected event provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured network device. In order to establish and correlate the series of events leading up to an outage or attack, it is imperative the date and time are recorded in all log records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to include the date and time on all log records as shown in the example below.

  R1(config)#service timestamps log datetime localtime

check_text:
  Verify that the router is configured to include the date and time on all log records as shown in the configuration example below.

  service timestamps log datetime localtime

  If time stamps are not configured, this is a finding.


vuln_id: V-215818
rule_id: SV-215818r960897_rule
severity: CAT II
cci: CCI-000132
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must produce audit records containing information to establish where the events occurred.

description:
  <VulnDiscussion>In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as device hardware components, device software modules, session identifiers, filenames, host names, and functionality.

  Associating information about where the event occurred within the network device provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the log-input parameter after any deny statements to provide the location as to where packets have been dropped via an ACL.

  R1(config)#ip access-list extended BLOCK_INBOUND
  R1(config-ext-nacl)#deny icmp any any log-input

check_text:
  Review the deny statements in all interface ACLs to determine if the log-input parameter has been configured as shown in the example below.
  Note: log-input can only apply to interface bound ACLs.

  ip access-list extended BLOCK_INBOUND
   deny  icmp any any log-input

  If the router is not configured with the log-input parameter after any deny statements to note where packets have been dropped via an ACL, this is a finding.


vuln_id: V-215819
rule_id: SV-215819r960909_rule
severity: CAT II
cci: CCI-000135
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.

description:
  <VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. 

  Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The additional information required is dependent on the type of information (i.e., sensitivity of the data and the environment within which it resides). At a minimum, the organization must audit full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to log all configuration changes as shown in the example below.

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement. The configuration example below will log all configuration changes.

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If the Cisco router is not configured to generate audit records of configuration changes, this is a finding.


vuln_id: V-215820
rule_id: SV-215820r960933_rule
severity: CAT II
title: The Cisco router must be configured to protect audit information from unauthorized modification.
cci: CCI-000163
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit network device activity.

  If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. 

  To ensure the veracity of audit data, the network device must protect audit information from unauthorized modification. 

  This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions and limiting log data locations. 

  Network devices providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights that the user enjoys in order to make access decisions regarding the modification of audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If persistent logging is enabled, configure the router to only allow administrators with privilege level "15" access to the file system as shown in the example below.

  R4(config)#file privilege 15

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement.

  Step 1: If persistent logging is enabled as shown in the example below, go to step 2. Otherwise, this requirement is not applicable.

  logging persistent url disk0:/logfile size 134217728 filesize 16384

  Step 2: Verify that the router is not configured with a privilege level other than "15" to allow access to the file system as shown in the example below.

  file privilege 10 

  Note: The default privilege level required for access to the file system is "15"; hence, the command file privilege "15" will not be shown in the configuration.

  If the router is configured with a privilege level other than "15" to allow access to the file system, this is a finding.


vuln_id: V-215821
rule_id: SV-215821r960936_rule
severity: CAT II
title: The Cisco router must be configured to protect audit information from unauthorized deletion.
cci: CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

  If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. 

  To ensure the veracity of audit data, the network device must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include: ensuring log files receive the proper file system permissions utilizing file system protections, restricting access, and backing up log data to ensure log data is retained. 

  Network devices providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights the user enjoys in order to make access decisions regarding the deletion of audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If persistent logging is enabled, configure the router to only allow administrators with privilege level "15" access to the file system as shown in the example below.

  R4(config)#file privilege 15

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement.

  Step 1: If persistent logging is enabled as shown in the example below, go to step 2. Otherwise, this requirement is not applicable.

  logging persistent url disk0:/logfile size 134217728 filesize 16384

  Step 2: Verify that the router is not configured with a privilege level other than "15" to allow access to the file system as shown in the example below.

  file privilege 10 

  Note: The default privilege level required for access to the file system is "15"; hence, the command file privilege "15" will not be shown in the configuration.

  If the router is configured with a privilege level other than "15" to allow access to the file system, this is a finding.


vuln_id: V-215822
rule_id: SV-215822r960960_rule
severity: CAT II
cci: CCI-001499
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to limit privileges to change the software resident within software libraries.

description:
  <VulnDiscussion>Changes to any software components of the network device can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the network device for implementing any changes or upgrades. If the network device were to enable non-authorized users to make changes to software libraries, those changes could be implemented without undergoing testing, validation, and approval.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to only allow administrators with privilege level "15" access to the file system as shown in the example below.

  R4(config)#file privilege 15

check_text:
  Verify that the router is not configured with a privilege level other than "15" to allow access to the file system as shown in the example below.

  file privilege 10 

  Note: The default privilege level required for access to the file system is "15"; hence, the command file privilege "15" will not be shown in the configuration.

  If the router is configured with a privilege level other than "15" to allow access to the file system, this is a finding.


vuln_id: V-215823
rule_id: SV-215823r1043177_rule
severity: CAT I
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.

description:
  <VulnDiscussion>Network devices are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. 

  To support the requirements and principles of least functionality, the network device must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved. Some network devices have capabilities enabled by default; if these capabilities are not necessary, they must be disabled. If a particular capability is used, then it must be documented and approved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable the following services if enabled as shown in the example below.

  R2(config)#no boot network
  R2(config)#no ip boot server
  R2(config)#no ip bootp server
  R2(config)#no ip dns server
  R2(config)#no ip identd
  R2(config)#no ip finger
  R2(config)#no ip http server
  R2(config)#no ip rcmd rcp-enable
  R2(config)#no ip rcmd rsh-enable
  R2(config)#no service config
  R2(config)#no service finger
  R2(config)#no service tcp-small-servers
  R2(config)#no service udp-small-servers
  R2(config)#no service pad
  R2(config)#no service call-home
  R2(config)#end

check_text:
  Verify that the router does not have any unnecessary or nonsecure ports, protocols, and services enabled. For example, the following commands should not be in the configuration:

  boot network
  ip boot server
  ip bootp server
  ip dns server
  ip identd
  ip finger
  ip http server
  ip rcmd rcp-enable
  ip rcmd rsh-enable
  service config
  service finger
  service tcp-small-servers
  service udp-small-servers
  service pad
  service call-home

  Note: Certain legacy devices may require 'service call-home' be enabled to support Smart Licensing as they do not support the newer smart transport configuration. Those devices do not incur a finding for having call-home enabled for Smart Licensing.

  If any unnecessary or nonsecure ports, protocols, or services are enabled, this is a finding.


vuln_id: V-215824
rule_id: SV-215824r1051115_rule
severity: CAT II
cci: CCI-001358
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

description:
  <VulnDiscussion>Authentication for administrative (privileged level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary.

  The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit should be added to the envelope as a record.
  An alternative to using a sealed envelope in a safe would be credential files, separated by technology, located in a secured location on a file server, with the files only accessible to those administrators authorized to use the accounts of last resort, and access to that location monitored by a central log server. 
  Administrators should secure the credentials and disable the root account (if possible) when not needed for system administration functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure a local account as shown in the example below.

  R2(config)#username xxxxxxxxx privilege nn secret xxxxxxx

  Step 2: Configure the authentication order to use the local account if the authentication server is not reachable as shown in the following example:

  R2(config)#aaa authentication login default group tacacs+ local

check_text:
  Step 1: Review the Cisco router configuration to verify that a local account for last resort has been configured.

  username xxxxxxxxxxx privilege nn common-criteria-policy PASSWORD_POLICY password xxxxxxxxxx

  Note: The configured Common Criteria policy must be used when creating or changing the local account password as shown in the example above.

  Step 2: Verify that local is defined after radius or tacas+ in the authentication order as shown in the example below.

  aaa authentication login default group tacacs+ local

  If the Cisco router is not configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable, this is a finding.


vuln_id: V-215826
rule_id: SV-215826r1015288_rule
severity: CAT II
title: The Cisco router must be configured to enforce a minimum 15-character password length.
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password.

  The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce a minimum 15-character password length as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#min-length 15
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
   min-length 15

  If the Cisco router is not configured to enforce a minimum 15-character password length, this is a finding.


vuln_id: V-215827
rule_id: SV-215827r1015289_rule
severity: CAT II
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce password complexity by requiring that at least one uppercase character be used.

description:
  <VulnDiscussion>Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

  Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.

  Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce password complexity by requiring that at least one uppercase character be used as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#upper-case 1
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
  upper-case 1

  If the Cisco router is not configured to enforce password complexity by requiring that at least one uppercase character be used, this is a finding.


vuln_id: V-215828
rule_id: SV-215828r1015290_rule
severity: CAT II
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce password complexity by requiring that at least one lowercase character be used.

description:
  <VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

  Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

  Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce password complexity by requiring that at least one lowercase character be used as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#lower-case 1
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
  lower-case 1

  If the Cisco router is not configured to enforce password complexity by requiring that at least one lowercase character be used, this is a finding.


vuln_id: V-215829
rule_id: SV-215829r1015291_rule
severity: CAT II
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce password complexity by requiring that at least one numeric character be used.

description:
  <VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

  Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

  Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce password complexity by requiring that at least one numeric character be used as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#numeric-count 1
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
   numeric-count 1

  If the Cisco router is not configured to enforce password complexity by requiring that at least one numeric character be used, this is a finding.


vuln_id: V-215830
rule_id: SV-215830r1015292_rule
severity: CAT II
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce password complexity by requiring that at least one special character be used.

description:
  <VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

  Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

  Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce password complexity by requiring that at least one special character be used as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#special-case 1
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
   special-case 1

  If the Cisco router is not configured to enforce password complexity by requiring that at least one special character be used, this is a finding.


vuln_id: V-215831
rule_id: SV-215831r1043189_rule
severity: CAT II
cci: CCI-004066
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

description:
  <VulnDiscussion>If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks.

  The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. In other words, characters may be the same within the two passwords; however, the positions of the like characters must be different.

  Multifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to enforce password complexity by requiring that when a password is changed, the characters are changed in at least eight of the positions within the password as shown in the example below.

  R1(config)#aaa common-criteria policy PASSWORD_POLICY
  R1(config-cc-policy)#char-changes 8
  R1(config-cc-policy)#exit

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  aaa new-model
  !
  !
  aaa common-criteria policy PASSWORD_POLICY
   char-changes 8

  If the Cisco router is not configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password, this is a finding.


vuln_id: V-215832
rule_id: SV-215832r1015294_rule
severity: CAT I
title: The Cisco router must only store cryptographic representations of passwords.
cci: CCI-004062
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.

  Network devices must enforce cryptographic representations of passwords when storing passwords in databases, configuration files, and log files. Passwords must be protected at all times; using a strong one-way hashing encryption algorithm with a salt is the standard method for providing a means to validate a password without having to store the actual password.

  Performance and time required to access are factors that must be considered, and the one way hash is the most feasible means of securing the password and providing an acceptable measure of password security. If passwords are stored in clear text, they can be plainly read and easily compromised.

  In many instances, verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the stored hash.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to encrypt all passwords.

  R4(config)#service password-encryption 
  R4(config)#end

check_text:
  Review the router configuration to determine if passwords are encrypted as shown in the example below.

  service password-encryption

  If the router is not configured to encrypt passwords, this is a finding.


vuln_id: V-215833
rule_id: SV-215833r961068_rule
severity: CAT I
cci: CCI-001133
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to terminate all network connections associated with device management after five minutes of inactivity.

description:
  <VulnDiscussion>Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. 

  Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, or de-allocating networking assignments at the application level if multiple application sessions are using a single, operating system-level network connection. This does not mean that the device terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the idle timeout value to five minutes or less on all configured login classes as shown in the example below.

  R1(config)#line vty 0 1
  R1(config-line)#exec-timeout 5 0
  R1(config-line)#exit
  R1(config)#line con 0
  R1(config-line)#exec-timeout 5 0
  R1(config-line)#exit
  R2(config)#ip http timeout-policy idle 300 life nnnn requests nn

check_text:
  Review the Cisco router configuration to verify that all network connections associated with a device management have an idle timeout value set to five minutes or less as shown in the following example:

  ip http secure-server
  ip http timeout-policy idle 300 life nnnn requests nn
  …
  …
  …
  line con 0
   exec-timeout 5 0
  line vty 0 1
   exec-timeout 5 0

  If the Cisco router is not configured to terminate all network connections associated with a device management after five minutes of inactivity, this is a finding.


vuln_id: V-215834
rule_id: SV-215834r961290_rule
severity: CAT II
title: The Cisco router must be configured to automatically audit account enabling actions.
cci: CCI-002130
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO). Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log account enabling using the following commands:

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the router configuration to determine if it automatically audits account enabling. The configuration should look similar to the example below:

  archive
   log config
   logging enable

  Note: Configuration changes can be viewed using the show archive log config all command.

  If account enabling is not automatically audited, this is a finding.


vuln_id: V-215836
rule_id: SV-215836r961392_rule
severity: CAT II
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

description:
  <VulnDiscussion>In order to ensure network devices have a sufficient storage capacity in which to write the audit logs, they need to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial device setup if it is modifiable. 

  The value for the organization-defined audit record storage requirement will depend on the amount of storage available on the network device, the anticipated volume of logs, the frequency of transfer from the network device to centralized log servers, and other factors.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the buffer size for logging as shown in the example below.

  R2(config)#logging buffered xxxxxxxx informational

check_text:
  Verify that the Cisco router is configured with a logging buffer size. The configuration should look like the example below:

  logging buffered xxxxxxxx informational

  If a logging buffer size is not configured, this is a finding.

  If the Cisco router is not configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements, this is a finding.


vuln_id: V-215837
rule_id: SV-215837r991886_rule
severity: CAT II
title: The Cisco router must be configured to generate an alert for all audit failure events.
cci: CCI-001858
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. 

  Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to send critical to emergency log messages to the syslog server as shown in the example below.

  R4(config)#logging trap critical

  Note: The parameter "critical" can replaced with a lesser severity level (i.e., error, warning, notice, informational).

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  logging trap critical

  Note: The parameter "critical" can replaced with a lesser severity level (i.e. error, warning, notice, informational). Informational is the default severity level; hence, if the severity level is configured to informational, the logging trap command will not be shown in the configuration.

  If the Cisco router is not configured to generate an alert for all audit failure events, this is a finding.


vuln_id: V-215838
rule_id: SV-215838r1015295_rule
severity: CAT II
cci: CCI-001889
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources.

description:
  <VulnDiscussion>The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. 

  Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes its time to a more accurate source. The network device must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891.

  DOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to synchronize its clock with redundant authoritative time sources as shown in the example below.

  R2(config)#ntp server x.x.x.x
  R2(config)#ntp server y.y.y.y

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the configuration example below.

  ntp server x.x.x.x
  ntp server y.y.y.y

  If the Cisco router is not configured to synchronize its clock with redundant authoritative time sources, this is a finding.


vuln_id: V-215841
rule_id: SV-215841r1107207_rule
severity: CAT II
cci: CCI-001967
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

description:
  <VulnDiscussion>Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.

  A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network, internet). A remote connection is any connection with a device communicating through an external network (e.g., the internet).

  Because of the challenges of applying this requirement on a large scale, organizations are encouraged to only apply the requirement to those limited number (and type) of devices that truly need to support this capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to authenticate SNMP messages as shown in the example below:

  R4(config)#snmp-server group V3GROUP v3 auth read V3READ write V3WRITE
  R4(config)#snmp-server user V3USER V3GROUP v3 auth sha xxxxxxx
  R4(config)#snmp-server host x.x.x.x version 3 auth V3USER

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  snmp-server group V3GROUP v3 auth read V3READ write V3WRITE 
  snmp-server host x.x.x.x version 3 auth V3USER

  Authentication used by the SNMP users can be viewed via the show snmp user command as shown in the example below:

  R4#show snmp user

  User name: V3USER
  Engine ID: 800000090300C2042B540000
  storage-type: nonvolatile active
  Authentication Protocol: SHA
  Privacy Protocol: None
  Group-name: V3GROUP

  If the Cisco router is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.


vuln_id: V-215842
rule_id: SV-215842r961506_rule
severity: CAT II
title: The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm.
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Without the strong encryption that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information that can be used to create a network outage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to encrypt SNMP messages using a FIPS 140-2 approved algorithm as shown in the example below.

  R4(config)#snmp-server group V3GROUP v3 priv read V3READ write V3WRITE
  R4(config)#snmp-server user V3USER V3GROUP v3 auth sha xxxxxx priv aes 256 xxxxxx

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  snmp-server group V3GROUP v3 priv read V3READ write V3WRITE
  snmp-server view V3READ iso included
  snmp-server view V3WRITE iso included
  snmp-server host x.x.x.x version 3 auth V3USER

  Encryption used by the SNMP users can be viewed via the show snmp user command as shown in the example below.

  R4#show snmp user

  User name: V3USER
  Engine ID: 800000090300C2042B540000
  storage-type: nonvolatile active
  Authentication Protocol: SHA
  Privacy Protocol: AES256
  Group-name: V3GROUP

  If the Cisco router is not configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm, this is a finding.


vuln_id: V-215843
rule_id: SV-215843r1050862_rule
severity: CAT II
cci: CCI-001967
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

description:
  <VulnDiscussion>If Network Time Protocol is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to authenticate NTP sources using authentication that is cryptographically based as shown in the example below.

  R2(config)#ntp authenticate
  R2(config)#ntp authentication-key 1 hmac-sha2-256 xxxxxxx
  R2(config)#ntp trusted-key 1
  R2(config)#ntp server x.x.x.x key 1
  R2(config)#ntp server y.y.y.y key 1

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the configuration example below.

  ntp authentication-key 1 hmac-sha2-256 xxxxxx
  ntp authenticate
  ntp trusted-key 1
  ntp server x.x.x.x key 1
  ntp server y.y.y.y key 1

  If the Cisco router is not configured to authenticate NTP sources using authentication that is cryptographically based, this is a finding.


vuln_id: V-215844
rule_id: SV-215844r961554_rule
severity: CAT I
cci: CCI-002890
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.

description:
  <VulnDiscussion>Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.

  Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. 

  Currently, HMAC is the only FIPS-approved algorithm for generating and verifying message/data authentication codes in accordance with FIPS 198-1. Products that are FIPS 140-2 validated will have an HMAC that meets specification; however, the option must be configured for use as the only message authentication code used for authentication to cryptographic modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure SSH to use FIPS-validated HMAC for remote maintenance sessions as shown in the following example:

  SSH Example

  R1(config)#ip ssh version 2
  R1(config)#ip ssh server algorithm mac hmac-sha2-256

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  NOTE: Although allowed by SP800-131Ar2 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and Government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions.

  SSH Example

  ip ssh version 2
  ip ssh server algorithm mac hmac-sha2-256

  If the Cisco router is not configured to use FIPS-validated HMAC to protect the integrity of remote maintenance sessions, this is a finding.


vuln_id: V-215845
rule_id: SV-215845r961557_rule
severity: CAT I
cci: CCI-003123
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions.

description:
  <VulnDiscussion>This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm as shown in the examples below.

  SSH Example

  R1(config)#ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement.

  SSH Example

  ip ssh version 2
  ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr

  If the router is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.


vuln_id: V-215848
rule_id: SV-215848r961812_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to generate log records when administrator privileges are deleted.

description:
  <VulnDiscussion>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

  Audit records can be generated from various components within the network device (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to generate log records when administrator privileges are deleted as shown in the example below.

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below.

  archive
   log config
   logging enable

  If the Cisco router is not configured to generate log records when administrator privileges are deleted, this is a finding.


vuln_id: V-215849
rule_id: SV-215849r961824_rule
severity: CAT II
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to generate audit records when successful/unsuccessful logon attempts occur.

description:
  <VulnDiscussion>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

  Audit records can be generated from various components within the network device (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to generate audit records when successful/unsuccessful logon attempts occur as shown in the example below.

  R5(config)#login on-failure log
  R5(config)#login on-success log

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the examples below.

  login on-failure log
  login on-success log

  If the Cisco router is not configured to generate audit records when successful/unsuccessful logon attempts occur, this is a finding.


vuln_id: V-215850
rule_id: SV-215850r961827_rule
severity: CAT II
title: The Cisco router must be configured to generate log records for privileged activities.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

  Audit records can be generated from various components within the network device (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to generate log records for privileged activities as shown in the example below.

  R4(config)#archive
  R4(config-archive)#log config
  R4(config-archive-log-cfg)#logging enable
  R4(config-archive-log-cfg)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example configurations below.

  archive
   log config
   logging enable

  If the Cisco router is not configured to generate log records for privileged activities, this is a finding.


vuln_id: V-215854
rule_id: SV-215854r961863_rule
severity: CAT I
cci: CCI-000370
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to use at least two  authentication servers for the purpose of authenticating users prior to granting administrative access.

description:
  <VulnDiscussion>Centralized management of user accounts and authentication increases the administrative access to the router. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each network device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Configure the Cisco router to use at least two authentication servers as shown in the following example:

  R4(config)#radius host 10.1.48.2 key xxxxxx
  R4(config)#radius host 10.1.48.3 key xxxxxx

  Step 2: Configure the authentication order to use the authentication servers as primary source for authentication as shown in the following example:

  R4(config)#aaa authentication CONSOLE local

  R4(config)#aaa authentication login
  LOGIN_AUTHENTICATION group radius local

  Step 3: Configure all network connections associated with a device management to use the authentication servers for the purpose of login authentication.

  R4(config)#line vty 0 1
  R4(config-line)#login authentication LOGIN_AUTHENTICATION
  R4(config-line)#exit
  R4(config)#line con 0
  R4(config-line)#login authentication CONSOLE
  R4(config-line)#exit 
  R4(config)#ip http authentication aaa login-authentication LOGIN_AUTHENTICATION

check_text:
  Review the Cisco router configuration to verify that the device is configured to use at least two authentication servers as primary source for authentication as shown in the following example:

  aaa new-model
  !
  aaa authentication CONSOLE local
  aaa authentication login LOGIN_AUTHENTICATION group radius local
  …
  …
  …
  ip http authentication aaa login-authentication LOGIN_AUTHENTICATION
  ip http secure-server
  …
  …
  …
  radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxxxxxx
  radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxxxxxx
  …
  …
  …
  line con 0
   exec-timeout 5 0
   login authentication CONSOLE
  line vty 0 1
   exec-timeout 5 0
   login authentication LOGIN_AUTHENTICATION

  If the Cisco router is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.


vuln_id: V-215855
rule_id: SV-215855r1069501_rule
severity: CAT II
title: The Cisco router must be configured to back up the configuration when changes occur.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>System-level information includes default and customized settings and security attributes, including ACLs that relate to the network device configuration, as well as software required for the execution and operation of the device. Information system backup is a critical step in ensuring system integrity and availability. If the system fails and there is no backup of the system-level information, a denial-of-service condition is possible for all who utilize this critical network component.

  This control requires the network device to support the organizational central backup process for system-level information associated with the network device. This function may be provided by the network device itself; however, the preferred best practice is a centralized backup rather than each network device performing discrete backups.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to send the configuration to a SCP server when a configuration change occurs as shown in the example below.

  R4(config)#event manager applet BACKUP_CONFIG
  R4(config-applet)#event syslog pattern "%SYS-5-CONFIG_I"
  R4(config-applet)#action 1 cli command "enable"
  R4(config-applet)#action 2 info type routername
  R4(config-applet)#action 3 cli command "copy run scp" pattern "remote host"
  R4(config-applet)#action 4 cli command "x.x.x.x" pattern "filename"
  R4(config-applet)#action 5 cli command "$_info_routername-config"
  R4(config-applet)#action 6 syslog priority informational msg "Configuration backup was executed"
  R4(config-applet)#end

check_text:
  Review the Cisco router configuration to verify that it is compliant with this requirement. The example configuration below will send the configuration to a SCP server when a configuration change occurs.

  event manager applet BACKUP_CONFIG
   event syslog pattern "%SYS-5-CONFIG_I"
   action 1 info type routername
   action 2 cli command "enable"
   action 3 cli command "copy run scp" pattern "remote host"
   action 4 cli command "x.x.x.x" pattern "filename"
   action 5 cli command "$_info_routername-config"
   action 6 syslog priority informational msg "Configuration backup was executed"

  If the Cisco router is not configured to conduct backups of the configuration when changes occur, this is a finding.


vuln_id: V-215856
rule_id: SV-215856r991889_rule
severity: CAT II
cci: CCI-001159
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider.

description:
  <VulnDiscussion>For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority (CA) at medium assurance or higher, this CA will suffice.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to obtain its public key certificates from an appropriate certificate policy through an approved service provider as shown in the example below.

  R2(config)# crypto pki trustpoint CA_X
  R2(ca-trustpoint)#enrollment url http://trustpoint1.example.com

check_text:
  Review the router configuration to determine if a CA trust point has been configured. The CA trust point will contain the URL of the CA in which the router has enrolled with. Verify this is a DOD or DOD-approved CA. This will ensure the router has enrolled and received a certificate from a trusted CA. The CA trust point configuration would look similar to the example below.

  crypto pki trustpoint CA_X
   enrollment url http://trustpoint1.example.com

  Note: A remote end-point's certificate will always be validated by the router by verifying the signature of the CA on the certificate using the CA's public key, which is contained in the router's certificate it received at enrollment.

  Note: This requirement is not applicable if the router does not have any public key certificates.

  If the Cisco router is not configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider, this is a finding.


vuln_id: V-220139
rule_id: SV-220139r961863_rule
severity: CAT I
cci: CCI-001851
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to send log data to at least two syslog servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).

description:
  <VulnDiscussion>The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, are important in showing whether someone is an internal employee or an outside threat.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to send log messages to the syslog servers as shown in the example below.

  R4(config)#logging host x.x.x.x
  R4(config)#logging host x.x.x.x

check_text:
  Verify that the router is configured to send logs to at least two syslog servers. The configuration should look similar to the example below:

  logging x.x.x.x
  logging x.x.x.x

  If the router is not configured to send log data to the syslog servers, this is a finding.


vuln_id: V-220140
rule_id: SV-220140r961863_rule
severity: CAT I
title: The Cisco router must be running an IOS release that is currently supported by Cisco Systems.
fix_text: Upgrade the router to a supported release.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities. Running a supported release also enables operations to maintain a stable and reliable network provided by improved quality of service and security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Verify that the router is in compliance with this requirement by having the router administrator enter the following command: 

  show version

  Verify that the release is still supported by Cisco. All releases supported by Cisco can be found on the following URL:

  www.cisco.com/c/en/us/support/ios-nx-os-software

  If the router is not running a supported release, this is a finding.


vuln_id: V-216641
rule_id: SV-216641r1007826_rule
severity: CAT II
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

description:
  <VulnDiscussion>Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Information flow control policies and enforcement mechanisms are commonly employed by organizations to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems.

  Enforcement occurs, for example, in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, and firewalls) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure ACLs to allow or deny traffic for specific source and destination addresses as well as ports and protocols between various subnets as required. The commands used below were used to create the configuration as shown in the check content.

  R5(config)#ip access-list extended FILTER_SERVER_TRAFFIC
  R5(config-ext-nacl)#permit tcp any x101.23.0 0.0.0.255 eq 515 631 9100
  R5(config-ext-nacl)#permit tcp any 10.1.24.0 0.0.0.255 eq 1433 1434 4022
  R5(config-ext-nacl)#permit icmp any any
  R5(config-ext-nacl)#permit ospf any any
  R5(config-ext-nacl)#deny ip any any
  R5(config-ext-nacl)#exit
  R5(config)#interface GigabitEthernet1/1
  R5(config-if)#ip access-group FILTER_SERVER_TRAFFIC in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  If Virtual Routing and Forwarding (VRF) is used to segment traffic and force traffic to traverse through next generation firewalls with ACLs, this requirement is not applicable.

  Review the router configuration to verify that Access Control Lists (ACLs) are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols. For example, the configuration below will allow only printer traffic into subnet 10.1.23.0/24 and SQL traffic into subnet 10.1.24.0/24. ICMP is allowed for troubleshooting and OSPF is the routing protocol used within the network.

  interface GigabitEthernet1/1
   description link to core
   ip address 10.1.12.2 255.255.255.0
   ip access-group FILTER_SERVER_TRAFFIC in
  …
  …
  …
  ip access-list extended FILTER_SERVER_TRAFFIC
   permit tcp any 10.1.23.0 0.0.0.255 eq lpd 631 9100
   permit tcp any 10.1.24.0 0.0.0.255 eq 1433 1434 4022
   permit icmp any any
   permit ospf any any
   deny   ip any any

  If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.


vuln_id: V-216645
rule_id: SV-216645r1007829_rule
severity: CAT II
cci: CCI-000803
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to enable routing protocol authentication using FIPS 198-1 algorithms with keys not exceeding 180 days of lifetime.

description:
  <VulnDiscussion>A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network or used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication using FIPS 198-1 algorithms for routing updates.
  If the keys used for authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Some routing protocols allow the use of key chains for authentication. A key chain is a set of keys that is used in succession, with each having a lifetime of no more than 180 days. Changing the keys frequently reduces the risk of them eventually being guessed. If a time period occurs during which no key is activated, neighbor authentication cannot occur, and therefore routing updates will fail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure routing protocol authentication to use a NIST-validated FIPS 198-1 message authentication code algorithm with keys not exceeding 180 days of lifetime as shown in the examples.

  BGP Example:

  Step 1: Configure a keychain using a FIPS 198-1 algorithm with a key duration not exceeding 180 days.

  key chain <KEY-CHAIN-NAME> tcp 
  key <KEY-ID>
  send-id <ID>
  recv-id <ID>
  cryptographic-algorithm hmac-sha256
  key-string <KEY>
  accept-lifetime 00:00:00 Jan 1 2022 duration 180
  send-lifetime 00:00:00 Jan 1 2022 duration 180 
  !

  Step 2: Configure BGP autonomous system to use the keychain for authentication.

  router bgp <ASN>
  no synchronization
  bgp log-neighbor-changes
  neighbor x.x.x.x remote-as <ASN>
  neighbor x.x.x.x ao <KEY-CHAIN-NAME>

  OSPF Example:

  Step 1: Configure a keychain using a FIPS 198-1 algorithm with a key duration not exceeding 180 days.

  key chain OSPF_KEY_CHAIN
  key 1
  key-string xxxxxxx
  send-lifetime 00:00:00 Jan 1 2018 23:59:59 Mar 31 2018
  accept-lifetime 00:00:00 Jan 1 2018 01:05:00 Apr 1 2018
  cryptographic-algorithm hmac-sha-256
  key 2
  key-string yyyyyyy
  send-lifetime 00:00:00 Apr 1 2018 23:59:59 Jun 30 2018
  accept-lifetime 23:55:00 Mar 31 2018 01:05:00 Jul 1 2018
  cryptographic-algorithm hmac-sha-256

  Step 2: Configure OSPF to use the keychain for authentication.

  interface GigabitEthernet0/1
  ip address x.x.x.x 255.255.255.0
  ip ospf authentication key-chain OSPF_KEY_CHAIN

check_text:
  Review the router configuration using the configuration examples below for BGP and OSPF.

  Certain older protocols supporting only MD5 will incur a permanent finding for those protocols as MD5 is not FIPS compliant.

  Note: The 180-day key lifetime is Not Applicable for the DODIN Backbone. The remainder of the requirement still applies.

  Verify that neighbor router authentication is enabled for all routing protocols. If neighbor authentication is not enabled, this is a finding.

  Verify that authentication is configured to use FIPS 198-1 message authentication algorithms. If the routing protocol authentication is not configured to use FIPS 198-1 algorithms this is a finding.

  Verify that the protocol key lifetime is configured to not exceed 180 days. If any protocol key lifetime is configured to exceed 180 days this is a finding.

  BGP Example:

  key chain <KEY-CHAIN-NAME> tcp 
  key <KEY-ID>
  send-id <ID>
  recv-id <ID>
  cryptographic-algorithm hmac-sha256
  key-string <KEY>
  accept-lifetime 00:00:00 Jan 1 2022 duration 180
  send-lifetime 00:00:00 Jan 1 2022 duration 180 
  !
  !
  router bgp <ASN>
  no synchronization
  bgp log-neighbor-changes
  neighbor x.x.x.x remote-as <ASN>
  neighbor x.x.x.x ao <KEY-CHAIN-NAME>

  Note: TCP-AO is used to replace MD5 in BGP authentication. 

  OSPF Example:

  key chain OSPF_KEY_CHAIN
  key 1
  key-string xxxxxxx
  send-lifetime 00:00:00 Jan 1 2018 23:59:59 Mar 31 2018
  accept-lifetime 00:00:00 Jan 1 2018 01:05:00 Apr 1 2018
  cryptographic-algorithm hmac-sha-256
  key 2
  key-string yyyyyyy
  send-lifetime 00:00:00 Apr 1 2018 23:59:59 Jun 30 2018
  accept-lifetime 23:55:00 Mar 31 2018 01:05:00 Jul 1 2018
  cryptographic-algorithm hmac-sha-256
  …
  …
  …
  interface GigabitEthernet0/1
  ip address x.x.x.x 255.255.255.0
  ip ospf authentication key-chain OSPF_KEY_CHAIN


vuln_id: V-216646
rule_id: SV-216646r531086_rule
severity: CAT III
title: The Cisco router must be configured to have all inactive interfaces disabled.
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use.

  If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, it must be deleted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable all inactive interfaces as shown below:

  R4(config)#interface GigabitEthernet3
  R4(config-if)#shutdown
  R4(config)#interface GigabitEthernet4
  R4(config-if)#shutdown

check_text:
  Review the router configuration and verify that inactive interfaces have been disabled as shown below:

  interface GigabitEthernet3
   shutdown
  !
  interface GigabitEthernet4
   shutdown
   
  If an interface is not being used but is configured or enabled, this is a finding.


vuln_id: V-216649
rule_id: SV-216649r855812_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

description:
  <VulnDiscussion>Network devices that are configured via a zero-touch deployment or auto-loading feature can have their startup configuration or image pushed to the device for installation via TFTP or Remote Copy (rcp). Loading an image or configuration file from the network is taking a security risk because the file could be intercepted by an attacker who could corrupt the file, resulting in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable configuration auto-loading if enabled using the following commands:

  R8(config)#no boot network
  R8(config)#no service config

  Disable CNS zero-touch deployment if enabled as shown in the example below:

  R2(config)#no cns config initial
  R2(config)#no cns exec
  R2(config)#no cns image
  R2(config)#no cns trusted-server config x.x.x.x
  R2(config)#no cns trusted-server image x.x.x.x

check_text:
  Review the device configuration to determine if auto-configuration or zero-touch deployment via Cisco Networking Services (CNS) is enabled. 

  Auto-configuration example:

  version 15.0
  service config
  …
  …
  …
  boot-start-marker
  boot network tftp://x.x.x.x/R5-config
  boot-end-marker

  CNS Zero-Touch Example:

  cns trusted-server config x.x.x.x
  cns trusted-server image x.x.x.x
  cns config initial x.x.x.x 80
  cns exec 80
  cns image

  If a configuration auto-loading feature or zero-touch deployment feature is enabled, this is a finding. 

  Note: Auto-configuration or zero-touch deployment features can be enabled when the router is offline for the purpose of image loading or building out the configuration. In addition, this would not be applicable to the provisioning of virtual routers via a software-defined network (SDN) orchestration system.


vuln_id: V-216650
rule_id: SV-216650r1107209_rule
severity: CAT I
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

description:
  <VulnDiscussion>The Route Processor (RP) is critical to all network operations because it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Any disruption to the RP or the control and management planes can result in mission-critical network outages.

  A DoS attack targeting the RP can result in excessive CPU and memory utilization. To maintain network stability and RP security, the router must be able to handle specific control plane and management plane traffic that is destined to the RP. In the past, one method of filtering was to use ingress filters on forwarding interfaces to filter both forwarding path and receiving path traffic, as well as limiting traffic destined to the device. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grows. Control plane policing increases the security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks, allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the Cisco router to protect against known types of DoS attacks on the route processor. Implementing a CoPP policy as shown in the example below is a best practice method: 

  Step 1: Configure ACL specific traffic types. 

  SW1(config)#ip access-list extended CoPP_CRITICAL 
  SW1(config-ext-nacl)#remark our control plane adjacencies are critical 
  SW1(config-ext-nacl)#permit ospf host x.x.x.x any 
  SW1(config-ext-nacl)#permit ospf host x.x.x.x any 
  SW1(config-ext-nacl)#permit pim host x.x.x.x any 
  SW1(config-ext-nacl)#permit pim host x.x.x.x any 
  SW1(config-ext-nacl)#permit igmp any 224.0.0.0 15.255.255.255 
  SW1(config-ext-nacl)#deny ip any any 
  SW1(config-ext-nacl)#exit 

  SW1(config)#ip access-list extended CoPP_IMPORTANT 
  SW1(config-ext-nacl)#permit tcp host x.x.x.x eq tacacs any 
  SW1(config-ext-nacl)#permit tcp x.x.x.x 0.0.0.255 any eq 22 
  SW1(config-ext-nacl)#permit udp host x.x.x.x any eq snmp 
  SW1(config-ext-nacl)#permit udp host x.x.x.x eq ntp any 
  SW1(config-ext-nacl)#deny ip any any 
  SW1(config-ext-nacl)#exit 

  SW1(config)#ip access-list extended CoPP_NORMAL 
  SW1(config-ext-nacl)#remark we will want to rate limit ICMP traffic 
  SW1(config-ext-nacl)#deny icmp any host x.x.x.x fragments
   SW1(config-ext-nacl)#permit icmp any any echo 
  SW1(config-ext-nacl)#permit icmp any any echo-reply 
  SW1(config-ext-nacl)#permit icmp any any time-exceeded 
  SW1(config-ext-nacl)#permit icmp any any unreachable 
  SW1(config-ext-nacl)#deny ip any any 
  SW1(config-ext-nacl)#exit 

  SW1(config)#ip access-list extended CoPP_UNDESIRABLE 
  SW1(config-ext-nacl)#remark management plane traffic that should not be received 
  SW1(config-ext-nacl)#permit udp any any eq ntp 
  SW1(config-ext-nacl)#permit udp any any eq snmp 
  SW1(config-ext-nacl)#permit tcp any any eq 22 
  SW1(config-ext-nacl)#permit tcp any any eq 23 
  SW1(config-ext-nacl)#remark control plane traffic not configured on switch 
  SW1(config-ext-nacl)#permit eigrp any any 
  SW1(config-ext-nacl)#permit udp any any eq rip 
  SW1(config-ext-nacl)#deny ip any any 
  SW1(config-ext-nacl)#exit 
  SW1(config)#ip access-list extended CoPP_DEFAULT 
  SW1(config-ext-nacl)#permit ip any any 
  SW1(config-ext-nacl)#exit 

  Step 2: Configure class-maps referencing each of the ACLs. 

  SW1(config)#class-map match-all CoPP_CRITICAL 
  SW1(config-cmap)#match access-group name CoPP_CRITICAL 
  SW1(config-cmap)#class-map match-any CoPP_IMPORTANT 
  SW1(config-cmap)#match access-group name CoPP_IMPORTANT 
  SW1(config-cmap)#match protocol arp 
  SW1(config-cmap)#class-map match-all CoPP_NORMAL 
  SW1(config-cmap)#match access-group name CoPP_NORMAL 
  SW1(config-cmap)#class-map match-any CoPP_UNDESIRABLE 
  SW1(config-cmap)#match access-group name CoPP_UNDESIRABLE 
  SW1(config-cmap)#class-map match-all CoPP_DEFAULT 
  SW1(config-cmap)#match access-group name CoPP_DEFAULT 
  SW1(config-cmap)#exit 

  Step 3: Configure a policy-map referencing the configured class-maps and apply appropriate bandwidth allowance and policing attributes. 

  SW1(config)#policy-map CONTROL_PLANE_POLICY 
  SW1(config-pmap)#class CoPP_CRITICAL 
  SW1(config-pmap-c)#police 512000 8000 conform-action transmit exceed-action transmit 
  SW1(config-pmap-c-police)#class CoPP_IMPORTANT 
  SW1(config-pmap-c)#police 256000 4000 conform-action transmit exceed-action drop 
  SW1(config-pmap-c-police)#class CoPP_NORMAL 
  SW1(config-pmap-c)#police 128000 2000 conform-action transmit exceed-action drop 
  SW1(config-pmap-c-police)#class CoPP_UNDESIRABLE 
  SW1(config-pmap-c)#police 8000 1000 conform-action drop exceed-action drop 
  SW1(config-pmap-c-police)#class CoPP_DEFAULT 
  SW1(config-pmap-c)#police 64000 1000 conform-action transmit exceed-action drop 
  SW1(config-pmap-c-police)#exit 
  SW1(config-pmap-c)#exit 
  SW1(config-pmap)#exit 

  Step 4: Apply the policy-map to the control plane. 

  SW1(config)#control-plane 
  SW1(config-cp)#service-policy input CONTROL_PLANE_POLICY 
  SW1(config-cp)#end

check_text:
  Review the Cisco router configuration to verify it protects against known types of DoS attacks by employing organization-defined security safeguards. 

  Step 1: Verify traffic types have been classified based on importance levels. The following is an example configuration: 

  class-map match-all CoPP_CRITICAL 
  match access-group name CoPP_CRITICAL 
  class-map match-any CoPP_IMPORTANT 
  match access-group name CoPP_IMPORTANT 
  match protocol arp 
  class-map match-all CoPP_NORMAL 
  match access-group name CoPP_NORMAL 
  class-map match-any CoPP_UNDESIRABLE 
  match access-group name CoPP_UNDESIRABLE 
  class-map match-all CoPP_DEFAULT 
  match access-group name CoPP_DEFAULT 

  Step 2: Review the access control lists (ACLs) referenced by the class maps to determine if the traffic is being classified appropriately. The following is an example configuration: 

  ip access-list extended CoPP_CRITICAL 
  remark our control plane adjacencies are critical 
  permit ospf host [OSPF neighbor A] any 
  permit ospf host [OSPF neighbor B] any 
  permit pim host [PIM neighbor A] any 
  permit pim host [PIM neighbor B] any 
  permit pim host [RP addr] any 
  permit igmp any 224.0.0.0 15.255.255.255 
  deny ip any any 

  ip access-list extended CoPP_IMPORTANT 
  permit tcp host [TACACS server] eq tacacs any 
  permit tcp [management subnet] 0.0.0.255 any eq 22 
  permit udp host [SNMP manager] any eq snmp 
  permit udp host [NTP server] eq ntp any 
  deny ip any any 

  ip access-list extended CoPP_NORMAL 
  remark we will want to rate limit ICMP traffic 
  deny icmp any host x.x.x.x fragments
  permit icmp any any echo 
  permit icmp any any echo-reply 
  permit icmp any any time-exceeded 
  permit icmp any any unreachable 
  deny ip any any 

  ip access-list extended CoPP_UNDESIRABLE 
  remark other management plane traffic that should not be received 
  permit udp any any eq ntp 
  permit udp any any eq snmp 
  permit tcp any any eq 22 
  permit tcp any any eq 23 
  remark other control plane traffic not configured on switch 
  permit eigrp any any 
  permit udp any any eq rip 
  deny ip any any 

  ip access-list extended CoPP_DEFAULT 
  permit ip any any 

  Note: Explicitly defining undesirable traffic with ACL entries enables the network operator to collect statistics. Excessive ARP packets can potentially monopolize Route Processor resources, starving other important processes. Currently, ARP is the only layer 2 protocol that can be specifically classified using the match protocol command. 

  Step 3: Review the policy-map to determine if the traffic is being policed appropriately for each classification. The following is an example configuration: 

  policy-map CONTROL_PLANE_POLICY 
  class CoPP_CRITICAL 
  police 512000 8000 conform-action transmit exceed-action transmit 
  class CoPP_IMPORTANT 
  police 256000 4000 conform-action transmit exceed-action drop 
  class CoPP_NORMAL 
  police 128000 2000 conform-action transmit exceed-action drop 
  class CoPP_UNDESIRABLE 
  police 8000 1000 conform-action drop exceed-action drop 
  class CoPP_DEFAULT 
  police 64000 1000 conform-action transmit exceed-action drop 

  Step 4: Verify the Control Plane Policing (CoPP) policy is enabled. The following is an example configuration: 

  control-plane 
  service-policy input CONTROL_PLANE_POLICY 

  Note: Control Plane Protection (CPPr) can be used to filter as well as police control plane traffic destined to the RP. CPPr is very similar to CoPP and can filter and police traffic using finer granularity by dividing the aggregate control plane into three separate categories: 1) host, 2) transit, and 3) CEF-exception. Hence, a separate policy-map could be configured for each traffic category. 

  If the Cisco router is not configured to protect against known types of DoS attacks by employing organization-defined security safeguards, this is a finding.


vuln_id: V-216653
rule_id: SV-216653r855814_rule
severity: CAT II
title: The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.
fix_text:
  Disable gratuitous ARP as shown in the example below:

  R5(config)#no ip gratuitous-arps

cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can cause network mapping information to be stored incorrectly, causing network malfunction.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the configuration to determine if gratuitous ARP is disabled. The following command should not be found in the router configuration:

  ip gratuitous-arps

  Note: With Cisco IOS, Gratuitous ARP is enabled and disabled globally.

  If gratuitous ARP is enabled on any external interface, this is a finding.


vuln_id: V-216654
rule_id: SV-216654r855815_rule
severity: CAT III
title: The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>An IP directed broadcast is a datagram sent to the broadcast address of a subnet that is not directly attached to the sending machine. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. Because of the nature of the IP addressing architecture, only the last router in the chain, which is connected directly to the target subnet, can conclusively identify a directed broadcast.

  IP directed broadcasts are used in the extremely common and popular smurf, or denial of service (DoS), attacks. In a smurf attack, the attacker sends Internet Control Message Protocol (ICMP) echo requests from a falsified source address to a directed broadcast address, causing all the hosts on the target subnet to send replies to the falsified source. By sending a continuous stream of such requests, the attacker can create a much larger stream of replies, which can completely inundate the host whose address is being falsified. This service should be disabled on all interfaces when not needed to prevent smurf and DoS attacks.

  Directed broadcast can be enabled on internal facing interfaces to support services such as Wake-On-LAN. Case scenario may also include support for legacy applications where the content server and the clients do not support multicast. The content servers send streaming data using UDP broadcast. Used in conjunction with the IP multicast helper-map feature, broadcast data can be sent across a multicast topology. The broadcast streams are converted to multicast and vice versa at the first-hop routers and last-hop routers before entering and leaving the multicast transit area respectively. The last-hop router must convert the multicast to broadcast. Hence, this interface must be configured to forward a broadcast packet (i.e., a directed broadcast address is converted to the all nodes broadcast address).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable IP directed broadcast on all interfaces as shown in the example below:

  R4(config)#int g0/1
  R4(config-if)#no ip directed-broadcast

check_text:
  Review the router configuration to determine if it is compliant with this requirement. IP directed broadcast command must not be found on any interface as shown in the example below:

  interface GigabitEthernet0/1
   ip address x.x.x.x 255.255.255.0
   ip directed-broadcast

  If IP directed broadcast is not disabled on all interfaces, this is a finding.


vuln_id: V-216655
rule_id: SV-216655r855816_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

description:
  <VulnDiscussion>The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Step 1: Disable ip unreachables on all external interfaces.

  R4(config)#int g0/1
  R4(config-if)#no ip unreachables

  Step 2: Disable ip unreachables on the Null0 interface if it is used to backhole packets.

  R4(config-if)#int null 0
  R4(config-if)#no ip unreachables

  Alternative – DODIN Backbone:

  Configure the PE router to rate limit ICMP unreachable messages as shown in the example below:

  R4(config)#ip icmp rate-limit unreachable df 100
  R4(config)#ip icmp rate-limit unreachable 100000
  R4(config)#end

  Alternative – Non DODIN Backbone. 

  An alternative for non-backbone networks (i.e. enclave, base, camp, etc.) is to filter messages generated by the router and silently drop ICMP Administratively Prohibited and Host Unreachable messages using the following configuration steps:  

  Step 1: Configure ACL to include ICMP Type 3 Code 1 (Host Unreachable) and Code 13 (Administratively Prohibited) as shown in the example below:

  R2(config)#ip access-list ext ICMP_T3C1C13
  R2(config-ext-nacl)#permit icmp any any host-unreachable
  R2(config-ext-nacl)#permit icmp any any administratively-prohibited
  R2(config-ext-nacl)#exit

  Step 2: Create a route map to forward these ICMP messages to the Null0 interface.
   
  R2(config)#route-map LOCAL_POLICY
  R2(config-route-map)#match ip address ICMP_T3C1C13
  R2(config-route-map)#set interface Null0
  R2(config-route-map)#exit

  Step 3: Configure no ip unreachables on the Null0 interface.

  R2(config)#int null 0
  R2(config-if)#no ip unreachables
  R2(config-if)#exit

  Step 4: Apply the policy to filter messages generated by the router.

  R2(config)#ip local policy route-map LOCAL_POLICY
  R2(config)#end

check_text:
  Review the configuration to verify the no ip unreachables command has been configured on all external interfaces as shown in the configuration example below:

  interface GigabitEthernet0/1
   ip address x.x.x.x 255.255.255.0
   no ip unreachables

  If ICMP unreachable notifications are sent from any external or null0 interface, this is a finding.

  Alternative – DODIN Backbone:

  Verify that the PE router is configured to rate limit ICMP unreachable messages as shown in the example below:

  ip icmp rate-limit unreachable 60000
  ip icmp rate-limit unreachable DF 1000

  Note: In the example above, packet-too-big message (ICMP Type 3 Code 4) can be sent once every second, while all other destination unreachable messages can be sent once every minute. This will avoid disrupting Path MTU Discovery for traffic traversing the backbone while mitigating the risk of an ICMP unreachable DoS attack.

  IF the PE router is not configured to rate limit ICMP unreachable messages, this is a finding.


vuln_id: V-216656
rule_id: SV-216656r855817_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

description:
  <VulnDiscussion>The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Mask Reply ICMP messages are commonly used by attackers for network mapping and diagnosis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable ip mask-reply on all external interfaces as shown below:

  R4(config)#int g0/1
  R4(config-if)#no ip mask-reply

check_text:
  Review the router configuration and verify that ip mask-reply command is not enabled on any external interfaces as shown in the example below: 

  interface GigabitEthernet0/1
   ip address x.x.x.x 255.255.255.0
   ip mask-reply

  If the ip mask-reply command is configured on any external interface, this is a finding.


vuln_id: V-216657
rule_id: SV-216657r855818_rule
severity: CAT II
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

description:
  <VulnDiscussion>The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable ICMP redirects on all external interfaces as shown in the example below:

  R4(config)#int g0/1
  R4(config-if)#no ip redirects

check_text:
  Review the router configuration to verify that the no ip redirects command has been configured on all external interfaces as shown in the example below:

  interface GigabitEthernet0/1
   ip address x.x.x.x 255.255.255.0
   no ip redirects

  If ICMP Redirect messages are enabled on any external interfaces, this is a finding.


vuln_id: V-216658
rule_id: SV-216658r531086_rule
severity: CAT III
cci: CCI-000134
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.

description:
  <VulnDiscussion>Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done or attempted to be done, and by whom, to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack or identify a configuration mistake on the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure ACLs to log  packets that are dropped as shown in the example below:

  R5(config)#ip access-list extended INGRESS_FILTER
  …
  …
  …
  R5(config-ext-nacl)#deny ip any any log

check_text:
  Review all ACLs used to filter traffic and verify that packets being dropped are logged as shown in the configuration below:

  ip access-list extended INGRESS_FILTER
   permit tcp any any established
   permit tcp host x.11.1.1 eq bgp host x.11.1.2
   permit tcp host x.11.1.1 host x.11.1.2 eq bgp
   permit tcp any host x.11.1.5 eq www
   permit icmp host x.11.1.1 host x.11.1.2 echo
   permit icmp any any echo-reply
   …
   …
   …
  deny   ip any any log

  If packets being dropped at interfaces are not logged, this is a finding.


vuln_id: V-216659
rule_id: SV-216659r531086_rule
severity: CAT II
cci: CCI-000132
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to produce audit records containing information to establish where the events occurred.

description:
  <VulnDiscussion>Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.

  In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as router components, modules, device identifiers, node names, and functionality.

  Associating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log events containing information to establish where the events occurred as shown in the example below:
   
  R5(config)#ip access-list extended INGRESS_FILTER
  …
  …
  …
  R5(config-ext-nacl)#deny ip any any log-input

check_text:
  Review the router configuration to verify that events are logged containing information to establish where the events occurred as shown in the example below:

  ip access-list extended INGRESS_FILTER
   permit tcp any any established
   permit tcp host x.11.1.1 eq bgp host x.11.1.2
   permit tcp host x.11.1.1 host x.11.1.2 eq bgp
   permit tcp any host x.11.1.5 eq www
   permit icmp host x.11.1.1 host x.11.1.2 echo
   permit icmp any any echo-reply
   …
   …
   …
  deny   ip any any log-input

  Note: When the log-input parameter is configured on deny statements, the log record will contain the interface where ingress packet has been dropped.

  If the router is not configured to produce audit records containing information to establish to establish where the events occurred, this is a finding.


vuln_id: V-216660
rule_id: SV-216660r531086_rule
severity: CAT II
cci: CCI-000133
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to produce audit records containing information to establish the source of the events.

description:
  <VulnDiscussion>Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.

  In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.

  In addition to logging where events occur within the network, the audit records must also identify sources of events such as IP addresses, processes, and node or device names.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the router to log events containing information to establish where the events occurred as shown in the example below:
   
  R5(config)#ip access-list extended INGRESS_FILTER
  …
  …
  …
  R5(config-ext-nacl)#deny ip any any log-input

check_text:
  Review the router configuration to verify that events are logged containing information to establish the source of the events as shown in the example below:

  ip access-list extended INGRESS_FILTER
   permit tcp any any established
   permit tcp host x.11.1.1 eq bgp host x.11.1.2
   permit tcp host x.11.1.1 host x.11.1.2 eq bgp
   permit tcp any host x.11.1.5 eq www
   permit icmp host x.11.1.1 host x.11.1.2 echo
   permit icmp any any echo-reply
   …
   …
   …
  deny   ip any any log-input

  Note: When the log-input parameter is configured on deny statements, the log record will contain the layer 2 address of the forwarding device for any packet being dropped.

  If the router is not configured to produce audit records containing information to establish the source of the events, this is a finding.


vuln_id: V-216661
rule_id: SV-216661r531086_rule
severity: CAT III
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

description:
  <VulnDiscussion>The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.

  Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port; thus, the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable the auxiliary port.

  R2(config)#line aux 0
  R2(config-line)#no exec 
  R2(config-line)#transport input none

check_text:
  Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.

  line aux 0
   no exec

  Note: transport input none is the default; hence it will not be shown in the configuration.

  If the auxiliary port is not disabled or is not connected to a secured modem when it is enabled, this is a finding.


vuln_id: V-216662
rule_id: SV-216662r531086_rule
severity: CAT I
cci: CCI-001109
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

description:
  <VulnDiscussion>A deny-all, permit-by-exception network communications traffic policy ensures that only connections that are essential and approved are allowed.

  This requirement applies to both inbound and outbound network communications traffic. All inbound and outbound traffic must be denied by default. Firewalls and perimeter routers should only allow traffic through that is explicitly permitted. The initial defense for the internal network is to block any traffic at the perimeter that is attempting to make a connection to a host residing on the internal network. In addition, allowing unknown or undesirable outbound traffic by the firewall or router will establish a state that will permit the return of this undesirable traffic inbound.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Configure an inbound ACL to deny all other traffic by default as shown in the example below:

  R1(config)#ip access-list extended EXTERNAL_ACL
  R1(config-ext-nacl)#permit tcp any any established
  R1(config-ext-nacl)#permit tcp host x.11.1.1 eq bgp host x.11.1.2    
  R1(config-ext-nacl)#permit tcp host x.11.1.1 host x.11.1.2 eq bgp
  R1(config-ext-nacl)#permit icmp host x.11.1.1 host x.11.1.2 echo
  R1(config-ext-nacl)#permit icmp host x.11.1.1 host x.11.1.2 echo-reply
  …
  …
  …
  R1(config-ext-nacl)#deny ip any any log-input

  Step 2: Apply the ingress filter to all external interfaces.

  R1(config)#int g0/2
  R1(config-if)#ip access-group EXTERNAL_ACL in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify that the inbound ACL applied to all external interfaces is configured to allow specific ports and protocols and deny all other traffic.

  Step 1: Verify that an inbound ACL is applied to all external interfaces as shown in the example below:

  interface GigabitEthernet0/2
   ip address x.11.1.2 255.255.255.254
   ip access-group EXTERNAL_ACL in

  Step 2: Review inbound ACL to verify that it is configured to deny all other traffic that is not explicitly allowed.

  ip access-list extended EXTERNAL_ACL
   permit tcp any any established
   permit tcp host x.11.1.1 eq bgp host x.11.1.2
   permit tcp host x.11.1.1 host x.11.1.2 eq bgp
   permit icmp host x.11.1.1 host x.11.1.2 echo
   permit icmp host x.11.1.1 host x.11.1.2 echo-reply
   …
   …
   …
  deny   ip any any log-input

  If the ACL is not configured to allow specific ports and protocols and deny all other traffic, this is a finding. If the ACL is not configured inbound on all external interfaces, this is a finding.


vuln_id: V-216663
rule_id: SV-216663r531086_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

description:
  <VulnDiscussion>Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most routers, internal information flow control is a product of system design.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Configure an ACL to allow or deny traffic as shown in the example below.

  R1(config)#ip access-list extended FILTER_PERIMETER
  R1(config-ext-nacl)#permit tcp any any established
  R1(config-ext-nacl)#permit tcp host x.12.1.9 host x.12.1.10 eq bgp
  R1(config-ext-nacl)#permit tcp host x.12.1.9 eq bgp host x.12.1.10
  R1(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo
  R1(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo-reply
  R1(config-ext-nacl)#permit tcp any host x.12.1.22 eq www
  R1(config-ext-nacl)#deny ip any any log-input
  R1(config-ext-nacl)#exit

  Step 2: Apply the ACL inbound on all external interfaces.

  R2(config)#int g0/0
  R1(config-if)#ip access-group  FILTER_PERIMETER in

check_text:
  Review the router configuration to verify that ACLs are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols. In the example below, the router is peering BGP with DISN. ICMP echo and echo-reply packets are allowed for troubleshooting connectivity. WWW traffic is permitted inbound to the NIPRNet host-facing web server (x.12.1.22).

  interface GigabitEthernet0/1
   description Link to DISN
   ip address x.12.1.10 255.255.255.0
   ip access-group FILTER_PERIMETER in
  …
  …
  …
  ip access-list extended FILTER_PERIMETER
   permit tcp any any established
   permit tcp host x.12.1.9 host x.12.1.10 eq bgp
   permit tcp host x.12.1.9 eq bgp host x.12.1.10
   permit icmp host x.12.1.9 host x.12.1.10 echo
   permit icmp host x.12.1.9 host x.12.1.10 echo-reply
   permit tcp any host x.12.1.22 eq www
   deny   ip any any log-input

  If the router is not configured to enforce approved authorizations for controlling the flow of information between interconnected networks, this is a finding.


vuln_id: V-216664
rule_id: SV-216664r855819_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

description:
  <VulnDiscussion>Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.

  Traffic can be restricted directly by an access control list (ACL), which is a firewall function, or by Policy Routing. Policy Routing is a technique used to make routing decisions based on a number of different criteria other than just the destination network, including source or destination network, source or destination address, source or destination port, protocol, packet size, and packet classification. This overrides the router's normal routing procedures used to control the specific paths of network traffic. It is normally used for traffic engineering but can also be used to meet security requirements; for example, traffic that is not allowed can be routed to the Null0 or discard interface. Policy Routing can also be used to control which prefixes appear in the routing table.

  This requirement is intended to allow network administrators the flexibility to use whatever technique is most effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to allow only incoming communications from authorized sources to be routed to authorized destinations. 

  R1(config)#ip access-list extended FILTER_PERIMETER
  R1(config-ext-nacl)#nn permit udp host x.12.1.9 host x.12.1.21 eq ntp
  R1(config-ext-nacl)#end

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to determine if the router allows only incoming communications from authorized sources to be routed to authorized destinations. The hypothetical example below allows inbound NTP from server x.1.12.9 only to host x.12.1.21.

  ip access-list extended FILTER_PERIMETER
   permit tcp any any established
   …
   …
   …
   permit udp host x.12.1.9 host x.12.1.21 eq ntp
   deny   ip any any log-input

  If the router does not restrict incoming communications to allow only authorized sources and destinations, this is a finding.


vuln_id: V-216665
rule_id: SV-216665r863260_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

description:
  <VulnDiscussion>Packets with Bogon IP source addresses should never be allowed to traverse the IP core. Bogon IP networks are RFC1918 addresses or address blocks that have never been assigned by the IANA or have been reserved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the perimeter to block inbound packets with Bogon source addresses.

  Step 1: Configure an ACL containing the current Bogon prefixes as shown below:

  R5(config)#ip access-list extended FILTER_PERIMETER
  R5(config-ext-nacl)#deny ip 0.0.0.0 0.255.255.255 any log-input
  R5(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any log-input
  R5(config-ext-nacl)#deny ip 100.64.0.0 0.63.255.255 any log-input
  R5(config-ext-nacl)#deny ip 127.0.0.0 0.255.255.255 any log-input
  R5(config-ext-nacl)#deny ip 169.254.0.0 0.0.255.255 any log-input
  R5(config-ext-nacl)#deny ip 172.16.0.0 0.15.255.255 any log-input
  R5(config-ext-nacl)#deny ip 192.0.0.0 0.0.0.255 any log-input
  R5(config-ext-nacl)#deny ip 192.0.2.0 0.0.0.255 any log-input
  R5(config-ext-nacl)#deny ip 192.168.0.0 0.0.255.255 any log-input
  R5(config-ext-nacl)#deny ip 198.18.0.0 0.1.255.255 any log-input
  R5(config-ext-nacl)#deny ip 198.51.100.0 0.0.0.255 any log-input
  R5(config-ext-nacl)#deny ip 203.0.113.0 0.0.0.255 any log-input
  R5(config-ext-nacl)#deny ip 224.0.0.0 31.255.255.255 any log-input
  R5(config-ext-nacl)#deny ip 240.0.0.0 15.255.255.255 any log-input
  R5(config-ext-nacl)#permit tcp any any established
  R5(config-ext-nacl)#permit tcp host x.12.1.9 host x.12.1.10 eq bgp
  R5(config-ext-nacl)#permit tcp host x.12.1.9 eq bgp host x.12.1.10
  R5(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo
  R5(config-ext-nacl)#permit icmp host x.12.1.9 host x.12.1.10 echo-reply
  …
  …
  …
  R5(config-ext-nacl)#deny ip any any log-input
  R5(config-ext-nacl)#end

  Step 2: Apply the ACL inbound on all external interfaces.

  R2(config)#int g0/0
  R1(config-if)#ip access-group  FILTER_PERIMETER in
  R1(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify that an ingress ACL applied to all external interfaces is blocking packets with Bogon source addresses.

  Step 1: Verify an ACL has been configured containing the current Bogon prefixes as shown in the example below:

  ip access-list extended FILTER_PERIMETER
   deny   ip 0.0.0.0 0.255.255.255 any log-input
   deny   ip 10.0.0.0 0.255.255.255 any log-input
   deny   ip 100.64.0.0 0.63.255.255 any log-input
   deny   ip 127.0.0.0 0.255.255.255 any log-input
   deny   ip 169.254.0.0 0.0.255.255 any log-input
   deny   ip 172.16.0.0 0.15.255.255 any log-input
   deny   ip 192.0.0.0 0.0.0.255 any log-input
   deny   ip 192.0.2.0 0.0.0.255 any log-input
   deny   ip 192.168.0.0 0.0.255.255 any log-input
   deny   ip 198.18.0.0 0.1.255.255 any log-input
   deny   ip 198.51.100.0 0.0.0.255 any log-input
   deny   ip 203.0.113.0 0.0.0.255 any log-input
   deny   ip 224.0.0.0 31.255.255.255 any log-input
   deny   ip 240.0.0.0 15.255.255.255 any log-input
   permit tcp any any established
   permit tcp host x.12.1.9 host x.12.1.10 eq bgp
   permit tcp host x.12.1.9 eq bgp host x.12.1.10
   permit icmp host x.12.1.9 host x.12.1.10 echo
   permit icmp host x.12.1.9 host x.12.1.10 echo-reply
   …
   …
   …
   deny   ip any any log-input

  Step 2: Verify that the inbound ACL applied to all external interfaces will block all traffic from Bogon source addresses.

  interface GigabitEthernet0/1
   description Link to DISN
   ip address x.12.1.10 255.255.255.254
   ip access-group FILTER_PERIMETER in

  If the router is not configured to block inbound packets with source Bogon IP address prefixes, this is a finding.


vuln_id: V-216666
rule_id: SV-216666r531086_rule
severity: CAT I
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

description:
  <VulnDiscussion>Enclaves with alternate gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's alternate gateway, the perimeter router could be routing transit data from the Internet into the NIPRNet. This could also make the perimeter router vulnerable to a denial of service (DoS) attack as well as provide a back door into the NIPRNet. The DoD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approved Gateway is secure through filters permitting packets with a destination address belonging to the DoD enclave's address block.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the ingress ACL of the perimeter router connected to an alternate gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternate gateway network service provider as shown in the example below:

  R5(config)#ip access-list extended FILTER_ISP
  R5(config-ext-nacl)#permit tcp any any established
  R5(config-ext-nacl)#permit icmp host x.12.1.16 host x.12.1.17 echo
  R5(config-ext-nacl)#permit icmp host x.12.1.16 host x.12.1.17 echo-reply
  R5(config-ext-nacl)#permit tcp any host x.12.1.22 eq www
  R5(config-ext-nacl)#permit tcp any host x.12.1.23 eq www
  R5(config-ext-nacl)#permit 50 any host x.12.1.24
  R5(config-ext-nacl)#permit 51 any host x.12.1.24
  R5(config-ext-nacl)#deny ip any any log-input
  R5(config-ext-nacl)#end

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Verify the interface connecting to ISP has an inbound ACL as shown in the example below.

  interface GigabitEthernet0/2
   description Link to ISP
   ip address x.22.1.15 255.255.255.240
   ip access-group FILTER_ISP in

  Step 2: Verify that the ACL only allows traffic to specific destination addresses (i.e. enclave’s NIPRNet address space) as shown in the example below.

  ip access-list extended FILTER_ISP
   permit tcp any any established
   permit icmp host x.12.1.16 host x.12.1.17 echo
   permit icmp host x.12.1.16 host x.12.1.17 echo-reply
   permit tcp any host x.12.1.22 eq www
   permit tcp any host x.12.1.23 eq www
   permit 50 any host x.12.1.24
   permit 51 any host x.12.1.24
   deny   ip any any log-input

  Note: An Approved Gateway (AG) is any external connection from a DoD NIPRNet enclave to an Internet Service Provider, or network owned by a contractor, or non-DoD federal agency that has been approved by either the DoD CIO or the DoD Component CIO. This AG requirement does not apply to commercial cloud connections when the Cloud Service Provider (CSP) network is connected via the NIPRNet Boundary Cloud Access Point (BCAP).


  If the ingress ACL bound to the interface connecting to an alternate gateway permits packets with addresses other than those specified, such as destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternate gateway network service provider, this is a finding.


vuln_id: V-216667
rule_id: SV-216667r531086_rule
severity: CAT I
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

description:
  <VulnDiscussion>ISPs use BGP to share route information with other autonomous systems (i.e. other ISPs and corporate networks). If the perimeter router was configured to BGP peer with an ISP, NIPRnet routes could be advertised to the ISP, thereby creating a backdoor connection from the Internet to the NIPRnet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Remove any BGP neighbors belonging to the alternate gateway service provider and configure a static route to forward Internet bound traffic to the alternate gateway as shown in the example below:

  R5(config)#ip route 0.0.0.0 0.0.0.0 x.22.1.14

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration and verify that it is not BGP peering with an alternate gateway service provider.

  Step 1: Determine the ip address of the ISP router. 

  interface GigabitEthernet0/2
   description Link to ISP
   ip address x.22.1.15 255.255.255.240

  Step 2: Verify that the router is not BGP peering with this router.

  router bgp nn
   no synchronization
   bgp log-neighbor-changes
   neighbor x.11.1.7 remote-as nn
   neighbor x.11.1.7 password xxxxxxx
   no auto-summary

  In the example above, the router is not peering with the ISP.

  If the router is BGP peering with an alternate gateway service provider, this is a finding.


vuln_id: V-216668
rule_id: SV-216668r531086_rule
severity: CAT III
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an Interior Gateway Protocol (IGP) peering with the NIPRNet or to other autonomous systems.

description:
  <VulnDiscussion>If the static routes to the alternate gateway are being redistributed into an Exterior Gateway Protocol or Interior Gateway Protocol to a NIPRNet gateway, this could make traffic on NIPRNet flow to that particular router and not to the Internet Access Point routers. This could not only wreak havoc with traffic flows on NIPRNet, but it could overwhelm the connection from the router to the NIPRNet gateway(s) and also cause traffic destined for outside of NIPRNet to bypass the defenses of the Internet Access Points.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router so that static routes are not redistributed to an alternate gateway into either a BGP or any IGP peering with the NIPRNet or to any other autonomous systems. This can be done by excluding that route in the route-map as shown in the example below:

  Step 1: Configure a prefix list for any static routes with the alternate gateway as the next-hop address.

  R5(config)#ip prefix-list ISP_PREFIX permit x.x.x.0/24

  Step 2: Configure a route map that will deny the state routes to the ISP.

  R5(config)#route-map FILTER_ISP_STATIC deny 10
  R5(config-route-map)#match ip address prefix-list ISP_PREFIX
  R5(config-route-map)#exit
  R5(config)#route-map FILTER_ISP_STATIC permit 20
  R5(config-route-map)#exit

  Step 3: Apply the route-map to the IGP and BGP redistribute static commands as shown in the EIGRP example.

  R5(config)#router eigrp 1
  R5(config-router)#redistribute static route-map FILTER_ISP_STATIC

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Review the IGP and BGP configurations. If there are redistribute static statements configured as shown in examples below, proceed to step 2.

  OSPF Example:

  router ospf 1
   log-adjacency-changes
   redistribute static subnets
   network 0.0.0.0 255.255.255.255 area 0

  EIGRP example:

  router eigrp 1
   network 10.1.15.0 0.0.0.255
   redistribute static

  RIP example:

  router rip
   version 2
   redistribute static
   network 10.0.0.0

  BGP example:

  router bgp nn
   no synchronization
   bgp log-neighbor-changes
   redistribute static
   neighbor x.11.1.7 remote-as nn
   neighbor x.11.1.7 password xxxxxxx
   no auto-summary

  Step 2: Review the static routes that have been configured to determine if any contain the next hop address of the alternate gateway.

  If the static routes to the alternate gateway are being redistributed into BGP or any IGP peering to a NIPRNet gateway or any other autonomous system, this is a finding.


vuln_id: V-216670
rule_id: SV-216670r1007827_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

description:
  <VulnDiscussion>Vulnerability assessments must be reviewed by the System Administrator, and protocols must be approved by the Information Assurance (IA) staff before entering the enclave.

  ACLs are the first line of defense in a layered security approach. They permit authorized packets and deny unauthorized packets based on port or service type. They enhance the posture of the network by not allowing packets to reach a potential target within the security domain. The lists provided are highly susceptible ports and services that should be blocked or limited as much as possible without adversely affecting customer requirements. Auditing packets attempting to penetrate the network that are stopped by an ACL will allow network administrators to broaden their protective ring and more tightly define the scope of operation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to use an inbound ACL on all external interfaces as shown in the example below to restrict traffic in accordance with the guidelines contained in DOD Instruction 8551.1.

  R1(config)#ip access-list extended EXTERNAL_ACL_INBOUND
  R1(config-ext-nacl)#permit tcp any any established
  R1(config-ext-nacl)#permit tcp host x.11.1.1 eq bgp host x.11.1.2    
  R1(config-ext-nacl)#permit tcp host x.11.1.1 host x.11.1.2 eq bgp
  R1(config-ext-nacl)#permit icmp host x.11.1.1 host x.11.1.2 echo
  R1(config-ext-nacl)#permit icmp host x.11.1.1 host x.11.1.2 echo-reply
  …
  …    < must be in accordance with DoD Instruction 8551.1>
  …
  R1(config-ext-nacl)#deny ip any any log-input
  R1(config-ext-nacl)#exit
  R1(config)#int g0/2
  R1(config-if)#ip access-group EXTERNAL_ACL_INBOUND in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify that the ingress ACL is in accordance with DoD 8551.1.

  Step 1: Verify that an inbound ACL is configured on all external interfaces.

  interface GigabitEthernet0/2
   ip address x.11.1.2 255.255.255.254
   ip access-group EXTERNAL_ACL_INBOUND in

  Step 2. Review the inbound ACL to verify that it is filtering traffic in accordance with DoD 8551.1.

  ip access-list extended EXTERNAL_ACL_INBOUND
   permit tcp any any established
   permit tcp host x.11.1.1 eq bgp host x.11.1.2
   permit tcp host x.11.1.1 host x.11.1.2 eq bgp
   permit icmp host x.11.1.1 host x.11.1.2 echo
   permit icmp host x.11.1.1 host x.11.1.2 echo-reply
   …
   …    < must be in accordance with DoD Instruction 8551.1>
   …
  deny   ip any any log-input

  If the router does not filter traffic in accordance with the guidelines contained in DoD 8551.1, this is a finding.


vuln_id: V-216671
rule_id: SV-216671r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

description:
  <VulnDiscussion>Access lists are used to separate data traffic into that which it will route (permitted packets) and that which it will not route (denied packets). Secure configuration of routers makes use of access lists for restricting access to services on the router itself as well as for filtering traffic passing through the router. 

  Inbound versus Outbound: It should be noted that some operating systems default access lists are applied to the outbound queue. The more secure solution is to apply the access list to the inbound queue for three reasons:

  - The router can protect itself before damage is inflicted.
  - The input port is still known and can be filtered upon.
  - It is more efficient to filter packets before routing them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to use an inbound ACL on all external interfaces as shown in the example below:

  R1(config)#int g0/2
  R1(config-if)#ip access-group EXTERNAL_ACL_INBOUND in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify that an inbound ACL is configured on all external interfaces as shown in the example below:

  interface GigabitEthernet0/2
   ip address x.11.1.2 255.255.255.254
   ip access-group EXTERNAL_ACL_INBOUND in

  If the router is not configured to filter traffic entering the network at all external interfaces in an inbound direction, this is a finding.


vuln_id: V-216672
rule_id: SV-216672r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

description:
  <VulnDiscussion>Access lists are used to separate data traffic into that which it will route (permitted packets) and that which it will not route (denied packets). Secure configuration of routers makes use of access lists for restricting access to services on the router itself as well as for filtering traffic passing through the router. 

  Inbound versus Outbound: It should be noted that some operating systems default access lists are applied to the outbound queue. The more secure solution is to apply the access list to the inbound queue for three reasons:

  - The router can protect itself before damage is inflicted.
  - The input port is still known and can be filtered upon.
  - It is more efficient to filter packets before routing them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to use an inbound ACL on all internal interfaces as shown in the example below:

  R5(config)#int g0/2
  R5(config-if)#ip access-group EGRESS_FILTER in

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to verify that the egress ACL is bound to the internal interface in an inbound direction.

  interface interface GigabitEthernet0/2
   description downstream link to LAN
   ip address 10.1.25.5 255.255.255.0
   ip access-group EGRESS_FILTER in

  If the router is not configured to filter traffic leaving the network at the internal interface in an inbound direction, this is a finding.


vuln_id: V-216674
rule_id: SV-216674r855821_rule
severity: CAT III
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces.

description:
  <VulnDiscussion>LLDP is a neighbor discovery protocol used to advertise device capabilities, configuration information, and device identity. LLDP is media-and-protocol-independent as it runs over layer 2; therefore, two network nodes that support different layer 3 protocols can still learn about each other. Allowing LLDP messages to reach external network nodes provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable LLDP transmit on all external interfaces as shown in the example below:

  R5(config)#int g0/1
  R5(config-if)#no lldp transmit

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Verify LLDP is not enabled globally via the command.  

  lldp run

  By default LLDP is not enabled globally. If LLDP is enabled, proceed to step 2.

  Step 2: Verify LLDP is not enabled on any external interface as shown in the example below:

  interface GigabitEthernet0/1
   ip address x.1.12.1 255.255.255.252
   no lldp transmit

  Note: LLDP is enabled by default on all interfaces once it is enabled globally; hence the command "lldp transmit" will not be visible on the interface configuration.

  If LLDP transmit is enabled on any external interface, this is a finding.


vuln_id: V-216675
rule_id: SV-216675r855822_rule
severity: CAT III
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to have Cisco Discovery Protocol (CDP) disabled on all external interfaces.

description:
  <VulnDiscussion>CDP is a Cisco proprietary neighbor discovery protocol used to advertise device capabilities, configuration information, and device identity. CDP is media-and-protocol-independent as it runs over layer 2; therefore, two network nodes that support different layer 3 protocols can still learn about each other. Allowing CDP messages to reach external network nodes provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Disable CDP on all external interfaces via no cdp enable command or disable CDP globally via no cdp run command.

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Step 1: Verify if CDP is enabled globally as shown below:

  cdp run

  By default, CDP is not enabled globally or on any interface. If CDP is enabled globally, proceed to step 2.

  Step 2: Verify CDP is not enabled on any external interface as shown in the example below:

  interface GigabitEthernet2
   ip address z.1.24.4 255.255.255.252
   …
   …
   …
  cdp enable

  If CDP is enabled on any external interface, this is a finding.


vuln_id: V-216676
rule_id: SV-216676r855823_rule
severity: CAT II
cci: CCI-002403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

description:
  <VulnDiscussion>When Proxy ARP is enabled on a router, it allows that router to extend the network (at Layer 2) across multiple interfaces (LAN segments). Because proxy ARP allows hosts from different LAN segments to look like they are on the same segment, proxy ARP is only safe when used between trusted LAN segments. Attackers can leverage the trusting nature of proxy ARP by spoofing a trusted host and then intercepting packets. Proxy ARP should always be disabled on router interfaces that do not require it, unless the router is being used as a LAN bridge.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Disable Proxy ARP on all external interfaces as shown in the example below:

  R2(config)#int g0/1     
  R2(config-if)#no ip proxy-arp

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the router configuration to determine if IP Proxy ARP is disabled on all external interfaces as shown in the example below:

  interface GigabitEthernet0/1
   description link to DISN
   ip address x.1.12.2 255.255.255.252
   no ip proxy-arp

  Note: By default Proxy ARP is enabled on all interfaces; hence, if enabled, it will not be shown in the configuration. 

  If IP Proxy ARP is enabled on any external interface, this is a finding.


vuln_id: V-216677
rule_id: SV-216677r945857_rule
severity: CAT II
title: The Cisco perimeter router must be configured to block all outbound management traffic.
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the perimeter router of the managed network with an outbound ACL on the egress interface to block all management traffic.

  Step 1: Configure an ACL to block egress management traffic.

  R5(config)#ip access-list extended EXTERNAL_ACL_OUTBOUND
  R5(config-ext-nacl)#deny tcp any any eq tacacs log-input
  R5(config-ext-nacl)#deny tcp any any eq 22 log-input
  R5(config-ext-nacl)#deny udp any any eq snmp log-input
  R5(config-ext-nacl)#deny udp any any eq snmptrap log-input
  R5(config-ext-nacl)#deny udp any any eq syslog log-input
  R5(config-ext-nacl)#permit tcp any any eq www
  R5(config-ext-nacl)#deny ip any any log-input
  R5(config-ext-nacl)#exit

  Note: Permit commands would be configured to allow applicable outbound traffic. The example above is allowing web traffic.

  Step 2: Configure the external interfaces with the outbound ACL.

  R1(config)#int g0/2
  R1(config-if)#ip access-group EXTERNAL_ACL_OUTBOUND out

check_text:
  This requirement is not applicable for the DODIN Backbone.

  The perimeter router of the managed network must be configured with an outbound ACL on the egress interface to block all management traffic as shown in the example below:

  Step 1: Verify that all external interfaces has been configured with an outbound ACL as shown in the example below:

  interface GigabitEthernet0/2
   description link to DISN
   ip address x.11.1.2 255.255.255.254
   ip access-group EXTERNAL_ACL_OUTBOUND out

  Step 2: Verify that the outbound ACL discards management traffic as shown in the example below:

  ip access-list extended EXTERNAL_ACL_OUTBOUND
   deny   tcp any any eq tacacs log-input
   deny   tcp any any eq 22 log-input
   deny   udp any any eq snmp log-input
   deny   udp any any eq snmptrap log-input
   deny   udp any any eq syslog log-input
   permit tcp any any eq www log-input
   deny   ip any any log-input

  If management traffic is not blocked at the perimeter, this is a finding.


vuln_id: V-216678
rule_id: SV-216678r991892_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.

description:
  <VulnDiscussion>Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the edge of the managed network and at the NOC. Dedicated links can be deployed using provisioned circuits or MPLS Layer 2 and Layer 3 VPN services or implementing a secured path with gateway-to-gateway IPsec tunnels. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Ensure that a dedicated circuit, MPLS/VPN service, or IPsec tunnel is deployed to transport management traffic between the managed network and the NOC. If an IPsec tunnel is to be used, the steps below can be used as a guideline.

  Step 1: Configure the ACL for the management network as the destination. This ACL will be defined in the crypto as the interesting traffic to be forwarded into the IPsec tunnel.

  R4(config)#ip access-list extended MGMT_TRAFFIC_ACL
  R4(config-ext-nacl)#permit ip 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255
  R4(config-ext-nacl)#exit

  Step 2: Create an ISAKMP policy for Phase 1 negotiations.

  R4(config)#crypto isakmp policy 10
  R4(config-isakmp)#hash sha256
  R4(config-isakmp)#authentication pre-share
  R4(config-isakmp)#exit

  Step 3: Specify the pre-shared key and the remote peer address.

  R4(config)#crypto isakmp key 0 xxxxxx address x.1.12.1

  Note: Digital certificates can be utilized as an alternative.
   
  Step 4: Create the IPSec transform set for the data encryption.

  R4(config)#crypto ipsec transform-set TRANS_SET ah-sha256-hmac esp-aes
  R4(cfg-crypto-trans)#mode tunnel
  R4(cfg-crypto-trans)#exit

  Step 5: Create the crypto map.

  R4(config)#crypto map IPSEC_MGMT_MAP 10 ipsec-isakmp
  R4(config-crypto-map)#set peer x.1.12.1
  R4(config-crypto-map)#match address MGMT_TRAFFIC_ACL
  R4(config-crypto-map)#set transform-set TRANS_SET
  R4(config-crypto-map)#end

  Step 6: Apply the crypto map to the external interface. 

  R4(config)#int g0/2
  R4(config-if)#crypto map IPSEC_MGMT_MAP

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the network topology diagram to determine connectivity between the managed network and the NOC. Review the OOBM gateway router configuration to validate the path and interface that the management traffic traverses. If an IPsec tunnel is used to transport the management traffic between the NOC and the managed network, review the configuration following the steps below.

  Step 1: Note the crypto map applied to the external interface.

   interface interface GigabitEthernet0/2
   description link to DISN
   ip address x.1.24.4 255.255.255.0
   crypto map IPSEC_MGMT_MAP

  Step 2: Review the ISAKMP policy for Phase 1 negotiations and Phase 2 policy for data encryption.

  crypto isakmp policy 10
   authentication pre-share
   hash sha256
   crypto isakmp key xxxxxx address x.1.12.1
  !
  !
  crypto ipsec transform-set TRANS_SET ah-sha256-hmac esp-aes 

  Step 3: Review the crypto map that was bound to the external interface and note the ACL defined that identifies the interesting traffic for the IPsec tunnel.

  crypto map IPSEC_MGMT_MAP 10 ipsec-isakmp
   set peer x.1.12.1
   set transform-set TRANS_SET
   match address MGMT_TRAFFIC_ACL

  Step 4: Review the ACL defined in the crypto map and verify that the destination is the management network.

  ip access-list extended MGMT_TRAFFIC_ACL
   permit ip 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255

  Note: The management network is this example is 10.22.2.0/24

  If management traffic is not transported between the managed network and the NOC via dedicated circuit, MPLS/VPN service, or IPsec tunnel, this is a finding.


vuln_id: V-216679
rule_id: SV-216679r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).

description:
  <VulnDiscussion>The OOBM network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device, enabling network management traffic to flow between the managed network elements and the NOC. This allows the use of paths separate from those used by the managed network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure ACLs to permit only authorized management traffic into IPsec tunnels or the OOBM interface used for forwarding management data as shown in the examples below:

  OOBM Link:

  R4(config)#ip access-list extended MGMT_TRAFFIC_ACL
  R4(config-ext-nacl)#permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq tacacs
  R4(config-ext-nacl)#permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq 22
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp-trap
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq syslog
  R4(config-ext-nacl)#permit icmp 10.1.34.0 0.0.0.255 10.22.22.0 0.0.0.255 echo
  R4(config-ext-nacl)#permit icmp 10.1.34.0 0.0.0.255 10.22.22.0 0.0.0.255 echo-reply
  R4(config-ext-nacl)#deny   ip any any log-input
  R4(config-ext-nacl)#exit

  IPsec Tunnel:

  R4(config)#ip access-list extended MGMT_TRAFFIC_ACL
  R4(config-ext-nacl)#permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq tacacs
  R4(config-ext-nacl)#permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq 22
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp-trap
  R4(config-ext-nacl)#permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq syslog
  R4(config-ext-nacl)#permit icmp 10.1.34.0 0.0.0.255 22.22.22.0 0.0.0.255
  R4(config-ext-nacl)#exit

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Review the network topology diagram to determine connectivity between the managed network and the NOC. Review the OOBM gateway router configuration to validate the path that the management traffic traverses. Verify that only management traffic is forwarded through the OOBM interface or IPsec tunnel.

  If an OOBM link is used, verify that the only authorized management traffic is transported to the NOC by reviewing the outbound ACL applied to the OOBM interface as shown in the example below:

  Step 1: Note the outbound ACL applied to the OOBM interface.

  interface GigabitEthernet0/2
   description OOB link to NOC
   ip address 10.11.1.8 255.255.255.0
   ip access-group MGMT_TRAFFIC_ACL out

  Step 2: Review the outbound ACL and verify only management traffic is forwarded to the NOC.

  ip access-list extended MGMT_TRAFFIC_ACL
   permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq tacacs
   permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq 22
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp-trap
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq syslog
   permit icmp 10.1.34.0 0.0.0.255 10.22.22.0 0.0.0.255 
   deny   ip any any log-input

  If an IPSec tunnel is used, verify that the only authorized management traffic is transported to the NOC.

  Step 1: Note the crypto map applied to the external interface.

   interface interface GigabitEthernet0/2
   description link to DISN
   ip address x.1.24.4 255.255.255.0
   crypto map IPSEC_MGMT_MAP

  Step 2: Review the crypto map that was bound to the external interface and note the ACL defined that identifies the interesting traffic for the IPsec tunnel.

  crypto map IPSEC_MGMT_MAP 10 ipsec-isakmp
   set peer x.1.12.1
   set transform-set TRANS_SET
   match address MGMT_TRAFFIC_ACL

  Step 3: Review the ACL defined in the crypto map and verify only management traffic is forwarded to the NOC.

  ip access-list extended MGMT_TRAFFIC_ACL
   permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq tacacs
   permit tcp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq 22
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq snmp-trap
   permit udp 10.1.34.0 0.0.0.255 10.22.2.0 0.0.0.255 eq syslog
   permit icmp 10.1.34.0 0.0.0.255 10.22.22.0 0.0.0.255

  Note: ICMP is permitted for troubleshooting purposes. The IPSec SA can only identify interesting traffic via address, protocol, and port; hence, the ICMP traffic cannot be qualified via type attribute.

  If traffic other than authorized management traffic is permitted through the OOBM interface or IPsec tunnel, this is a finding.


vuln_id: V-216680
rule_id: SV-216680r531086_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco out-of-band management (OOBM) gateway router must be configured to have separate Interior Gateway Protocol (IGP) instances for the managed network and management network.

description:
  <VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, implementation of several safeguards for containment of management and production traffic boundaries must occur. Since the managed and management network are separate routing domains, configuration of separate IGP routing instances is critical on the router to segregate traffic from each network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Configure the router to have a separate IGP instance for the management network as shown in the example below:

  R3(config)#router ospf 1 vrf MGMT
  R3(config-router)#network 0.0.0.0 0.0.0.0 area 0
  R3(config-router)#exit
  R3(config)#router ospf 2 vrf PROD
  R3(config-router)#network 0.0.0.0 0.0.0.0 area 0
  R3(config-router)#end

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Verify that the OOBM interface is an adjacency in the IGP domain for the management network via separate VRF as shown in the example below:

  router ospf 1 vrf MGMT
   log-adjacency-changes
   network 0.0.0.0 255.255.255.255 area 0
  !
  router ospf 2 vrf PROD
   log-adjacency-changes
   network 0.0.0.0 255.255.255.255 area 0

  If the router is not configured to have separate IGP instances for the managed network and management network, this is a finding.


vuln_id: V-216681
rule_id: SV-216681r531086_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

description:
  <VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries; otherwise, it is possible that management traffic will not be separated from production traffic.

  Since the managed network and the management network are separate routing domains, separate Interior Gateway Protocol (IGP) routing instances must be configured on the router, one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone.

  Remove the configuration that imports routes from the managed network into the management network or vice versa as shown in the example below:

  R1(config)#ip vrf MGMT
  R1(config-vrf)#no route-target import 8:8

check_text:
  This requirement is not applicable for the DODIN Backbone.

  Verify the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports OSPF routes from the production route table (VRF PROD) into the management route table (VRF MGMT) using BGP.

  ip vrf MGMT
   rd 4:4
   route-target export 4:4
   route-target import 4:4
   route-target import 8:8
  !
  ip vrf PROD
   rd 8:8
   route-target import 8:8
   route-target export 8:8
  …
  …
  …
  router ospf 1 vrf MGMT
   log-adjacency-changes
   redistribute bgp 64512 subnets
   network 0.0.0.0 255.255.255.255 area 0
  !
  router ospf 2 vrf PROD
   log-adjacency-changes
   network 0.0.0.0 255.255.255.255 area 0
  !
  router bgp 64512
   no synchronization
   bgp log-neighbor-changes
   no auto-summary
   !
   address-family ipv4 vrf MGMT
    no synchronization
    redistribute ospf 1 vrf MGMT
   exit-address-family
   !
   address-family ipv4 vrf PROD
    no synchronization
    redistribute ospf 2 vrf PROD
   exit-address-family

  If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.


vuln_id: V-216682
rule_id: SV-216682r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).

description:
  <VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

  Step 1: Configure the ACL to only allow traffic to the route processor from the OOBM backbone and the NOC.

  R4(config)#ip access-list extended TRAFFIC_FROM_NOC
  R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
  R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
  R4(config-ext-nacl)#permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
  R4(config-ext-nacl)#permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
  R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
  R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
  R4(config-ext-nacl)#permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
  R4(config-ext-nacl)#permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
  R4(config-ext-nacl)#deny ip any any log-input

  Step 2: Configure the ACL to only allow traffic to the route processor from the OOBM LAN.

  R4(config)#ip access-list extended TRAFFIC_TO_NOC
  R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
  R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
  R4(config-ext-nacl)#deny ip any host 10.13.1.1 log-input
  R4(config-ext-nacl)#deny ip any host 10.11.1.8 log-input
  R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
  R4(config-ext-nacl)#permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
  R4(config-ext-nacl)#deny ip any any log-input
  R4(config-ext-nacl)#exit

  Step 3: Apply the ACLs configured above to the appropriate OOBM interfaces as shown in the example below:

  R4(config)#int g0/2
  R4(config-if)#ip access-group TRAFFIC_FROM_NOC in
  R4(config)#int g0/3
  R4(config-if)#ip access-group TRAFFIC_TO_NOC in
  R4(config-if)#end

check_text:
  This requirement is not applicable for the DODIN Backbone. It is only applicable if the OOBM gateway router is not a dedicated device to the OOBM backbone.

  Verify that traffic destined to itself is only sourced by the OOBM or the NOC. In the example below, the OOBM backbone network is 10.11.1.0/24, the NOC address spaces is 10.12.1.0/24, and the OOBM LAN address space at remote site connecting to the managed network is 10.13.1.0/24.

  Step 1: Note the inbound ACL applied to the OOBM interfaces.

  interface GigabitEthernet0/2
   description OOB link to NOC
   ip address 10.11.1.8 255.255.255.0
   ip access-group TRAFFIC_FROM_NOC in
  !
  interface GigabitEthernet0/3
   description link to OOBM LAN access switch
   ip address 10.13.1.1 255.255.255.0
   ip access-group TRAFFIC_TO_NOC in

  If the ACL is not configured to only allow traffic to the route processor from the OOBM backbone and the NOC, this is a finding.

  Step 2: Review the inbound ACL bound to any OOB interface connecting to the OOBM backbone and verify traffic destined to itself is only from the OOBM or NOC address space.

  ip access-list extended TRAFFIC_FROM_NOC
   permit ip 10.11.1.0 0.255.255.255 host 10.11.1.8
   permit ip 10.12.1.0 0.255.255.255 host 10.11.1.8
   permit ip 10.11.1.0 0.255.255.255 host 10.13.1.1
   permit ip 10.12.1.0 0.255.255.255 host 10.13.1.1
   deny   ip any host 10.11.1.8 log-input
   deny   ip any host 10.13.1.1 log-input
   permit ip 10.11.1.0 0.0.0.255 10.13.1.0 0.0.0.255
   permit ip 10.12.1.0 0.0.0.255 10.13.1.0 0.0.0.255
   deny   ip any any log-input

  Step 3: Review the inbound ACL bound to any OOBM LAN interfaces and verify traffic destined to itself is from the OOBM LAN address space.

  ip access-list extended TRAFFIC_TO_NOC
   permit ip 10.13.1.0 0.255.255.255 host 10.13.1.1
   permit ip 10.13.1.0 0.255.255.255 host 10.11.1.8
   deny   ip any host 10.13.1.1 log-input
   deny   ip any host 10.11.1.8 log-input
   permit ip 10.13.1.0 0.255.255.255 10.11.1.0 0.0.0.255
   permit ip 10.13.1.0 0.255.255.255 10.12.1.0 0.0.0.255
   deny   ip any any log-input

  If the ACL is not configured to only allow traffic to the route processor from the OOBM LAN, this is a finding.


vuln_id: V-216683
rule_id: SV-216683r531086_rule
severity: CAT II
cci: CCI-001097
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Cisco router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

description:
  <VulnDiscussion>The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.

  An OOBM interface does not forward transit traffic, thereby providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the management interface is not a dedicated OOBM interface, it must be configured with both an ingress and egress ACL.

  Step 1: Configure an ingress ACL a shown in the example below:

  R5(config)#ip access-list extended INGRESS_MANAGEMENT_ACL
  R5(config-ext-nacl)#permit tcp any host 10.11.1.22 eq tacacs
  R5(config-ext-nacl)#permit tcp any host 10.11.1.22 eq 22
  R5(config-ext-nacl)#permit udp any host 10.11.1.22 eq snmp
  R5(config-ext-nacl)#permit udp any host 10.11.1.22 eq snmptrap
  R5(config-ext-nacl)#permit udp any host 10.11.1.22 eq ntp
  R5(config-ext-nacl)#permit icmp any host 10.11.1.22
  R5(config-ext-nacl)#deny ip any any log-input
  R5(config-ext-nacl)#exit

  Step 2: Configure an egress ACL a shown in the example below:

  R5(config)#ip access-list extended EGRESS_MANAGEMENT_ACL
  R5(config-ext-nacl)#deny ip any any log-input
  R5(config-ext-nacl)#exit

  Step 3: Apply the ACLs to the OOBM interfaces.

  R4(config)#int g0/7
  R4(config-if)#ip access-group INGRESS_MANAGEMENT_ACL in
  R4(config-if)#ip access-group EGRESS_MANAGEMENT_ACL out

check_text:
  This requirement is only applicable where management access to the router is via an OOBM interface which is not a true OOBM interface.

  Step 1: Verify that the managed interface has an inbound and outbound ACL configured. 

  interface GigabitEthernet0/7
   description link to OOBM access switch
   ip address 10.11.1.22 255.255.255.0
   ip access-group INGRESS_MANAGEMENT_ACL in
   ip access-group EGRESS_MANAGEMENT_ACL out

  Step 2: Verify that the ingress ACL only allows management and ICMP traffic. 

  ip access-list extended INGRESS_MANAGEMENT_ACL
   permit tcp any host 10.11.1.22 eq tacacs
   permit tcp any host 10.11.1.22 eq 22
   permit udp any host 10.11.1.22 eq snmp
   permit udp any host 10.11.1.22 eq snmptrap
   permit udp any host 10.11.1.22 eq ntp
   permit icmp any host 10.11.1.22
   deny   ip any any log-input

  Step 3: Verify that the egress ACL blocks any transit traffic.

  ip access-list extended EGRESS_MANAGEMENT_ACL
   deny   ip any any log-input

  Note: On Cisco routers, local generated packets are not inspected by outgoing interface access-lists. Hence, the above configuration would simply drop any packets not generated by the router; hence, blocking any transit traffic.

  If the router does not restrict traffic that ingresses and egresses the management interface, this is a finding.


