Cisco IOS Router STIG Checklist

19 items · Security · Hard difficulty · 4 hours

Secure Cisco IOS routers with this STIG-based implementation checklist.

• Download latest Cisco IOS Router STIG resources

  Get XCCDF and automated SCC content from DISA.

• Verify device model and IOS version

  Check hardware model and show version output.

• Compare device version against STIG requirements

  Match installed IOS against STIG's allowed versions.

• Install IOS updates and security patches

  Stage and install recommended patches; schedule maintenance window.

• Enable secure management (SSH v2) and disable Telnet

  Enable SSHv2, remove or block Telnet and other plaintext access.

• Configure AAA and authentication methods

  Centralize authentication, authorization, and accounting per STIG guidance.

• Create local admin account with minimum necessary privileges

  Define emergency local account with a strong password and limited privileges.

• Point AAA to TACACS+/RADIUS servers and test authentication

  Configure server groups, shared secrets, and verify logins.

• Enforce strong password policies and account lockouts

  Set complexity, min length, history, and lockout timers.

• Limit management access with ACLs and VTY access-class

  Restrict management IPs, apply to vty lines and management interfaces.

• Disable unused services and shutdown unused interfaces

  Turn off services like HTTP, CDP, and unused ports if not required.

• Configure logging and send logs to a remote, secured syslog/SIEM

  Log all critical events centrally and ensure log retention and protection.

• Configure and secure NTP sources

  Point to authenticated NTP servers and restrict NTP access.

• Configure SNMPv3 with encrypted auth and restrict access

  Use SNMPv3, avoid community strings, and restrict management hosts.

• Apply interface and network ACLs according to STIG rules

  Implement ingress/egress filters to limit traffic exposure.

• Enable secure boot, image integrity checks, and secure file permissions

  Verify boot integrity, sign images, and protect IOS files.

• Save configuration and back up to a secure repository

  Write memory and store config off-device (encrypted), verify backups.

• Perform compliance scan using automated STIG/XCCDF content

  Run XCCDF/SCC tools, review findings, and remediate issues.

• Review and document changes; report comments to DISA if required

  Maintain change log and email DISA for proposed revisions or issues.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.