What changed in Cisco IOS XE Router NDM SCAP Benchmark V3R5V3R5 changes

Cisco IOS XE Router NDM SCAP Benchmark V3R5 (2026-02-11) replaced V3R4 (2025-05-16): 9 rules updated. It has 20 rules, against 20 in V3R4.

V3R5 benchmarkV3R4 benchmark Compare V3R4 and V3R5 in SCAP Compare

  • 0 added
  • 0 removed
  • 9 updated

Updated fields: Fix text 9

Updated in V3R5 (9)

V-215808CAT IIThe Cisco router must be configured to automatically audit account creation.Fix text

Fix text

Configure the router to log account creation using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215808 in V3R5

V-215809CAT IIThe Cisco router must be configured to automatically audit account modification.Fix text

Fix text

Configure the router to log account modification using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215809 in V3R5

V-215810CAT IIThe Cisco router must be configured to automatically audit account disabling actions.Fix text

Fix text

Configure the router to log account disabling using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215810 in V3R5

V-215811CAT IIThe Cisco router must be configured to automatically audit account removal actions.Fix text

Fix text

Configure the router to log account removal using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215811 in V3R5

V-215815CAT IIThe Cisco device must be configured to audit all administrator activity.Fix text

Fix text

Configure the router to log administrator activity as shown in the example below. R1(config)#logging userinfo R1(config)#archive R1(config-archive)#log config R1(config-archive-log-cfg)#logging enable R1(config-archive-log-cfg)#logging size 1000 R1(config-archive-log-cfg)#notify syslog contenttype plaintext R1(config-archive-log-cfg)#hidekeys R1(config-archive-log-cfg)#end

V-215815 in V3R5

V-215819CAT IIThe Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.Fix text

Fix text

Configure the Cisco router to log all configuration changes as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215819 in V3R5

V-215834CAT IIThe Cisco router must be configured to automatically audit account enabling actions.Fix text

Fix text

Configure the router to log account enabling using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215834 in V3R5

V-215848CAT IIThe Cisco router must be configured to generate log records when administrator privileges are deleted.Fix text

Fix text

Configure the Cisco router to generate log records when administrator privileges are deleted as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215848 in V3R5

V-215850CAT IIThe Cisco router must be configured to generate log records for privileged activities.Fix text

Fix text

Configure the Cisco router to generate log records for privileged activities as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215850 in V3R5

How these changes are found

Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.

Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.