What changed in Cisco IOS XE Router NDM STIG V3R7V3R7 changes

Cisco IOS XE Router NDM STIG V3R7 (2026-04-01) replaced V3R6 (2026-01-05): 10 checks updated. It has 42 checks, against 42 in V3R6.

V3R7 checklistV3R6 checklist Compare V3R6 and V3R7 in STIG Compare

  • 0 added
  • 0 removed
  • 10 updated

Updated fields: Fix text 10Check text 1

Updated in V3R7 (10)

V-215807CAT IIThe Cisco router must be configured to limit the number of concurrent management sessions to an organization-defined number.Check text, Fix text

Check text

Note: This requirement is not applicable to file transfer actions such as FTP, SCP, and SFTP. Review the router configuration to determine if concurrent management sessions are limited as shown in the example below: ip http secure-server ip http max-connections 2 … … … For platforms that support the session-limit command: line vty 0 14 session-limit 2 transport input ssh For those platforms that do not support the session-limit command, the sessions can also be limited by reducing the number of active vty lines as shown in the example below. line vty 0 1 transport input ssh line vty 2 4 transport input none If the router is not configured to limit the number of concurrent management sessions, this is a finding.

Fix text

Configure the router to limit the number of concurrent management sessions to an organization-defined number as shown in the example below. R4(config)#ip http max-connections 2 R4(config)#line vty 0 1 R4(config-line)#transport input ssh R4(config-line)#exit R4(config)#line vty 2 4 R4(config-line)# transport input none R4(config-line)#end To configure session limiting, use the example below. R4(config)#line vty 0 4 R4(config-line)#session-limit 2 R4(config-line)#transport input ssh

V-215807 in V3R7

V-215808CAT IIThe Cisco router must be configured to automatically audit account creation.Fix text

Fix text

Configure the router to log account creation using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215808 in V3R7

V-215809CAT IIThe Cisco router must be configured to automatically audit account modification.Fix text

Fix text

Configure the router to log account modification using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215809 in V3R7

V-215810CAT IIThe Cisco router must be configured to automatically audit account disabling actions.Fix text

Fix text

Configure the router to log account disabling using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215810 in V3R7

V-215811CAT IIThe Cisco router must be configured to automatically audit account removal actions.Fix text

Fix text

Configure the router to log account removal using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215811 in V3R7

V-215815CAT IIThe Cisco device must be configured to audit all administrator activity.Fix text

Fix text

Configure the router to log administrator activity as shown in the example below. R1(config)#logging userinfo R1(config)#archive R1(config-archive)#log config R1(config-archive-log-cfg)#logging enable R1(config-archive-log-cfg)#logging size 1000 R1(config-archive-log-cfg)#notify syslog contenttype plaintext R1(config-archive-log-cfg)#hidekeys R1(config-archive-log-cfg)#end

V-215815 in V3R7

V-215819CAT IIThe Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.Fix text

Fix text

Configure the Cisco router to log all configuration changes as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215819 in V3R7

V-215834CAT IIThe Cisco router must be configured to automatically audit account enabling actions.Fix text

Fix text

Configure the router to log account enabling using the following commands: R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215834 in V3R7

V-215848CAT IIThe Cisco router must be configured to generate log records when administrator privileges are deleted.Fix text

Fix text

Configure the Cisco router to generate log records when administrator privileges are deleted as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215848 in V3R7

V-215850CAT IIThe Cisco router must be configured to generate log records for privileged activities.Fix text

Fix text

Configure the Cisco router to generate log records for privileged activities as shown in the example below. R4(config)#archive R4(config-archive)#log config R4(config-archive-log-cfg)#logging enable R4(config-archive-log-cfg)#logging size 1000 R4(config-archive-log-cfg)#notify syslog contenttype plaintext R4(config-archive-log-cfg)#hidekeys R4(config-archive-log-cfg)#end

V-215850 in V3R7

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R7 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.