Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Layer 2 Switch Security Requirements Guide

The Layer 2 Switch Security Requirements Guide (V3 R4) has 36 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

36STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Apr 01 2026

The layer 2 switch must have all disabled switch ports assigned to an unused VLAN.

Layer 2 Switch Security Requirements Guide

Assessment Title

Rule Text

Description

Discussion Text

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-206666

Rule

SV-206666r385561_rule

Severity

medium

Rule Version

SRG-NET-000512-L2S-000007

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the switch configurations and examine all access switch ports.  Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links.

If there are any access switch ports not in use and not in an inactive VLAN, this is a finding.

Note: Switch ports configured for 802.1x are exempt from this requirement.

Implementation Procedure

Fix Text

Assign all switch ports not in use to an inactive VLAN.

Note: Switch ports configured for 802.1x are exempt from this requirement.

STIG check 19 of 36 in the Layer 2 Switch Security Requirements Guide checklist

← Previous · V-206665The layer 2 switch must have all trunk links enabled statically.Next · V-206667 →The layer 2 switch must not have the default VLAN assigned to any host-facing switch ports.