What changed in Network Device Management Security Requirements Guide V5R5V5R5 changes

Network Device Management Security Requirements Guide V5R5 (2026-07-01) replaced V5R4 (2025-10-28): 6 checks removed, 1 updated. It has 99 checks, against 105 in V5R4.

V5R5 checklistV5R4 checklist Compare V5R4 and V5R5 in STIG Compare

  • 0 added
  • 6 removed
  • 1 updated

Updated fields: Check text 1Fix text 1Title 1Discussion 1

Removed since V5R4 (6)

  • V-202006CAT IIThe network device must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
  • V-202007CAT IIThe network device must initiate a session lock after a 15-minute period of inactivity.
  • V-202008CAT IIThe network device must be configured to enable network administrators to directly initiate a session lock.
  • V-202009CAT IIThe network device must retain the session lock until the administrator reestablishes access using established identification and authentication procedures.
  • V-202130CAT IIThe network device must generate log records for a locally developed list of auditable events
  • V-213468CAT IThe network device must be running an operating system release that is currently supported by the vendor.

Updated in V5R5 (1)

V-278996CAT IThe network device hardware and software must be a version supported by the vendor.Title, Check text, Fix text, Discussion

Title

The network device hardware and software must be a version supported by the vendor.

Check text

Verify that the network device ishardware and software are a version supported by the vendor. If the network device ishardware and software are not a version supported by the vendor, this is a finding.

Fix text

Install or upgrade the network device hardware and software to a version supported by the vendor.

Discussion

Unsupported software and systems shouldmust not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilities. Software and systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation. When maintenance updates and patches are no longer available, software is no longer considered supported and shouldmust be upgraded or decommissioned.

V-278996 in V5R5

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V5R5 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.