OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ACI must conduct backups of the configuration weekly or at an organization-defined frequency and store on a separate device.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271921CACI-ND-000006SV-271921r1113817_ruleCCI-000539medium
Description
Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configuration and security settings. If this information were not backed up, and a system failure were to occur, the security settings would be difficult to reconfigure quickly and accurately. Maintaining a backup of information system and security-related documentation provides for a quicker recovery time when system outages occur. This control requires the Cisco ACI to support the organizational central backup process for user account information associated with the Cisco ACI. This function may be provided by the Cisco ACI itself; however, the preferred best practice is a centralized backup rather than each Cisco ACI performing discrete backups. With ACI, all components of the ACI Fabric are treated as one entity (leaves, spines, APIC controllers). The ACI Fabric configuration, while made up of different managed objects, is combined into one tar/gz zipfile, which greatly improves the configuration backup process, as well as the configuration restoration process. Finally, the backups can be configured as one-time backup jobs, or they can be scheduled in a daily or weekly scheduler to export the entire Fabric configuration to a remote location (i.e., external server) using SCP, FTP, or SFTP. Cisco ACI allows administrators to perform on-demand and periodic snapshots. Those snapshots can be saved either locally or in a remote location. Cisco ACI configuration contains many sensitive details, including passwords and secrets. Therefore, backup configuration must be properly secured and stored in a secure remote location, ensuring that sensitive information on the configuration files is not disclosed. Set the AES passphrase immediately after fabric bring-up and store the passphrase in a safe location external to the APIC. This passphrase must be provided by the administrator to unencrypt the configuration backup needed to restore the fabric should a disaster happen.
STIGDate
Cisco ACI NDM Security Technical Implementation Guide2025-12-11

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-11Data Backups
1.00
BCD-11.1Testing for Reliability & Integrity
1.00
BCD-11.5Test Restoration Using Sampling
1.00
BCD-11.6Transfer to Alternate Storage Site
1.00
BCD-13Backup & Restoration Hardware Protection
1.00
BCD-13.1Restoration Integrity Verification
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
CRY-01.1Alternate Physical Protection
1.00
CRY-05Encrypting Data At Rest
1.00

+2 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-6Configuration Settings
1.00
CP-9System Backup
1.00
NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.8.9
1.00
CCI1 mapping
CCI-000539
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
1.00
PR.DS-10
1.00
PR.DS-11
1.00
RC.RP-03
1.00

Who does this work

11 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-271921r1113817_chk)

From the APIC GUI, verify backups are being performed as required: 1. Navigate to Admin >> Import/Export >> Export Policies >> Configuration >> Create Configuration Export Policy. 2. Fill out the rest of the form and click "Submit". If the Cisco ACI is not configured to conduct backups of the configuration weekly or at an organization-defined frequency and stored on a separate device, this is a finding.

Fix Text (F-75878r1063953_fix)

From the APIC GUI, create a remote location where the configuration will be stored: 1. Navigate to Admin >> Import/Export >> Remote Locations >> Create Remote Location. 2. Enable the global AES encryption setting and save the password in a secure location. 3. Fill out the rest of the form and click "Submit". Create a Scheduler policy for weekly backups: 1. Navigate to Admin >> Schedulers >> Fabric >> Create Scheduler >> Create Trigger Scheduler. 2. Fill out the rest of the form and click "Submit". Create a Configuration Export Policy: 1. Navigate to Admin >> Import/Export >> Export Policies >> Configuration >> Create Configuration Export Policy. 2. Fill out the rest of the form and click "Submit".