OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ISE must enforce posture status assessment for posture required clients defined in the NAC System Security Plan (SSP). This is required for compliance with C2C Step 3.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-242605CSCO-NC-000310SV-242605r944370_ruleCCI-000366high
Description
Posture assessments can reduce the risk that clients impose on networks by restricting or preventing access of noncompliant clients. If the posture assessment is not enforced, then access of clients not complying is not restricted allowing the risk of vulnerabilities being exposed. Though the configuration is out of scope, one of the ways to allow posturing with Cisco AnyConnect Secure Mobility Client is to enable http redirect on the network switch so that AnyConnect can connect to ISE's Client Provisioning Portal (call home). Every effort must be taken to configure this function without the need to require the command 'ip http server' on the switch (see V-220534 in the Network Infrastructure STIG). If deemed operationally necessary, the site must obtain AO approval and document the variation from V-220534, risk mitigations, and the mission need that makes the service necessary. If the service is operationally necessary to meet C2C compliance for posture assessment and a vendor-provided alternative is not available, then it is, by definition, a necessary service. Thus, V-220534 is not a finding as it states that "If a particular capability is used, then it must be documented and approved."
STIGDate
Cisco ISE NAC Security Technical Implementation Guide2026-06-03

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-000366
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-242605r944370_chk)

If DOD is not at C2C Step 3 or higher, this is not a finding. If not required by the NAC SSP, this is not a finding. Verify the authorization policy will enforce posture assessment status for posture required clients. 1. Navigate to Work Centers >> Network Access >> Policy Sets. 2. Choose ">" on the applicable policy set. 3. Expand the Authorization Policy. 4. Verify that a rule with the condition "Session-PostureStatus EQUALS NonCompliant" is present and will apply to posture required devices by analyzing other conditions used on the same policy. 5. Ensure the result that is used for remediation access is a restricted VLAN, ACL, SGT, or any combination used to restrict the access. If there is not an authorization policy for NonCompliant clients that are posture required, this is a finding. If the authorization policy does not restrict the access of NonCompliant clients that are posture required, this is a finding.

Fix Text (F-45837r803568_fix)

If required by the NAC SSP, configure the authorization policy to enforce posture assessment status for posture required clients. 1. Edit the Policy Set to enforce the posture assessment. 2. Navigate to Work Centers >> Network Access >> Policy Sets. 3. Choose ">" on the applicable policy set. 4. Expand the Authorization Policy. 5. Click on Actions Gear below to location where the new Authorization Policy will be inserted. 6. Choose "Insert new role above", or if there is an Authorization Policy made for the device type that posture will be applied to, choose "Duplicate above". 7. Click on the name of the policy and define a desirable name. 8 Either click on the "+" icon or click on the existing Conditions to open the Conditions Studio. 9. Choose "New" under the editor. 10. Choose "Click to add an attribute". 11. Under Dictionary, select "Session" in the drop-down menu. 12. Under Attribute, select "PostureStatus". 13. Ensure "Equals" is selected as the operator. 14. Select "Compliant" in the drop-down menu. 15. Choose "New". 16. Add a condition to flag the device type that should be postured. 17. Choose "Use". 18. Name the rule accordingly. 19. Select the desired result. 20. Click on Actions Gear on the Authorization Policy just created. 21. Select Duplicate below in the drop-down. 22. Click on the conditions of the copy. 23. Change the PostureStatus variable form "Compliant" to "NonCompliant". 24. Choose "Use". 25. Name the rule accordingly. 26. Select a result that is used for remediation access, which should be a result that is configured for a restricted VLAN, ACL, SGT, or any combination used to restrict the access. 27. Choose "Save".