Network Device Management Security Requirements Guide

Version: 5

Updated: 08 Jan 2026

Findings: 105

Findings

V-202006 - The network device must conceal, via the session lock, information previously visible on the display with a publicly viewable image. (medium)
V-202007 - The network device must initiate a session lock after a 15-minute period of inactivity. (medium)
V-202008 - The network device must be configured to enable network administrators to directly initiate a session lock. (medium)
V-202009 - The network device must retain the session lock until the administrator reestablishes access using established identification and authentication procedures. (medium)
V-202013 - The network device must automatically audit account creation. (medium)
V-202014 - The network device must automatically audit account modification. (medium)
V-202015 - The network device must automatically audit account disabling actions. (medium)
V-202016 - The network device must automatically audit account removal actions. (medium)
V-202017 - The network device must be configured to assign appropriate user roles or access levels to authenticated users. (high)
V-202018 - The network device must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies. (medium)
V-202019 - The network device must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. (medium)
V-202020 - The network device must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. (medium)
V-202021 - The network device must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access. (medium)
V-202025 - The network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. (medium)
V-202028 - The network device must generate audit records when successful/unsuccessful attempts to access privileges occur. (medium)
V-202029 - The network device must initiate session auditing upon startup. (medium)
V-202030 - The network device must produce audit log records containing sufficient information to establish what type of event occurred. (medium)
V-202031 - The network device must produce audit records containing information to establish when (date and time) the events occurred. (medium)
V-202032 - The network device must produce audit records containing information to establish where the events occurred. (medium)
V-202033 - The network device must produce audit log records containing information to establish the source of events. (medium)
V-202034 - The network device must produce audit records that contain information to establish the outcome of the event. (medium)
V-202035 - The network device must generate audit records containing information that establishes the identity of any individual or process associated with the event. (medium)
V-202036 - The network device must generate audit records containing the full-text recording of privileged commands. (medium)
V-202039 - The network device must use internal system clocks to generate time stamps for audit records. (medium)
V-202040 - The network device must protect audit information from unauthorized modification. (medium)
V-202041 - The network device must protect audit information from unauthorized deletion. (medium)
V-202042 - The network device must protect audit tools from unauthorized access. (medium)
V-202043 - The network device must protect audit tools from unauthorized modification. (medium)
V-202044 - The network device must protect audit tools from unauthorized deletion. (medium)
V-202047 - The network device must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. (medium)
V-202048 - The network device must limit privileges to change the software resident within software libraries. (medium)
V-202049 - The network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services (high)
V-202051 - The network device must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. (medium)
V-202054 - The network device must be configured to authenticate each administrator prior to authorizing privileges based on assignment of group or role. (medium)
V-202055 - The network device must implement replay-resistant authentication mechanisms for network access to privileged accounts. (medium)
V-202057 - The network device must enforce a minimum 15-character password length. (medium)
V-202059 - The network device must enforce password complexity by requiring that at least one uppercase character be used. (medium)
V-202060 - The network device must enforce password complexity by requiring that at least one lowercase character be used. (medium)
V-202061 - The network device must enforce password complexity by requiring that at least one numeric character be used. (medium)
V-202062 - The network device must enforce password complexity by requiring that at least one special character be used. (medium)
V-202063 - The network device must require that when a password is changed, the characters are changed in at least eight of the positions within the password. (medium)
V-202064 - The network device must be configured to store passwords using an approved salted key derivation function, preferably using a keyed hash for password-based authentication. (high)
V-202065 - The network device must transmit only encrypted representations of passwords. (high)
V-202071 - The network device must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. (high)
V-202072 - The network device must use FIPS 140-2 approved algorithms for authentication to a cryptographic module. (high)
V-202074 - The network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements. (high)
V-202075 - The network device must invalidate session identifiers upon administrator logout or other session termination. (medium)
V-202076 - The network device must recognize only system-generated session identifiers. (medium)
V-202077 - The network device must generate unique session identifiers using a FIPS 140-2 approved random number generator. (medium)
V-202078 - The network device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive). (high)
V-202085 - The network device must be configured to provide a logout mechanism for administrator-initiated communication sessions. (medium)
V-202086 - The network device must display an explicit logout message to administrators indicating the reliable termination of authenticated communications sessions. (medium)
V-202087 - The network device must terminate shared/group account credentials when members leave the group. (medium)
V-202088 - The network device must automatically audit account enabling actions. (medium)
V-202091 - If the network device uses discretionary access control, the network device must enforce organization-defined discretionary access control policies over defined subjects and objects. (medium)
V-202092 - If the network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects. (medium)
V-202093 - The network device must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (high)
V-202094 - The network device must audit the execution of privileged functions. (medium)
V-202098 - The network device must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. (medium)
V-202100 - The network device must generate an immediate real-time alert of all audit failure events requiring real-time alerts. (medium)
V-202102 - The network device must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). (medium)
V-202103 - The network device must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision. (medium)
V-202105 - The network device must prohibit installation of software without explicit privileged status. (medium)
V-202106 - The network device must enforce access restrictions associated with changes to device configuration. (medium)
V-202107 - The network device must audit the enforcement actions used to restrict access associated with changes to the device. (medium)
V-202111 - The network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). (medium)
V-202112 - The network device must authenticate Network Time Protocol sources using authentication that is cryptographically based. (medium)
V-202115 - The network device must prohibit the use of cached authenticators after an organization-defined time period. (medium)
V-202116 - Network devices performing maintenance functions must restrict use of these functions to authorized personnel only. (medium)
V-202117 - The network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications. (high)
V-202118 - The network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions (high)
V-202119 - The network device must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards. (medium)
V-202120 - If the network device uses mandatory access control, the network device must enforce organization-defined mandatory access control policies over all subjects and objects. (medium)
V-202121 - The network device must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur. (medium)
V-202122 - The network device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur. (medium)
V-202123 - The network device must generate audit records when successful/unsuccessful logon attempts occur. (medium)
V-202124 - The network device must generate audit records for privileged activities or other system-level access. (medium)
V-202125 - The network device must generate audit records showing starting and ending time for administrator access to the system. (medium)
V-202126 - The network device must generate audit records when concurrent logons from different workstations occur. (medium)
V-202127 - The network device must off-load audit records onto a different system or media than the system being audited. (medium)
V-202130 - The network device must generate log records for a locally developed list of auditable events (medium)
V-202131 - The network device must enforce access restrictions associated with changes to the system components. (medium)
V-202132 - The network device must be configured to use at least one authentication server for the purpose of authenticating users prior to granting administrative access. For boundary devices, two authentication servers are required. (high)
V-202136 - The network device must be configured to conduct backups of system level information contained in the information system when changes occur. (medium)
V-202137 - The network device must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner. (medium)
V-202139 - The network device must obtain its public key certificates from an appropriate certificate policy through an approved service provider. (medium)
V-202140 - The network device must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type. (medium)
V-213467 - The network device must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required. (high)
V-213468 - The network device must be running an operating system release that is currently supported by the vendor. (high)
V-216508 - The network device must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. (medium)
V-237779 - The network device must be configured to use DoD PKI as multi-factor authentication (MFA) for interactive logins. (high)
V-237780 - The network device must be configured to use DoD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication. (high)
V-237781 - The network device, for PKI-based authentication, must be configured to map validated certificates to unique user accounts. (high)
V-256777 - The network device must install security-relevant firmware updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). (medium)
V-264293 - The network device must be configured to alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information. (medium)
V-264294 - The network device must be configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. (medium)
V-264295 - The network device must be configured to implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements. (medium)
V-264299 - The network device must be configured to verify, when users create or update passwords, the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-5 (1) (a) for password-based authentication. (medium)
V-264301 - The network device must be configured to allow user selection of long passwords and passphrases, including spaces and all printable characters for password-based authentication. (medium)
V-264303 - The network device must be configured to implement certificate revocation checking to support path discovery and validation for public key-based authentication. (medium)
V-264304 - The network device must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths. (medium)
V-264305 - The network device must be configured to include only approved trust anchors in trust stores or certificate stores managed by the organization. (medium)
V-264307 - The network device must be configured to synchronize system clocks within and between systems or system components. (medium)
V-264308 - The network device must be configured to compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source. (medium)
V-278996 - The network device must be a version supported by the vendor. (high)