DISA STIG Router Compliance: A Practical Guide for Network Admins
DISA STIGs are the most rigorous security configuration standards in existence for network devices. Whether you manage DoD infrastructure or simply want a battle-tested hardening reference, this guide explains exactly what the Cisco router STIGs require — and how to get compliant.
What Is a DISA STIG?
A STIG — Security Technical Implementation Guide — is a mandatory configuration standard published by the Defense Information Systems Agency (DISA). STIGs exist for hundreds of technology products, from Windows servers to databases to network devices. The Cisco IOS Router STIG and the Cisco IOS-XE Router STIG define the specific security settings required for Cisco routers deployed on US Department of Defense networks.
Unlike general best-practice guides, STIGs are non-negotiable in DoD environments. Every device must be assessed against its applicable STIG before it can receive an Authorization to Operate (ATO). Unresolved CAT I findings block authorization entirely. CAT II and CAT III findings may be accepted with a formal Plan of Action and Milestones (POA&M) if mitigation is impractical.
DISA releases updated STIGs periodically. The Cisco IOS Router STIG is organized into rules identified by V-IDs (Vulnerability IDs) and SV-IDs (Security Vulnerability IDs). When performing a STIG assessment, you document each rule as Open (finding), Not a Finding, or Not Applicable.
CAT I, II, III — Severity Explained
Every STIG rule is assigned a Category (CAT) level that reflects the severity of the vulnerability if the control is not implemented. The category determines how urgently a finding must be remediated.
| Category | Severity | Impact | ATO Impact |
|---|---|---|---|
| CAT I | Critical | Direct path to compromise — remote code execution, full device takeover, credential exposure | Blocks ATO. Must be fixed or accepted with very high-level approval. |
| CAT II | High | Significant risk — enables privilege escalation, lateral movement, or data exposure | POA&M required if not fixed. Must have mitigation timeline. |
| CAT III | Medium/Low | Degrades defense-in-depth — missing logging, weak banners, suboptimal configuration | POA&M acceptable. Lower urgency but still tracked. |
Important: In non-DoD environments, there is no formal ATO process, but the CAT severity ratings are still useful for prioritizing remediation. Fix CAT I findings immediately, plan CAT II within 30 days, and schedule CAT III during normal maintenance cycles.
Critical CAT I Findings Every Admin Must Fix
The following are among the most commonly encountered CAT I findings on Cisco IOS routers during STIG assessments. Each finding, if left unresolved, represents a critical security gap.
Telnet Enabled on VTY Lines
If VTY lines allow Telnet, passwords and session content are transmitted in cleartext. An attacker with access to the network path can capture administrative credentials trivially.
line vty 0 4
transport input ssh
transport output sshVerify: show running-config | section vty — no “transport input telnet” should appear
No Enable Secret Configured
Without an enable secret, or with only a weak enable password, the privileged EXEC mode is either unprotected or protected by reversible encryption. An attacker who obtains the configuration file can immediately recover the credential.
enable secret [strong-passphrase]
no enable passwordSNMP Community Strings Set to Default
Default SNMP community strings (“public” and “private”) are known to every attacker. SNMP read access exposes the entire running configuration. SNMP write access allows configuration modification.
no snmp-server community public
no snmp-server community private
snmp-server community [complex-string] RO [ACL-NUMBER]AAA Not Configured
Without AAA, all authentication is local and there is no centralized audit trail of who logged in, what commands they ran, or when. This is both a critical security control and a compliance requirement for most frameworks.
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa accounting exec default start-stop group tacacs+Scan Your Config for STIG Findings
Paste your Cisco IOS or IOS-XE running configuration and identify CAT I, II, and III findings instantly. Free, browser-based, nothing stored.
Run Free STIG Audit →High-Priority CAT II Findings
CAT II findings are not instant dealbreakers, but they represent significant risk that must be addressed. The following are the most common CAT II findings on Cisco routers.
No Login Banner Configured
A legal warning banner is required before any login prompt. Without it, unauthorized access may be harder to prosecute. The banner must explicitly state that access is restricted to authorized users only.
banner login ^
WARNING: This system is restricted to authorized users only.
All activity is monitored and subject to audit.
Unauthorized access is a violation of federal law.
^Logging Not Configured or Insufficiently Detailed
STIG requires logging to a remote syslog server at informational severity with timestamps. Local-only logging with no timestamps makes post-incident forensics difficult or impossible.
service timestamps log datetime msec show-timezone localtime
logging buffered 65536
logging host [SYSLOG-SERVER-IP]
logging trap informationalUnnecessary Services Not Disabled
Services like CDP, IP directed broadcasts, proxy ARP, and the HTTP server are enabled by default in IOS and create unnecessary attack surface. The STIG requires explicit disabling of all unused services.
no ip directed-broadcast
no ip proxy-arp
no ip redirects
no ip unreachables
no cdp run
no ip http server
no ip http secure-serverNTP Not Authenticated
Unauthenticated NTP allows an attacker to manipulate the router’s clock. This can falsify log timestamps, break Kerberos authentication, and cause certificate validation failures.
ntp authenticate
ntp authentication-key 1 md5 [strong-key]
ntp trusted-key 1
ntp server [NTP-SERVER-IP] key 1The ATO Process and STIGs
In DoD environments, every system requires an Authorization to Operate before it can be deployed or continue operating. The ATO process under the Risk Management Framework (RMF) requires a STIG assessment as part of the system assessment phase. Network administrators must run a STIG checklist against each router and document results in the eMASS system.
CAT I findings must be resolved or receive a formal exception with Authorizing Official approval — in practice, exceptions for CAT I network device findings are rarely granted. CAT II and CAT III findings can be accepted with a documented POA&M that commits to a remediation timeline.
For organizations outside DoD, the same basic principle applies: document your findings, prioritize by severity, remediate in order, and re-assess after changes. This documentation is what auditors look for when verifying your security posture.
Using STIGs on Non-DoD Networks
DISA STIGs are publicly available and widely used outside of DoD environments. Many federal civilian agencies, contractors, and private-sector organizations adopt STIG requirements voluntarily for several reasons.
First, STIGs are among the most thoroughly researched security configuration standards available. They reflect years of DoD operational experience and are updated regularly. Second, STIGs map well to other compliance frameworks — PCI DSS, NIST SP 800-53, and ISO 27001 controls are addressed by STIG requirements. Third, STIG documentation provides ready-made audit evidence: if you can show a completed STIG checklist with all findings resolved, that goes a long way with any auditor.
If you manage Cisco routers and are not subject to DoD requirements, using the STIG as a hardening reference still makes sense. It is more specific and operationally tested than most vendor hardening guides and covers security gaps that generic recommendations often miss.
Frequently Asked Questions
Ready to Audit Your Router?
Free. No login. No data sent to any server. Works on Cisco IOS and IOS-XE.
Run Your Free Audit Now →