Security certifications compliance characteristics

Enabling CC or UCAPL modes result in certain changes to system behaviors and compliance characteristics on the managed devices. Restrictions on login accounts apply to command line access. These restrictions do not apply to web interface access.

Cloud-Delivered Firewall Management Center

Cloud-Delivered Firewall Management Center for a FedRAMP tenant has these behaviour and compliance characteristics:

Applicable FIPS-mode cryptographic controls and startup self-tests are enabled.
The system does not allow remote storage for backups or reports.
The admin user is locked out after a maximum number of failed login attempts configurable through the web interface.
The system automatically rekeys an SSH session with an appliance:
- After a key has been in use for one hour of session activity.
- After a key has been used to transmit 1 GB of data over the connection.
The system performs a file system integrity check (FSIC) at boot-time and reports FSIC failures.

Managed Devices


System Change	Classic Managed Devices		Secure Firewall Threat Defense
System Change	CC Mode	UCAPL Mode	CC Mode	UCAPL Mode
Applicable FIPS-mode cryptographic controls and startup self-tests are enabled.	Yes	Yes	Yes	Yes
The system does not allow remote storage for backups or reports.	Not applicable	Not applicable	Not applicable	Not applicable
The system starts an additional system audit daemon.	No	Yes	No	No
The system boot loader is secured.	No	Yes	No	No
The system applies additional security to login accounts.	No	Yes	No	No
The system disables the reboot key sequence Ctrl+Alt+Del.	No	Yes	No	No
The system limits the number of simultaneous command-line login sessions allowed for each user account.	No	No	No	No
Passwords must be at least 14 characters long, and must consist of alphanumeric characters of mixed case and must include at least one numeric character and one non-alphanumeric character.	No	Yes	No	No
The minimum required password length for the local `admin` user can be configured using the local device CLI.	No	No	Yes	Yes
Passwords cannot be a word that appears in a dictionary nor include more than two consecutive occurrences of the same character.	No	Yes	No	No
The system locks out users other than `admin` after three failed login attempts in a row. In this case, the password must be reset by an administrator.	No	Yes	No	No
The system stores password history by default.	No	Yes	No	No
The `admin` user can be locked out after a maximum number of failed login attempts configurable through the web interface.	Yes	Yes	—	—
The `admin` user can be locked out after a maximum number of failed login attempts configurable through the local appliance CLI.	Yes, regardless of security certifications compliance enablement.	Yes, regardless of security certifications compliance enablement.	Yes	Yes
The system automatically rekeys an SSH session with an appliance: After a key has been in use for one hour of session activity After a key has been used to transmit 1 GB of data over the connection	Yes	Yes	Yes	Yes
The system performs a file system integrity check (FSIC) at boot-time. If the FSIC fails, Secure Firewall software does not start, remote SSH access is disabled, and you can access the appliance only via local console. If this happens, contact Cisco TAC.	Yes	Yes	Yes	Yes