Security certifications compliance recommendations

Cisco recommends that you observe the following best practices when using a system with security certifications compliance enabled:

  • For all users, enable password strength checking and set the minimum password length to the value required by the certifying agency.

  • When you configure Firewall Threat Defense on a Firepower 4100/9300 to operate in CC or UCAPL mode, you should also configure the Firepower 4100/9300 to operate in CC mode. For more information, see the Cisco Firepower 4100/9300 FXOS Chassis Manager Configuration Guide.

Do not configure the system to use these features:

  • Email reports, alerts, or data pruning notifications.

  • Nmap Scan, Cisco IOS Null Route, Set Attribute Value, or ISE EPS remediations.

  • Third-party client access to the system database.

  • External notifications or alerts transmitted via email (SMTP), SNMP trap, or syslog.

  • Audit log messages transmitted to an HTTP server or to a syslog server without using SSL certificates to secure the channel between the appliance and the server.

Configure authentication and access settings appropriately for your security certifications compliance mode.

  • Do not enable external authentication using LDAP or RADIUS in deployments using CC mode.

  • Do not enable CACs in deployments using CC mode.

  • Disable access to the Cloud-Delivered Firewall Management Center FedRAMP tenant using the REST APIs.

  • Disable access to the managed devices via the Secure Firewall REST API in deployments using CC or UCAPL mode.

  • Enable CACs in deployments using UCAPL mode.

  • Do not configure SSO in deployments using CC mode.

The system does not support CC or UCAPL mode for:

  • Firewall Threat Defense clustering is not supported in UCAPL mode. CC mode clustering is supported only on certain releases of Firewall Threat Defense, and every cluster member must use the same compliance mode.

  • Firewall Threat Defense container instances on the Firepower 4100/9300.

  • Exporting event data to an external client using eStreamer.