The layer 2 switch must have all disabled switch ports assigned to an unused VLAN.

From Layer 2 Switch Security Requirements Guide

Associated with: CCI-000366

SV-76691r1_rule The layer 2 switch must have all disabled switch ports assigned to an unused VLAN.

Vulnerability discussion

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

Check content

Review the switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links. If there are any access switch ports not in use and not in an inactive VLAN, this is a finding. Note: Switch ports configured for 802.1x are exempt from this requirement.

Fix text

Assign all switch ports not in use to an inactive VLAN. Note: Switch ports configured for 802.1x are exempt from this requirement.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.