| 1.1.1.1 Ensure ext2fs kernel module is not available | CONFIGURATION MANAGEMENT |
| 1.1.1.2 Ensure msdosfs kernel module is not available | CONFIGURATION MANAGEMENT |
| 1.1.1.3 Ensure zfs kernel module is not available | CONFIGURATION MANAGEMENT |
| 1.1.2.1.1 Ensure /tmp is a separate partition | CONFIGURATION MANAGEMENT |
| 1.1.2.1.2 Ensure nosuid option set on /tmp partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.1.3 Ensure noexec option set on /tmp partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.2.2 Ensure nosuid option set on /home partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.3.2 Ensure nosuid option set on /var partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.4.2 Ensure nosuid option set on /var/tmp partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.4.3 Ensure noexec option set on /var/tmp partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.5.2 Ensure nosuid option set on /var/log partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.5.3 Ensure noexec option set on /var/log partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.6.2 Ensure nosuid option set on /var/audit partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.6.3 Ensure noexec option set on /var/audit partition | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.1 Ensure update server certificate key fingerprints are configured | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.2 Ensure package manager repositories are configured | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.3 Ensure updates, patches, and additional security software are installed | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.3.1 Ensure bootloader password is set | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3.2 Ensure permissions on bootloader config are configured | ACCESS CONTROL, MEDIA PROTECTION |
| 1.4.1 Ensure address space layout randomization (ASLR) is enabled | CONFIGURATION MANAGEMENT |
| 1.4.2 Ensure core dump backtraces are disabled | CONFIGURATION MANAGEMENT |
| 1.4.3 Ensure core dump storage is disabled | CONFIGURATION MANAGEMENT |
| 1.6.1 Ensure message of the day is configured properly | CONFIGURATION MANAGEMENT |
| 1.6.2 Ensure local login warning banner is configured properly | CONFIGURATION MANAGEMENT |
| 1.6.3 Ensure remote login warning banner is configured properly | CONFIGURATION MANAGEMENT |
| 1.6.4 Ensure access to /etc/motd is configured | ACCESS CONTROL, MEDIA PROTECTION |
| 1.6.5 Ensure access to /etc/issue is configured | ACCESS CONTROL, MEDIA PROTECTION |
| 2.1.1 Ensure time synchronization is in use | AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure autofs services are not in use | MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.2.2 Ensure ftp server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.3 Ensure message access server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.4 Ensure network file system services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.5 Ensure nis server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.6 Ensure rpcbind services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.7 Ensure snmp services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.8 Ensure telnet server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.9 Ensure tftp server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.10 Ensure web proxy server services are not in use | CONFIGURATION MANAGEMENT |
| 2.2.11 Ensure mail transfer agents are configured for local-only mode | CONFIGURATION MANAGEMENT |
| 2.2.12 Ensure only approved services are listening on a network interface | CONFIGURATION MANAGEMENT |
| 3.1.1 Ensure IPv6 status is identified | CONFIGURATION MANAGEMENT |
| 3.3.1 Ensure ip forwarding is disabled | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.2 Ensure packet redirect sending is disabled | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.3 Ensure broadcast & multicast icmp requests are ignored | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.4 Ensure icmp redirects are not accepted | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.5 Ensure source routed packets are not accepted | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.6 Ensure tcp syn cookies is enabled | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.7 Ensure ipv6 router advertisements are not accepted | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.4.1.1 Ensure ipfw is enabled and configured | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4.1.2 Ensure a single firewall utility is in use | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
