| 1.2 Host hardware must enable UEFI Secure Boot | CONFIGURATION MANAGEMENT |
| 1.6 Host integrated hardware management controller must enable time synchronization | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 2.1 Host must run software that has not reached End of General Support status | SYSTEM AND SERVICES ACQUISITION |
| 2.2 Host must have all software updates installed | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.3 Host must enable Secure Boot enforcement | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.4 (Host image profile acceptance level must be PartnerSupported or higher | SYSTEM AND SERVICES ACQUISITION |
| 2.5 Host must only run binaries delivered via signed VIB | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.7 Host must have time synchronization services enabled and running | AUDIT AND ACCOUNTABILITY |
| 2.8 Host must require TPM-based configuration encryption | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.11 Host must use sufficient entropy for cryptographic operations | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 3.22 Host must deny shell access for the dcui account | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 3.25 Host must display a login banner for SSH connections | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 4.3 Host must log sufficient information for events | AUDIT AND ACCOUNTABILITY |
| 4.4 Host must set the logging informational level to info | AUDIT AND ACCOUNTABILITY |
| 4.5 Host must deactivate log filtering | AUDIT AND ACCOUNTABILITY |
| 4.6 Host must enable audit record logging | AUDIT AND ACCOUNTABILITY |
| 4.7 Host must configure a persistent log location for all locally stored audit records | AUDIT AND ACCOUNTABILITY |
| 4.8 Host must store one week of audit records | AUDIT AND ACCOUNTABILITY |
| 4.10 Host must verify certificates for TLS remote logging endpoints | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 4.11 Host must use strict x509 verification for TLS-enabled remote logging endpoints | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.2 Host must block network traffic by default | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.11 Host must isolate management communications | ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY |
| 6.1.1 Host CIM services, if enabled, must limit access | CONFIGURATION MANAGEMENT |
| 6.2.2 Host must ensure all datastores have unique names | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.4.1 Host SNMP services, if enabled, must limit access | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5.1 Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated ciphers | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5.2 Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated cryptographic modules | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5.3 Host SSH daemon, if enabled, must not allow use of gateway ports | CONFIGURATION MANAGEMENT |
| 6.5.4 Host SSH daemon, if enabled, must not allow host-based authentication | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.6 Host SSH daemon, if enabled, must set a timeout interval on idle sessions | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.7 Host SSH daemon, if enabled, must display the system login banner before granting access | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.8 Host SSH daemon, if enabled, must ignore .rhosts files | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.9 Host SSH daemon, if enabled, must disable stream local forwarding | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.10 Host SSH daemon, if enabled, must disable TCP forwarding | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.11 Host SSH daemon, if enabled, must not permit tunnels | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.12 Host SSH daemon, if enabled, must not permit user environment settings | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 7.25 Virtual machines must enable diagnostic logging | AUDIT AND ACCOUNTABILITY |
| CIS_VMware_ESXi_8.0_v1.4.0_L1_Unix.audit from CIS VMware ESXi 8.0 v1.4.0 | |
