| 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware | SYSTEM AND SERVICES ACQUISITION |
| 1.3 Host hardware must enable Intel TXT, if available | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.4 Host hardware must enable and configure a TPM 2.0 | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.5 Host integrated hardware management controller must be secure | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.7 Host integrated hardware management controller must enable remote logging of events | AUDIT AND ACCOUNTABILITY |
| 2.6 Host must have reliable time synchronization sources | AUDIT AND ACCOUNTABILITY |
| 2.9 Host must not suppress warnings about unmitigated hyperthreading vulnerabilities | AUDIT AND ACCOUNTABILITY |
| 2.10 Host must restrict inter-VM transparent page sharing | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.1 Host should deactivate SSH | CONFIGURATION MANAGEMENT |
| 3.2 Host must deactivate the ESXi shell | CONFIGURATION MANAGEMENT |
| 3.3 Host must deactivate the ESXi Managed Object Browser (MOB) | ACCESS CONTROL, MEDIA PROTECTION |
| 3.4 Host must deactivate SLP | CONFIGURATION MANAGEMENT |
| 3.5 Host must deactivate CIM | CONFIGURATION MANAGEMENT |
| 3.6 Host should deactivate SNMP | CONFIGURATION MANAGEMENT |
| 3.7 Host must automatically terminate idle DCUI sessions | ACCESS CONTROL |
| 3.8 Host must automatically terminate idle shells | ACCESS CONTROL |
| 3.9 Host must automatically deactivate shell services | ACCESS CONTROL |
| 3.10 Host must not suppress warnings that the shell is enabled | SYSTEM AND INFORMATION INTEGRITY |
| 3.11 Host must enforce password complexity | IDENTIFICATION AND AUTHENTICATION |
| 3.12 Host must lock an account after a specified number of failed login attempts | ACCESS CONTROL |
| 3.13 Host must unlock accounts after a specified timeout period | ACCESS CONTROL |
| 3.14 Host must configure the password history setting to restrict the reuse of passwords | IDENTIFICATION AND AUTHENTICATION |
| 3.15 Host must be configured with an appropriate maximum password age | IDENTIFICATION AND AUTHENTICATION |
| 3.16 Host must configure a session timeout for the API | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.17 Host must automatically terminate idle host client sessions | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.18 Host must have an accurate DCUI.Access list | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.19 Host must have an accurate Exception Users list | ACCESS CONTROL, MEDIA PROTECTION |
| 3.20 Host must enable lockdown mode | ACCESS CONTROL |
| 3.24 Host must display a login banner for the DCUI and Host Client | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 3.26 Host must enable the highest version of TLS supported | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1 Host must configure a persistent log location for all locally stored system logs | AUDIT AND ACCOUNTABILITY |
| 4.2 Host must transmit system logs to a remote log collector | AUDIT AND ACCOUNTABILITY |
| 4.3 Host must log sufficient information for events | AUDIT AND ACCOUNTABILITY |
| 4.9 Host must transmit audit records to a remote log collector | AUDIT AND ACCOUNTABILITY |
| 5.1 Host firewall must only allow traffic from authorized networks | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.3 Host must restrict use of the dvFilter network API | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4 Host must filter Bridge Protocol Data Unit (BPDU) packets | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6 Host should reject forged transmits on standard virtual switches and port groups | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7 Host should reject MAC address changes on standard virtual switches and port groups | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.8 Host should reject promiscuous mode requests on standard virtual switches and port groups | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9 Host must restrict access to a default or native VLAN on standard virtual switches | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10 Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.1 Host must isolate storage communications | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.1 Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.2 Host iSCSI client, if enabled, must employ unique CHAP authentication secrets | IDENTIFICATION AND AUTHENTICATION |
| 7.2 Virtual machines must require encryption for vMotion | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 Virtual machines must require encryption for Fault Tolerance | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.5 Virtual machines must be configured to lock when the last console connection is closed | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.6 Virtual machines must limit console sharing. | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.7 Virtual machines must limit PCI/PCIe device passthrough functionality | CONFIGURATION MANAGEMENT |
