| 1.1 Use a Split-Horizon Architecture | CIS BIND DNS v3.0.1 Authoritative Name Server | Unix | |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - excel.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - groove.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - msaccess.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - mse7.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - mspub.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - onent.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - powerpnt.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.6 Ensure 'Saved from URL' is set to Enabled - pptview.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.17 VCEM-80-000126 | CIS VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 3.1 Ensure a secondary SharePoint site collection administrator has been defined on each site collection. | CIS Microsoft SharePoint 2019 OS v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.8 Ensure 'httpsRequired' is set to 'true' in OIDC Relying Party (RP) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.3.17 Set 'Internet Explorer web browser control' to 'Enabled:Disable' | CIS IE 11 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 10.18 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production | CIS Apache Tomcat 10.1 v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 10.18 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production - context.xml | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 10.18 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production - context.xml | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 10.18 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production - web.xml | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 10.19 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production - web.xml | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 14 - SSL Encryption - Modify WSDL Address | TNS Best Practice JBoss 7 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 14 - SSL Encryption - WSDL Secure Port | TNS Best Practice JBoss 7 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| Disable AutoRepublish | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | ACCESS CONTROL |
| Disable AutoRepublish | MSCT Office 2016 v1.0.0 | Windows | ACCESS CONTROL |
| Disable AutoRepublish | MSCT Office 365 ProPlus 1908 v1.0.0 | Windows | ACCESS CONTROL |
| DTAVSEL-103 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to find unknown macro viruses. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| DTAVSEL-104 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to find potentially unwanted programs. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| DTAVSEL-105 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to scan all file types. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| DTAVSEL-112 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to decode MIME encoded files. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| DTOO117 - Saved from URL mark to assure Internet zone processing must be enforced. | DISA STIG Microsoft OneNote 2016 v2r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXi : set-account-auto-unlock-time | VMWare vSphere 6.0 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-account-auto-unlock-time | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-account-lockout | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-account-lockout | VMWare vSphere 6.0 Hardening Guide | VMware | ACCESS CONTROL |
| F5BI-AP-300002 - The F5 BIG-IP appliance providing intermediary services for remote access communications traffic must ensure inbound and outbound traffic is monitored for compliance with remote access security policies. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | ACCESS CONTROL |
| O365-EX-000021 - AutoRepublish in Excel must be disabled. | DISA Microsoft Office 365 ProPlus STIG v3r5 | Windows | CONFIGURATION MANAGEMENT |
| O365-EX-000022 - AutoRepublish warning alert in Excel must be enabled. | DISA Microsoft Office 365 ProPlus STIG v3r5 | Windows | CONFIGURATION MANAGEMENT |
| PANW-AG-000081 - To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code. | DISA Palo Alto Networks ALG STIG v3r4 | Palo_Alto | ACCESS CONTROL |
| SonicWALL - Password Policy - Affected User types | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SonicWALL - Password Policy - Affected User types - full-admins | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SonicWALL - Password Policy - Affected User types - limited-admins | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SonicWALL - Password Policy - Change Period <=30 days | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SYMP-AG-000180 - Symantec ProxySG must produce audit records containing information to establish the source of the events. | DISA Symantec ProxySG Benchmark ALG v1r3 | BlueCoat | AUDIT AND ACCOUNTABILITY |
| SYMP-AG-000420 - Symantec ProxySG providing user authentication intermediary services using PKI-based user authentication must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network. | DISA Symantec ProxySG Benchmark ALG v1r3 | BlueCoat | IDENTIFICATION AND AUTHENTICATION |
| Syslog - Console Destination - Severity | Tenable Cisco ACI | Cisco_ACI | AUDIT AND ACCOUNTABILITY |
| Syslog Remote Destination - Severity | Tenable Cisco ACI | Cisco_ACI | AUDIT AND ACCOUNTABILITY |
| VCEM-80-000065 - The vCenter ESX Agent Manager service must set URIEncoding to UTF-8. | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCWN-65-000063 - The vCenter Server for Windows must restrict access to cryptographic role. | DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3 | VMware | CONFIGURATION MANAGEMENT |
| vNetwork : reject-mac-changes-dvportgroup | VMWare vSphere 6.0 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| vNetwork : reject-mac-changes-dvportgroup | VMWare vSphere 6.5 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| WatchGuard : SNMP Configuration - v3 user has password - auth protocol | TNS Best Practice WatchGuard Audit 1.0.0 | WatchGuard | ACCESS CONTROL |
| WatchGuard : SNMP Configuration - v3 user has password - priv protocol | TNS Best Practice WatchGuard Audit 1.0.0 | WatchGuard | ACCESS CONTROL |
