| 1.3 Verify no unauthorized kernel modules are loaded on the host | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | |
| 1.6 Support Web Access Security - b) ssl-context field | Tenable ZTE ROSNG Best Practices | ZTE_ROSNG | |
| 1.19 IBMW-LS-000720 | CIS IBM WebSphere Liberty Server STIG v1.0.0 CAT II | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 2.1 Do not use lxc execution driver | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.1.11 Ensure comprehensive attachment filtering is applied | CIS Microsoft 365 Foundations v7.0.0 L2 E5 | microsoft_azure | SYSTEM AND INFORMATION INTEGRITY |
| 2.2 Configure sendmail Service for Local-Only Mode | CIS Solaris 11 L1 v1.1.0 | Unix | |
| 2.2 Configure sendmail Service for Local-Only Mode | CIS Solaris 11.1 L1 v1.0.0 | Unix | |
| 2.2.21 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account and member of Administrators group' (MS only) | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.21 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account and member of Administrators group' (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.22 (L1) Ensure 'Deny access to this computer from the network' to include 'Guests, Local account and member of Administrators group' (MS only) | CIS Microsoft Windows Server 2016 v4.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.4 Only enable rlogin/rsh/rcp if absolutely necessary (login) | CIS FreeBSD v1.0.5 | Unix | CONFIGURATION MANAGEMENT |
| 2.4.5 Disable Remote Login | CIS Apple macOS 10.13 L1 v1.1.0 | Unix | ACCESS CONTROL |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely | CIS IIS 8.0 v1.5.1 Level 1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 5.1.7 Ensure sshd Ciphers are configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.7 Ensure sshd Ciphers are configured | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.7 Ensure sshd Ciphers are configured | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.7 Ensure sshd Ciphers are configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Workstation | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.34 (L1) Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | CONFIGURATION MANAGEMENT |
| 5.37 Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled' | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 6.1.8 Ensure the 'SYNONYM' Audit Option Is Enabled | CIS Oracle Server 12c DB Traditional Auditing v3.0.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 7.2.3 Ensure that port groups are not configured to VLAN values reserved by upstream physical switches | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | |
| 18.9.24.1 (L1) Ensure 'EMET 5.52' or higher is installed | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| ARBA-VN-002430 - AOS, when used as a VPN Gateway, must not accept certificates that have been revoked when using PKI for authentication. | DISA HPE Aruba Networking AOS VPN STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| DB2X-00-003300 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to DB2, etc.) must be restricted to authorized users - s used to modify database structure and logic modules must be restricted to authorized users. | DISA STIG IBM DB2 v10.5 LUW v2r1 Database | IBM_DB2DB | CONFIGURATION MANAGEMENT |
| Ensure 'HTTP source restriction' is set to an authorized IP address | Tenable Cisco Firepower Threat Defense Best Practices Audit | Cisco_Firepower | ACCESS CONTROL |
| ESXi : audit-exception-users | VMWare vSphere 6.0 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : config-persistent-logs | VMWare vSphere 6.5 Hardening Guide | VMware | AUDIT AND ACCOUNTABILITY |
| ESXi : config-persistent-logs | VMWare vSphere 6.0 Hardening Guide | VMware | AUDIT AND ACCOUNTABILITY |
| Huawei: HTTPS Server is configured | TNS Huawei VRP Best Practice Audit | Huawei | CONFIGURATION MANAGEMENT |
| Huawei: HTTPS Server is not configured | TNS Huawei VRP Best Practice Audit | Huawei | CONFIGURATION MANAGEMENT |
| Install a trusted CA certificate on the pool | TNS Citrix Hypervisor | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled. | DISA STIG MongoDB Enterprise Advanced 3.x v2r3 OS | Unix | CONFIGURATION MANAGEMENT |
| MD4X-00-002600 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled. | DISA STIG MongoDB Enterprise Advanced 4.x v1r4 OS | Unix | CONFIGURATION MANAGEMENT |
| O121-C2-006900 - The DBMS must allow designated organizational personnel to select which auditable events are to be audited by the database. | DISA Oracle Database 12c STIG v3r5 OracleDB | OracleDB | AUDIT AND ACCOUNTABILITY |
| SYMP-AG-000540 - Symantec ProxySG must block outbound traffic containing known and unknown denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints. | DISA Symantec ProxySG Benchmark ALG v1r3 | BlueCoat | SYSTEM AND COMMUNICATIONS PROTECTION |
| SYMP-NM-000230 - Symantec ProxySG must implement HTTPS-console to provide replay-resistant authentication mechanisms for network access to privileged accounts. - HTTP-Console | DISA Symantec ProxySG Benchmark NDM v1r2 | BlueCoat | IDENTIFICATION AND AUTHENTICATION |
| SYMP-NM-000230 - Symantec ProxySG must implement HTTPS-console to provide replay-resistant authentication mechanisms for network access to privileged accounts. - HTTPS-Console | DISA Symantec ProxySG Benchmark NDM v1r2 | BlueCoat | IDENTIFICATION AND AUTHENTICATION |
| SYMP-NM-000260 - Symantec ProxySG must transmit only encrypted representations of passwords. | DISA Symantec ProxySG Benchmark NDM v1r2 | BlueCoat | IDENTIFICATION AND AUTHENTICATION |
| VM : disable-console-copy | VMWare vSphere 6.0 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : disable-console-copy | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : disable-console-paste | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : disable-console-paste | VMWare vSphere 6.0 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : limit-setinfo-size | VMWare vSphere 6.0 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| vNetwork : restrict-port-level-overrides | VMWare vSphere 6.5 Hardening Guide | VMware | |
| vNetwork : restrict-port-level-overrides | VMWare vSphere 6.0 Hardening Guide | VMware | |
| vNetwork : verify-dvfilter-bind | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| XenServer - Install a trusted CA certificate on the pool | TNS Citrix XenServer | Unix | |
