| 1.1 Use a Split-Horizon Architecture | CIS BIND DNS v3.0.1 Authoritative Name Server | Unix | |
| 1.1.42 (L1) Ensure 'Password Manager' is set to 'Disabled' | CIS Mozilla Firefox ESR GPO v1.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 1.4.10 (L1) Ensure 'Default geolocation setting' is set to 'Enabled: Don't allow any site to track users' physical location' | CIS Microsoft Intune for Edge v1.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 1.5 Ensure that VDS Netflow traffic is only being sent to authorized collector IP Addresses | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | |
| 1.17 VCEM-80-000126 | CIS VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.21.1 (L1) Ensure 'Enable saving passwords to the password manager' is set to 'Disabled' | CIS Microsoft Intune for Edge v1.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 1.22.2 Ensure 'Enable saving passwords to the password manager' is set to 'Disabled' | CIS Microsoft Edge v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 1.63 (L2) Ensure 'Block third party cookies' is set to 'Enabled' | CIS Microsoft Intune for Edge v1.0.0 L2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.80 O19C-00-016800 | CIS Oracle Database 19c STIG v1.1.0 CAT I OracleDB | OracleDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.37.3.1 Ensure 'Open Office documents as read/write while browsing' is set to 'Disabled' | CIS Microsoft Office Enterprise v1.2.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.1 (L2) Ensure 'Control use of the Serial API' is set to 'Enabled: Do not allow any site to request access to serial ports via the Serial API' | CIS Google Chrome L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.2.13 Ensure SSH LoginGraceTime is set to one minute or less | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 6.5 Disable Geolocation Serivces | CIS Mozilla Firefox 102 ESR Windows L1 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 6.7 Ensure 'http.conduit.tlsClientParameters.disableCNCheck' is set to 'false' to enable hostname verification for JAX-WS applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.3 Ensure All Default Apache Content Is Removed | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.3.17 Set 'Internet Explorer web browser control' to 'Enabled:Disable' | CIS IE 11 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 12.1 Ensure the AppArmor Framework Is Enabled | CIS Apache HTTP Server 2.2 L2 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 12.1 Ensure the AppArmor Framework Is Enabled | CIS Apache HTTP Server 2.2 L2 v3.6.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| AS24-W1-000740 - The Apache web server must use a logging mechanism that is configured to provide a warning to the Information System Security Officer (ISSO) and System Administrator (SA) when allocated record storage volume reaches 75 percent of maximum log record storage capacity - SA when allocated record storage volume reaches 75% of maximum log record storage capacity. | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| DTAVSEL-000 - The McAfee VirusScan Enterprise for Linux Web interface must be disabled unless the system is on a segregated network. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | CONFIGURATION MANAGEMENT |
| DTAVSEL-301 - Access to the McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x Web UI must be enforced by firewall rules. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Local Client v1r6 | Unix | CONFIGURATION MANAGEMENT |
| DTOO140 - Automatic republish to web pages must be disallowed. | DISA STIG Microsoft Excel 2013 v1r8 | Windows | CONFIGURATION MANAGEMENT |
| DTOO274 - Outlook - Internet with Safe Zones for Picture Download must be disabled. | DISA Microsoft Outlook 2010 STIG v1r14 | Windows | CONFIGURATION MANAGEMENT |
| DTOO275 - Intranet with Safe Zones for automatic picture downloads must be configured. | DISA STIG Microsoft Outlook 2013 v1r14 | Windows | CONFIGURATION MANAGEMENT |
| DTOO275 - Outlook - Intranet with Safe Zones for automatic picture downloads must be configured. | DISA Microsoft Outlook 2010 STIG v1r14 | Windows | CONFIGURATION MANAGEMENT |
| ESXi : set-account-auto-unlock-time | VMWare vSphere 6.0 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-account-auto-unlock-time | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-account-lockout | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| EX13-CA-000105 - Exchange must have the Public Folder virtual directory removed if not in use by the site. | DISA Microsoft Exchange 2013 Client Access Server STIG v2r2 | Windows | CONFIGURATION MANAGEMENT |
| JBOS-AS-000120 - JBoss must be configured to produce log records that establish which hosted application triggered the events. | DISA JBoss Enterprise Application Platform 6.3 STIG v2r6 | Unix | AUDIT AND ACCOUNTABILITY |
| O19C-00-016800 - Oracle Database must take needed steps to protect data at rest and ensure confidentiality and integrity of application data. | DISA Oracle Database 19c STIG v1r3 OracleDB | OracleDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| O19C-00-016800 - Oracle Database must take steps to protect data at rest and ensure confidentiality and integrity of application data. | DISA Oracle Database 19c STIG v1r5 OracleDB | OracleDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| O365-EX-000017 - Open/save of Web pages and Excel 2003 XML spreadsheets must be blocked. | DISA Microsoft Office 365 ProPlus STIG v3r5 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000030 - Remote access to OHS must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | ACCESS CONTROL |
| SonicWALL - Password Policy - Affected User types | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SonicWALL - Password Policy - Affected User types - full-admins | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| SonicWALL - Password Policy - Change Period <=30 days | TNS SonicWALL v5.9 | SonicWALL | IDENTIFICATION AND AUTHENTICATION |
| VCEM-80-000125 - The vCenter ESX Agent Manager service must limit the amount of time that each Transmission Control Protocol (TCP) connection is kept alive. | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | ACCESS CONTROL |
| VCEM-80-000138 - The vCenter ESX Agent Manager service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | CONFIGURATION MANAGEMENT |
| VCLU-80-000138 - The vCenter Lookup service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Lookup Service STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-80-000138 - The vCenter STS service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service STS STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-80-000138 The vCenter STS service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| VCUI-80-000138 The vCenter UI service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance User Interface (UI) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| vNetwork : enable-bpdu-filter | VMWare vSphere 6.0 Hardening Guide | VMware | |
| vNetwork : limit-network-healthcheck | VMWare vSphere 6.0 Hardening Guide | VMware | |
| vNetwork : reject-mac-changes-dvportgroup | VMWare vSphere 6.0 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| vNetwork : reject-mac-changes-dvportgroup | VMWare vSphere 6.5 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| WA00510 W22 - Web server status module must be disabled. | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | ACCESS CONTROL |
| WatchGuard : IPS Threat Level Action High - DROP or BLOCK | TNS Best Practice WatchGuard Audit 1.0.0 | WatchGuard | SYSTEM AND INFORMATION INTEGRITY |
| WatchGuard : SNMP Configuration - v3 user has password - priv protocol | TNS Best Practice WatchGuard Audit 1.0.0 | WatchGuard | ACCESS CONTROL |
