| 1.1.1 Create security user group | CIS HPE Aruba Networking CX Switch v1.0.1 L1 | ArubaOS | ACCESS CONTROL |
| 1.4 APPL-14-000005 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.4 APPL-15-000005 | CIS Apple macOS 15 Sequoia STIG v1.1.0 CAT II | Unix | ACCESS CONTROL |
| 1.5.6 Login Privilege Elevation for Administrators | CIS HPE Aruba Networking CX Switch v1.0.1 L2 | ArubaOS | ACCESS CONTROL |
| 1.9.1 Configure SNMPv3 | CIS Cisco NX-OS v1.2.0 L1 | Cisco | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 3.1.4.1 If VLAN interfaces have IP addreses, configure anti spoofing / ingress filtering protections | CIS Cisco NX-OS v1.2.0 L1 | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 3.2.5 Disable IP Source-Routing | CIS Cisco NX-OS v1.2.0 L1 | Cisco | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.16 AirDrop security considerations | CIS Apple macOS 10.13 L1 v1.1.0 | Unix | CONFIGURATION MANAGEMENT |
| 49.30 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L1 | Windows | ACCESS CONTROL |
| AIOS-12-010700 - Apple iOS must implement the management setting: not allow automatic completion of Safari browser passcodes. | AirWatch - DISA Apple iOS 12 v2r1 | MDM | CONFIGURATION MANAGEMENT |
| AOSX-13-000030 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur. | DISA STIG Apple Mac OSX 10.13 v2r5 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| APPL-14-000005 - The macOS system must configure user session lock when a smart token is removed. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | ACCESS CONTROL |
| APPL-26-000005 - The macOS system must configure user session lock when a smart token is removed. | DISA Apple macOS 26 Tahoe STIG v1r4 | Unix | ACCESS CONTROL |
| BIND-9X-001480 - On a BIND 9.x server, all authoritative name servers for a zone must be located on different network segments. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-06-000068 - Virtual switch VLANs must be fully documented and have only the required VLANs. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000068 - All ESXi host-connected virtual switch VLANs must be fully documented and have only the required VLANs. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| GEN000280 - Direct logins must not be permitted to shared, default, application, or utility accounts - '/etc/security/user rlogin=false' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN000280 - Direct logins must not be permitted to shared, default, application, or utility accounts - 'results of last should be reviewed' | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN000280 - Direct logins must not be permitted to shared, default, application, or utility accounts - 'results of last should be reviewed' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| JUEX-L2-000220 - The Juniper EX switch must not use the default VLAN for management traffic. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUSX-DM-000001 - The Juniper SRX Services Gateway must limit the number of concurrent sessions to a maximum of 10 or less for remote access using SSH. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL |
| JUSX-DM-000016 - For local accounts created on the device, the Juniper SRX Services Gateway must automatically generate log records for account modification events. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL |
| JUSX-DM-000020 - The Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when the local accounts (i.e., the account of last resort or root account) are modified. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| JUSX-DM-000021 - The Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when accounts are disabled. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| JUSX-DM-000039 - The Juniper SRX Services Gateway must allow only the information system security manager (ISSM) (or administrators/roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the syslog and/or local logs - or administrators/roles appointed by the ISSM to select which auditable events are to be generated and forwarded to the syslog and/or local logs. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| JUSX-DM-000041 - The Juniper SRX Services Gateway must generate log records when changes are made to administrator privileges. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000042 - The Juniper SRX Services Gateway must generate log records when administrator privileges are deleted. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000043 - The Juniper SRX Services Gateway must generate log records when logon events occur. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000046 - The Juniper SRX Services Gateway must generate log records when concurrent logons from different workstations occur. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000055 - The Juniper SRX Services Gateway must generate log records containing the full-text recording of privileged commands. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000056 - For local log files, the Juniper SRX Services Gateway must allocate log storage capacity in accordance with organization-defined log record storage requirements so that the log files do not grow to a size that causes operational issues. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000061 - In the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| JUSX-DM-000065 - The Juniper SRX Services Gateway must record time stamps for log records using Coordinated Universal Time (UTC). | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000077 - The Juniper SRX Services Gateway must implement logon roles to ensure only authorized roles are allowed to install software and updates. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-DM-000084 - If the loopback interface is used, the Juniper SRX Services Gateway must protect the loopback interface with firewall filters for known attacks that may exploit this interface. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-DM-000094 - The Juniper SRX Services Gateway must be configured to synchronize internal information system clocks with the primary and secondary NTP servers for the network. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| JUSX-DM-000097 - The Juniper SRX Services Gateway must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| JUSX-DM-000098 - The Juniper SRX Services Gateway must specify the order in which authentication servers are used. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-DM-000099 - The Juniper SRX Services Gateway must detect the addition of components and issue a priority 1 alert to the ISSM and SA, at a minimum. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-DM-000112 - The Juniper SRX Services Gateway must ensure SSH is disabled for root user logon to prevent remote access using the root account. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-DM-000131 - For local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by requiring at least one lowercase character be used - i.e., the root account and the account of last resort, the Juniper SRX Services Gateway must enforce password complexity by requiring at least one lower-case character be used. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| JUSX-DM-000136 - The Juniper SRX Services Gateway must use the SHA256 or later protocol for password authentication for local accounts using password authentication (i.e., the root account and the account of last resort) - i.e., the root account and the account of last resort the Juniper SRX Services Gateway must use the SHA1 or later protocol for password authentication. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| JUSX-DM-000147 - The Juniper SRX Services Gateway must securely configure SSHv2 FIPS 140-2/140-3 validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions - MAC algorithms to protect the integrity of maintenance and diagnostic communications. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | MAINTENANCE |
| JUSX-DM-000152 - For nonlocal maintenance sessions, the Juniper SRX Services Gateway must ensure only zones where management functionality is desired have host-inbound-traffic system-services configured. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | MAINTENANCE |
| JUSX-DM-000156 - The Juniper SRX Services Gateway must terminate a device management session after 10 minutes of inactivity, except to fulfill documented and validated mission requirements. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUSX-DM-000163 - The Juniper SRX Services Gateway must limit the number of sessions per minute to an organization-defined number for SSH to protect remote access management from unauthorized access. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| SLEM-05-255060 - SLEM 5 must deny direct logons to the root account using remote access via SSH. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| SQL6-D0-014200 - SQL Server must generate audit records when successful and unsuccessful attempts to delete privileges/permissions occur. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| UBTU-22-411010 - Ubuntu 22.04 LTS must prevent direct login into the root account. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| VCRP-67-000009 - The rhttpproxy log files must be moved to a permanent repository in accordance with site policy. | DISA STIG VMware vSphere 6.7 RhttpProxy v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
