| 1.1.3.6.3 Configure 'Interactive logon: Require smart card' | CIS Windows 8 L1 v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.2.5 Set 'access-class' for 'line vty' | CIS Cisco IOS 12 L1 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4 SNMP Security - b) SNMP server | Tenable ZTE JINOS | ZTE_JINOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1 Protection Policy for the CPS Control Engine | Tenable ZTE JINOS | ZTE_JINOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2 NTP Security Protection - b) NTP access-group | Tenable ZTE JINOS | ZTE_JINOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.5 Ensure allowed-client is set to those necessary for device management | CIS Check Point Firewall L2 v1.1.0 | CheckPoint | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks -'External interface has ACL applied' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.1 Create a Web Filtering Profile | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 4.4.1.1 Ensure latest version of pam is installed | CIS CentOS Linux 7 v4.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.4.1.1 Ensure latest version of pam is installed | CIS Red Hat Enterprise Linux 7 v4.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.4.1.1 Ensure latest version of pam is installed | CIS Oracle Linux 7 v4.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.4.6 Ensure 'hostNameIncludeList' is set to the host names that will be allowed for web traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.7 Ensure 'addressIncludeList' is set to the IP addresses that will be allowed for web traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.8 Ensure 'addressExcludeList' is set to the IP addresses to be excluded for web traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Rocky Linux 8 v3.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS SUSE Linux Enterprise 15 v2.0.1 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Oracle Linux 8 v4.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1.1 Ensure latest version of pam is installed | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1.1 Ensure latest version of pam is installed | CIS Amazon Linux 2 v4.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.18 Install an approved tokend for smartcard authentication | CIS Apple OSX 10.9 L2 v1.3.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.19 Install an approved tokend for smartcard authentication | CIS Apple OSX 10.11 El Capitan L2 v1.1.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.17 Use a Web-Tier ELB Security Group to accept only HTTP/HTTPS | CIS Amazon Web Services Three-tier Web Architecture L1 1.0.0 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2 Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist | CIS Palo Alto Firewall 6 Benchmark L1 v1.0.0 | Palo_Alto | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access control lists | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| Brocade - Authentication policy must be rejected | Tenable Best Practices Brocade FabricOS | Brocade | SYSTEM AND COMMUNICATIONS PROTECTION |
| Brocade - Fabric Configuration Server policy must be rejected | Tenable Best Practices Brocade FabricOS | Brocade | SYSTEM AND COMMUNICATIONS PROTECTION |
| Brocade - Switch Connection Control policy must be rejected | Tenable Best Practices Brocade FabricOS | Brocade | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure 'SSH source restriction' is set to an authorized IP address | Tenable Cisco Firepower Best Practices Audit | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure 'threat-detection statistics' is set to 'tcp-intercept' | Tenable Cisco Firepower Best Practices Audit | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure packet fragments are restricted for untrusted interfaces | Tenable Cisco Firepower Threat Defense Best Practices Audit | Cisco_Firepower | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure that multi-factor authentication is enabled for all accounts | Tenable Best Practices RackSpace v2.0.0 | Rackspace | IDENTIFICATION AND AUTHENTICATION |
| Firewall Filter - Order terms with time sensitive protocols at the top | Juniper Hardening JunOS 12 Devices Checklist | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| Firewall Filter - Permit only required protocols from authorized sources | Juniper Hardening JunOS 12 Devices Checklist | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| Network Security - Ensure IP directed broadcast has not been configured | Juniper Hardening JunOS 12 Devices Checklist | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| Port security auto-recovery | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCLD-70-000002 - VAMI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections. | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| VCLD-70-000003 - VAMI must use cryptography to protect the integrity of remote sessions. | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| VCLD-70-000010 - VAMI must only load allowed server modules | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | CONFIGURATION MANAGEMENT |
| VCLD-70-000016 - VAMI must prevent hosted applications from exhausting system resources | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | CONFIGURATION MANAGEMENT |
| VCLD-70-000019 - VAMI must set the encoding for all text Multipurpose Internet Mail Extensions (MIME) types to UTF-8 - py | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCLD-70-000056 - VAMI must enable FIPS mode. | DISA STIG VMware vSphere 7.0 VAMI v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| VCPG-67-000016 - VMware Postgres must write log entries to disk prior to returning operation success or failure - full_page_writes | DISA STIG VMware vSphere 6.7 PostgreSQL v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCPG-67-000024 - VMware Postgres must set client-side character encoding to UTF-8. | DISA STIG VMware vSphere 6.7 PostgreSQL v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCPG-70-000002 - VMware Postgres log files must contain required fields. | DISA STIG VMware vSphere 7.0 PostgreSQL v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| VCPG-70-000003 - VMware Postgres configuration files must not be accessible by unauthorized users. | DISA STIG VMware vSphere 7.0 PostgreSQL v1r2 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
