| 5.1.1 Ensure Home Folders Are Secure | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| APPL-11-000007 - The macOS system must be configured to disable hot corners - bottom left | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-000007 - The macOS system must be configured to disable hot corners - bottom right | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-000007 - The macOS system must be configured to disable hot corners - top right | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-000033 - The macOS system must be configured to disable password forwarding for FileVault2. | DISA STIG Apple macOS 11 v1r8 | Unix | ACCESS CONTROL |
| APPL-11-000033 - The macOS system must be configured to disable password forwarding for FileVault2. | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-002067 - The macOS system must prohibit user installation of software without explicit privileged status. | DISA STIG Apple macOS 11 v1r5 | Unix | CONFIGURATION MANAGEMENT |
| DTBI032-IE11 - Accessing data sources across domains must be disallowed (Internet zone). | DISA STIG IE 11 v2r7 | Windows | ACCESS CONTROL |
| DTBI038-IE11 - Launching programs and files in IFRAME must be disallowed (Internet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI061-IE11 - Java permissions must be configured with High Safety (Intranet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI114-IE11 - The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI115-IE11 - ActiveX controls and plug-ins must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI318-IE11 - Internet Explorer must be set to disallow users to add/delete sites. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI390-IE11 - Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI426-IE11 - Anti-Malware programs against ActiveX controls must be run for the Local Machine zone. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI435-IE11 - Java permissions must be disallowed (Locked Down Intranet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI485-IE11 - Protected Mode must be enforced (Internet zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI490-IE11 - Protected Mode must be enforced (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI580-IE11 - Automatic prompting for file downloads must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI590-IE11 - Internet Explorer Processes for MIME handling must be enforced. (Reserved) | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI600-IE11 - Internet Explorer Processes for MK protocol must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI614-IE11 - Internet Explorer Processes for Zone Elevation must be enforced (iexplore). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI635-IE11 - Internet Explorer Processes for Restrict File Download must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI760-IE11 - Browser must retain history on exit. | DISA STIG IE 11 v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| DTBI770-IE11 - Deleting websites that the user has visited must be disallowed. | DISA STIG IE 11 v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| DTBI835-IE11 - Internet Explorer Processes for Notification Bars must be enforced (iexplore). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI930-IE11 - .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone). | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1005-IE11 - Dragging of content from different domains across windows must be disallowed (Restricted Sites zone). | DISA STIG IE 11 v2r7 | Windows | ACCESS CONTROL |
| DTBI1010-IE11 - Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1060-IE11 - Prevent bypassing SmartScreen Filter warnings must be enabled. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| DTBI1070-IE11 - Prevent per-user installation of ActiveX controls must be enabled. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1115-IE11 - Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1120-IE11 - Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone. | DISA STIG IE 11 v2r7 | Windows | CONFIGURATION MANAGEMENT |
| DTBI1125-IE11 - VBScript must not be allowed to run in Internet Explorer (Internet zone) - Internet zone | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI1130-IE11 - VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone) - Restricted Sites zone | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-11-000300 - Google Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | ACCESS CONTROL |
| GOOG-11-009200 - The Google Android 11 Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | MobileIron - DISA Google Android 11 COPE v2r1 | MDM | CONFIGURATION MANAGEMENT |
| MOTS-11-009100 - Motorola Solutions Android 11 must allow only the administrator (EMM) to install/remove DoD root and intermediate PKI certificates - MDM to install/remove DoD root and intermediate PKI certificates. | AirWatch - DISA Motorola Solutions Android 11 COBO v1r3 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-000300 - Microsoft Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | AirWatch - DISA Microsoft Android 11 COBO v1r2 | MDM | ACCESS CONTROL |
| MSFT-11-000300 - Microsoft Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | ACCESS CONTROL |
| MSFT-11-001600 - Microsoft Android 11 must be configured to not display the following (work profile) notifications when the device is locked: [selection:- Email notifications - Calendar appointments - Contact associated with phone call notification - Text message notification- Other application-based notifications- All notifications] - work profile notifications when the device is locked: | AirWatch - DISA Microsoft Android 11 COPE v1r2 | MDM | ACCESS CONTROL |
| MSFT-11-009200 - The Microsoft Android 11 Work Profile must be configured to prevent users from adding personal email accounts to the work email app. | AirWatch - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
| TCAT-AS-001670 - RECYCLE_FACADES must be set to true. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WN12-SO-000045 - The system must be configured to use Safe DLL Search Mode. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-SO-000045 - The system must be configured to use Safe DLL Search Mode. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| ZEBR-11-000300 - Zebra Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | AirWatch - DISA Zebra Android 11 COBO STIG v1r4 | MDM | ACCESS CONTROL |
| ZEBR-11-000300 - Zebra Android 11 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity. | MobileIron - DISA Zebra Android 11 COBO STIG v1r4 | MDM | ACCESS CONTROL |
