| 1.33 CISC-RT-000520 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | ACCESS CONTROL, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.40 CISC-RT-000590 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT III | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.42 CISC-RT-000610 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT III | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.50 CISC-RT-000700 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.72 CISC-RT-000930 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT III | Cisco | ACCESS CONTROL, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.2 Ensure access profile is set to use CHAP | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.2 BGP TCP Authentication Option (TCP-AO) | CIS Arista EOS benchmark v1.0.0 L2 | Arista | IDENTIFICATION AND AUTHENTICATION |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 6.21 Ensure ICMP Redirects are Disabled for IPv4 | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | CONFIGURATION MANAGEMENT |
| APPL-14-001060 - The macOS system must set smart card certificate trust to moderate. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-RT-000040 - The Arista BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer. | DISA Arista MLS EOS 4.X Router STIG v2r2 | Arista | ACCESS CONTROL |
| CISC-RT-000610 - The MPLS switch with RSVP-TE enabled must be configured with message pacing to adjust maximum burst and maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core switches. | DISA Cisco NX OS Switch RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure timezone is properly configured | Tenable Cisco Firepower Best Practices Audit | Cisco | CONFIGURATION MANAGEMENT |
| RHEL-08-040261 - RHEL 8 must not accept router advertisements on all IPv6 interfaces. | DISA Red Hat Enterprise Linux 8 STIG v2r8 | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000970 - Idle timeout for the management application must be set to 10 minutes. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| WDNS-AU-000006 - The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| WDNS-AU-000016 - The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| WDNS-CM-000001 - The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS). | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000006 - The Windows 2012 DNS Server with a caching name server role must be secured against pollution by ensuring the authenticity and integrity of queried records. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000007 - The Windows 2012 DNS Server must implement cryptographic mechanisms to detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS). | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000014 - The Windows 2012 DNS Server must be configured to enable DNSSEC Resource Records. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000018 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-000027 - AAAA addresses must not be configured in a zone for hosts that are not IPv6-aware. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-CM-999999 - The Windows 2012 DNS Server must be a vendor supported release. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT |
| WDNS-IA-000007 - The Windows 2012 DNS Server key file must be owned by the account under which the Windows 2012 DNS Server service is run. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WDNS-IA-000011 - The Windows 2012 DNS Server must implement a local cache of revocation data for PKIauthentication in the event revocation information via the network is not accessible. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WDNS-SC-000004 - The Windows 2012 DNS Server must return data information in responses to internal name/address resolution queries. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000005 - The Windows 2012 DNS Server must use DNSSEC data within queries to confirm data origin to DNS resolvers. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000009 - The Windows 2012 DNS Server must enforce approved authorizations between DNS servers through the use of digital signatures in the RRSet. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000014 - The Windows DNS secondary servers must request data origin authentication verification from the primary server when requesting name/address resolution. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000018 - The Windows DNS secondary server must validate data origin verification authentication on the name/address resolution responses received from primary name servers. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000027 - The Windows 2012 DNS Server must use DNS Notify to prevent denial of service through increase in workload. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WDNS-SC-000030 - The Windows 2012 DNS Server must maintain the integrity of information during reception. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
