| 1.2 Ensure the container host has been Hardened | CIS Docker Community Edition v1.1.0 L1 Linux Host OS | Unix | CONFIGURATION MANAGEMENT |
| 1.114 WN11-CC-000038 | CIS Microsoft Windows 11 STIG v1.2.0 CAT II | Windows | CONFIGURATION MANAGEMENT |
| 2.1.5 Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | CIS Microsoft 365 Foundations v7.0.0 L2 E5 | microsoft_azure | SYSTEM AND INFORMATION INTEGRITY |
| 2.2.2.2 Ensure Content Caching Is Disabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 2.3.1 Ensure Sending Diagnostic and Usage Data to Apple Is Disabled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.2 Ensure Content Caching Is Disabled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.1 Restrict Recursive Queries | CIS ISC BIND 9.0/9.5 v2.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1 Ensure Bonjour Advertising Services Is Disabled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.1.6 Ensure No World Writable Folders Exist in the Library Folder | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.2.3 Enable Conditional Access policies to block legacy authentication | CIS Microsoft 365 Foundations v7.0.0 L1 E3 | microsoft_azure | CONFIGURATION MANAGEMENT |
| 5.2.3 Ensure Complex Password Must Contain Alphabetic Characters Is Configured | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.3 Ensure Complex Password Must Contain Alphabetic Characters Is Configured | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.5 Ensure Complex Password Must Contain Special Character Is Configured | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.7 Ensure a Login Window Banner Exists | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.8 Ensure a Login Window Banner Exists | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.3.1 (L1) Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled' (MS only) | CIS Microsoft Windows Server 2008 Member Server Level 1 v3.3.1 | Windows | ACCESS CONTROL |
| 18.4.1 (L1) Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | ACCESS CONTROL |
| 18.10.43.6 (L1) Ensure 'Turn on Microsoft Defender Application Guard in Managed Mode' is set to 'Enabled: 1' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.43.6 Ensure 'Turn on Microsoft Defender Application Guard in Managed Mode' is set to 'Enabled: 1' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.43.6 Ensure 'Turn on Microsoft Defender Application Guard in Managed Mode' is set to 'Enabled: 1' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| ARST-L2-000060 - The Arista MLS layer 2 switch must have BPDU Guard enabled on all switch ports connecting to access layer switches and hosts. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000090 - The Arista MLS layer 2 switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000100 - The Arista MLS layer 2 switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000100 - The Arista MLS layer 2 switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports. | DISA STIG Arista MLS EOS 4.2x L2S v2r1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000140 - The Arista MLS layer 2 Arista MLS switch must implement Rapid STP where VLANs span multiple switches with redundant links. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | CONFIGURATION MANAGEMENT |
| ARST-L2-000160 - The Arista MLS layer 2 switch must have all trunk links enabled statically. | DISA STIG Arista MLS EOS 4.2x L2S v2r1 | Arista | CONFIGURATION MANAGEMENT |
| ARST-L2-000170 - The Arista MLS layer 2 switch must have all disabled switch ports assigned to an unused VLAN. | DISA STIG Arista MLS EOS 4.2x L2S v2r1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000190 - The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000190 - The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it. | DISA STIG Arista MLS EOS 4.2x L2S v2r1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000200 - The Arista MLS layer 2 switch must not use the default VLAN for management traffic. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | CONTINGENCY PLANNING |
| ARST-L2-000210 - The Arista MLS layer 2 switch must have all user-facing or untrusted ports configured as access switch ports. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000220 - The Arista MLS layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-L2-000230 - The Arista MLS layer 2 switch must not have any switch ports assigned to the native VLAN. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUEX-L2-000010 - The Juniper EX switch must be configured to disable non-essential capabilities. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUEX-L2-000070 - The Juniper EX switch must be configured to authenticate all network-connected endpoint devices before establishing any connection. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| JUEX-L2-000130 - The Juniper EX switch must be configured to enable IP Source Guard on all user-facing or untrusted access VLANs with active access interfaces. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUEX-L2-000160 - The Juniper EX switch must be configured to enable IGMP or MLD Snooping on all VLANs. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUEX-L2-000170 - If STP is used, the Juniper EX switch must be configured to implement Rapid STP, or Multiple STP, where VLANs span multiple switches with redundant links. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUEX-L2-000190 - The Juniper EX switch must be configured to assign all explicitly disabled access interfaces to an unused VLAN. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUEX-L2-000210 - The Juniper EX switch must be configured to prune the default VLAN from all trunked interfaces that do not require it. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUEX-L2-000240 - The Juniper EX switch must not have a native VLAN ID assigned, or have a unique native VLAN ID, for all 802.1q trunk links. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUEX-L2-000250 - The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface. | DISA Juniper EX Series Switches Layer 2 Switch STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| WN22-MS-000010 - Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | ACCESS CONTROL |
| WN22-MS-000040 - Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-MS-000120 - The Windows Server 2025 'Deny log on through Remote Desktop Services' user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
