| 1.11 Host hardware must secure unused external hardware ports | CIS VMware ESXi 9.0 v1.0.0 L2 VMware | VMware | CONFIGURATION MANAGEMENT |
| 1.12 Host integrated hardware management controller must deactivate internal networking | CIS VMware ESXi 9.0 v1.0.0 L2 VMware | VMware | CONFIGURATION MANAGEMENT |
| 1.15 APPL-15-000033 | CIS Apple macOS 15 Sequoia STIG v1.1.0 CAT II | Unix | ACCESS CONTROL |
| 1.15 APPL-26-000033 | CIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.125 APPL-14-003030 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.126 APPL-15-003030 | CIS Apple macOS 15 Sequoia STIG v1.1.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.6 Host must have reliable time synchronization sources | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 2.10 Host must restrict inter-VM transparent page sharing | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.10 Host must restrict inter-VM transparent page sharing | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.5 Host must deactivate CIM | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.5 Host must deactivate CIM | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.6 Host should deactivate SNMP | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.6 Host should deactivate SNMP | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.11 Host must enforce password complexity | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | IDENTIFICATION AND AUTHENTICATION |
| 3.13 Host must unlock accounts after a specified timeout period | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | ACCESS CONTROL |
| 3.19 Host must have an accurate Exception Users list | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | ACCESS CONTROL, MEDIA PROTECTION |
| 3.24 Host must display a login banner for the DCUI and Host Client | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 4.1 Host must configure a persistent log location for all locally stored system logs | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 4.2 Host must transmit system logs to a remote log collector | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 5.4 Host must filter Bridge Protocol Data Unit (BPDU) packets | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9 Host must restrict access to a default or native VLAN on standard virtual switches | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10 Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.1 Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.2 Host iSCSI client, if enabled, must employ unique CHAP authentication secrets | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | IDENTIFICATION AND AUTHENTICATION |
| 7.5 Virtual machines must be configured to lock when the last console connection is closed | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.8 Ensure unauthorized modification and disconnection of devices is disabled | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.9 Virtual machines must prevent unauthorized connection of devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.12 Virtual machines must remove unnecessary USB/XHCI devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.13 Virtual machines must remove unnecessary serial port devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.17 Virtual machines must deactivate console drag and drop operations | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.18 Virtual machines must deactivate console copy operations | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.19 Virtual machines must deactivate console paste operations | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.21 Virtual machines must deactivate virtual disk shrinking operations | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.23 Virtual machines must restrict sharing of memory pages with other VMs | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.26 Virtual machines must limit the number of retained diagnostic logs | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 7.27 Virtual machines must limit the size of diagnostic logs | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 8.1.2 Limit informational messages from the VM to the VMX file | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | AUDIT AND ACCOUNTABILITY |
| 8.7.4 Ensure VM log file size is limited | CIS VMware ESXi 6.5 v1.0.0 Level 1 | VMware | AUDIT AND ACCOUNTABILITY |
| AOSX-14-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions. | DISA STIG Apple Mac OSX 10.14 v2r6 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| AOSX-14-003025 - The macOS system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access. | DISA STIG Apple Mac OSX 10.14 v2r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| AOSX-15-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple Mac OSX 10.15 v1r10 | Unix | ACCESS CONTROL |
| APPL-11-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities to verify the establishment of protected sessions. | DISA STIG Apple macOS 11 v1r5 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-11-003020 - The macOS system must use multifactor authentication for local access to privileged and non-privileged accounts. | DISA STIG Apple macOS 11 v1r8 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-12-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple macOS 12 v1r9 | Unix | ACCESS CONTROL |
| APPL-12-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions - PIV credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities to verify the establishment of protected sessions. | DISA STIG Apple macOS 12 v1r9 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-14-003020 - The macOS system must enforce smart card authentication. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-15-003030 - The macOS system must allow smart card authentication. | DISA Apple macOS 15 Sequoia STIG v1r8 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-26-000033 - The macOS system must disable FileVault automatic login. | DISA Apple macOS 26 Tahoe STIG v1r4 | Unix | ACCESS CONTROL |
| APPL-26-003030 - The macOS system must allow smart card authentication. | DISA Apple macOS 26 Tahoe STIG v1r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
