| 1.1 Remove extraneous files and directories (SERVER_DIR/webapps/host-manager.xml) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (SERVER_DIR/webapps/manager) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (WEBAPP_DIR/balancer) | CIS Apache Tomcat 7 L2 v1.1.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (WEBAPP_DIR/js-examples) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.46 PHTN-40-000130 | CIS VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v1.0.0 CAT I | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Establish a Secure Baseline - Make sure that /network/rpc/bind only allows local connections (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that application/graphical-login/cde-login is only limited to local connections | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that application/management/sma:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that application/x11/xfs:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/login:rlogin is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/nfs/client:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/nfs/rquota:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/rpc/meta is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/rpc/metamed:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/rpc/metamh:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/rpc/rstat:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/shell:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that network/telnet:default is disabled (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3 Establish a Secure Baseline - Make sure that system/webconsole:console only allows local connections (netservices limited) | CIS Solaris 10 L1 v5.2 | Unix | |
| 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver | CIS Debian Linux 12 v2.0.0 L1 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver | CIS Ubuntu Linux 20.04 LTS v3.0.0 L1 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver | CIS SUSE Linux Enterprise 15 v2.0.1 L1 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.17.4 Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | CONFIGURATION MANAGEMENT |
| 3.3.1.11 Ensure net.ipv4.conf.default.secure_redirects is configured | CIS Rocky Linux 10 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.11 Ensure net.ipv4.conf.default.secure_redirects is configured | CIS Oracle Linux 10 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.11 Ensure net.ipv4.conf.default.secure_redirects is configured | CIS AlmaLinux OS 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 4.7 Ensure 'Automatic Downloads' of 'App Updates' is set to 'Enabled' | AirWatch - CIS Apple iPadOS 26 v1.0.0 L1 End User Owned | MDM | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 4.7 Ensure 'Automatic Downloads' of 'App Updates' is set to 'Enabled' | MobileIron - CIS Apple iOS 17 v1.1.0 End User Owned L1 | MDM | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 4.7 Ensure 'Automatic Downloads' of 'App Updates' is set to 'Enabled' | AirWatch - CIS Apple iOS 26 Benchmark v1.0.0 L1 End User Owned | MDM | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.208 - Device Install - PnP Interface Remote Access | DISA Windows Vista STIG v6r41 | Windows | CONFIGURATION MANAGEMENT |
| 5.211 - Driver Install - Device Driver Search Prompt | DISA Windows Vista STIG v6r41 | Windows | CONFIGURATION MANAGEMENT |
| 12.55 Passwords - 'Remove password parameters from configuration files utilized for Silent Installations' | CIS v1.1.0 Oracle 11g OS Windows Level 2 | Windows | |
| 18.7.4 (L1) Ensure 'Manage processing of Queue-specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles' | CIS Windows Server 2012 DC L1 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| DB2X-00-003100 - Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications. | DISA STIG IBM DB2 v10.5 LUW v2r1 OS Windows | Windows | CONFIGURATION MANAGEMENT |
| DTBI1070-IE11 - Prevent per-user installation of ActiveX controls must be enabled. | DISA STIG IE 11 v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXi: esxi-8.lockdown-dcui-access | VMware vSphere Security Configuration and Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| F5BI-LT-000219 - The BIG-IP Core implementation must be configured to protect against known types of Denial of Service (DoS) attacks by employing signatures when providing content filtering to virtual servers. | DISA F5 BIG-IP Local Traffic Manager STIG v2r4 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| Network access: Remotely accessible registry paths | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | ACCESS CONTROL |
| Network access: Remotely accessible registry paths | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | ACCESS CONTROL |
| VBA Macro Notification Settings - vbadigsigtrustedpublishers - access | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND SERVICES ACQUISITION |
| VBA Macro Notification Settings - vbadigsigtrustedpublishers - powerpoint | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND SERVICES ACQUISITION |
| VBA Macro Notification Settings - vbarequiredigsigwithcodesigningeku - powerpoint | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - vbarequiredigsigwithcodesigningeku - publisher | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - vbarequirelmtrustedpublisher - access | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - vbarequirelmtrustedpublisher - powerpoint | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - vbawarnings - publisher | MSCT Microsoft 365 Apps for Enterprise 2112 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - vbawarnings - word | MSCT Microsoft 365 Apps for Enterprise 2206 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - visio - vbarequirelmtrustedpublisher | MSCT Microsoft 365 Apps for Enterprise 2112 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VBA Macro Notification Settings - word - vbadigsigtrustedpublishers | MSCT Microsoft 365 Apps for Enterprise 2112 v1.0.0 | Windows | SYSTEM AND SERVICES ACQUISITION |
