| 1.1.15 Ensure nosuid option set on /run/shm partition | CIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0 | Unix | ACCESS CONTROL |
| 1.1.16 Ensure nosuid option set on /dev/shm partition | CIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.17 Ensure nodev option set on removable media partitions | CIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0 | Unix | ACCESS CONTROL |
| 1.1.17 Ensure nodev option set on removable media partitions | CIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0 | Unix | ACCESS CONTROL |
| 1.1.17 Ensure noexec option set on /dev/shm partition | CIS SUSE Linux Enterprise Workstation 11 L1 v2.1.1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.18 Ensure nodev option set on removable media partitions | CIS SUSE Linux Enterprise Server 11 L1 v2.1.1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.18 Ensure nosuid option set on removable media partitions | CIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0 | Unix | ACCESS CONTROL |
| 1.1.19 Ensure noexec option set on removable media partitions | CIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0 | Unix | ACCESS CONTROL |
| 1.1.20 Ensure noexec option set on removable media partitions | CIS Ubuntu Linux 18.04 LXD Host L1 Server v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.2.1.9 Ensure access to files in /etc/apt/sources.list.d are configured | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.1.9 Ensure access to files in /etc/apt/sources.list.d are configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.1.4 Ensure correct system time is configured through NTP | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.1.4 Ensure correct system time is configured through NTP | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.1.5 Ensure hostname is set | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.5 Ensure hostname is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.7 Disable USB Firmware and configuration installation | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.10 Ensure management GUI listens on secure TLS version | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.1.12 Ensure single CPU core overloaded event is logged | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure 'Password Policy' is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | IDENTIFICATION AND AUTHENTICATION |
| 2.4.3 Ensure admin accounts with different privileges have their correct profiles assigned | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 2.4.3 Ensure admin accounts with different privileges have their correct profiles assigned | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.4.5 Ensure only encrypted access channels are enabled | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.7 Ensure default Admin ports are changed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.2 Ensure "Monitor Interfaces" for High Availability devices is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.2 Ensure that policies do not use "ALL" as Service | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 3.4 Ensure logging is enabled on all firewall policies | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 4.2.3 Enable Outbreak Prevention Database | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.1 Enable Botnet C&C Domain Blocking DNS Filter | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.3 Apply DNS Filter Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.5 Ensure the latest iOS device architecture is used by high-value targets | MobileIron - CIS Apple iOS 11 v1.0.0 Institution Owned L2 | MDM | SYSTEM AND INFORMATION INTEGRITY |
| 5.2.15 Ensure SSH Idle Timeout Interval is configured - ClientAliveCountMax | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 6.1.1 Apply a Trusted Signed Certificate for VPN Portal | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | ACCESS CONTROL |
| 6.1.1 Audit system file permissions | CIS Oracle Linux 6 Workstation L2 v2.0.0 | Unix | ACCESS CONTROL |
| 6.1.1 Audit system file permissions | CIS Red Hat 6 Server L2 v3.0.0 | Unix | ACCESS CONTROL |
| 6.1.1 Audit system file permissions | CIS SUSE Linux Enterprise Workstation 11 L2 v2.1.1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.10.2.3 Ensure Web-Management is Set to use PKI Certificate for HTTPS | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| BIND-9X-001150 - The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline. | DISA BIND 9.x STIG v3r3 | Unix | IDENTIFICATION AND AUTHENTICATION |
| BIND-9X-001390 - The primary servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001740 - A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients. | DISA BIND 9.x STIG v3r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CIS_Cisco_Firewall_v8.x_Level_1_v4.2.0.audit for Cisco ASA 8 from CIS Cisco Firewall v8.x Benchmark v4.2.0 | CIS Cisco Firewall v8.x L1 v4.2.0 | Cisco | |
| Ensure noexec option set on /dev/shm partition | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| Ensure noexec option set on /var/tmp partition | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| Ensure nosuid option set on removable media partitions | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| EPAS-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations. | EnterpriseDB PostgreSQL Advanced Server OS Linux v2r1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN000590 - The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes - CRYPT_DEFAULT | DISA STIG Solaris 10 SPARC v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| MD8X-00-004200 - MongoDB must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations. | DISA MongoDB Enterprise Advanced 8.x STIG v1r1 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| MYS8-00-006200 - The MySQL Database Server 8.0 must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | IDENTIFICATION AND AUTHENTICATION |
| O19C-00-015500 - Oracle Database must use NIST-validated FIPS 140-2/140-3 compliant cryptography for authentication mechanisms. | DISA Oracle Database 19c STIG v1r3 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| PGS9-00-012300 - PostgreSQL must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations. | DISA STIG PostgreSQL 9.x on RHEL OS v2r5 | Unix | IDENTIFICATION AND AUTHENTICATION |
| PPS9-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations. | EDB PostgreSQL Advanced Server OS Linux Audit v2r3 | Unix | IDENTIFICATION AND AUTHENTICATION |
