| 1.1 Ensure DNS server is configured | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2 Ensure intra-zone traffic is not always allowed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.17 Set 'Maximum send size - organization level' to '10240' | CIS Microsoft Exchange Server 2013 Hub v1.1.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.73 SOL-11.1-040010 | CIS Solaris 11 X86 STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.2 Ensure 'Post-Login-Banner' is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.1.3 Ensure timezone is properly configured | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.1.6 Ensure the latest firmware is installed | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 2.1.8 Disable static keys for TLS | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.8 Disable static keys for TLS | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.9 Enable Global Strong Encryption | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL |
| 2.1.9 Enable Global Strong Encryption | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.10 Ensure management GUI listens on secure TLS version | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 2.1.11 Ensure CDN is enabled for improved GUI performance | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.13 Ensure Hostname is Not Displayed On Login GUI | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.1 Ensure 'Password Policy' is enabled | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | IDENTIFICATION AND AUTHENTICATION |
| 2.3.1 Ensure only SNMPv3 is enabled | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.1 Ensure default 'admin' password is changed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | IDENTIFICATION AND AUTHENTICATION |
| 2.4.5 Ensure only encrypted access channels are enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.6 Apply Local-in Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.8 Virtual patching on the local-in management interface | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.5.1 Ensure High Availability configuration is enabled | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 2.5.2 Ensure "Monitor Interfaces" for High Availability devices is enabled | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 3.1 Ensure that unused policies are reviewed regularly | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 4.1.1 Detect Botnet connections | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.1.1.8 Ensure crontab is restricted to authorized users | CIS Red Hat Enterprise Linux 7 v4.0.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.8 Ensure crontab is restricted to authorized users | CIS Red Hat Enterprise Linux 7 v4.0.0 L1 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.5 Enable grayware detection on antivirus | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.6 Ensure inline scanning with FortiGuard AI-Based Sandbox Service is enabled | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.6 Ensure inline scanning with FortiGuard AI-Based Sandbox Service is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.1 Block high risk categories on Application Control | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.1 Create a Web Filtering Profile | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 4.4.3 Ensure all Application Control related traffic is logged | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.4 Apply Application Control Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 4.5.1 Block high risk categories on Application Control | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.1.1 Ensure Security Fabric is Configured | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 6.1.1 Apply a Trusted Signed Certificate for VPN Portal | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 7.1.1 Enable Event Logging | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 7.2.1 Encrypt Log Transmission to FortiAnalyzer / FortiManager | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3.1 Encrypt Log Transmission to FortiAnalyzer / FortiManager | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3.2 Encrypt Log Transmission to Syslog | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3.3 Encrypt Log Transmission to Syslog | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-001110 - A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes. | DISA BIND 9.x STIG v3r3 | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| BIND-9X-001230 - On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001280 - On the BIND 9.x server, the private keys corresponding to both the zone signing key (ZSK) and the key signing key (KSK) must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001340 - On the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be owned by named. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001510 - The host running a BIND 9.x implementation must use a dedicated management interface to separate management traffic from DNS-specific traffic. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001590 - On the BIND 9.x server, a zone file must not include resource records that resolve to a fully qualified domain name residing in another zone. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001620 - The permissions assigned to the core BIND 9.x server files must be set to use the least privilege possible. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001750 - A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks. | DISA BIND 9.x STIG v3r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| SLEM-05-211020 - SLEM 5 must display the Standard Mandatory DOD Notice and Consent Banner before granting any local or remote connection to the system. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | ACCESS CONTROL |
