| 1.2.1.9 Ensure access to files in /etc/apt/sources.list.d are configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3 Disable all management related services on WAN port | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.1.1 Ensure 'Pre-Login Banner' is set | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 2.1.1 Ensure 'Pre-Login Banner' is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AWARENESS AND TRAINING, PROGRAM MANAGEMENT |
| 2.1.2 Ensure 'Post-Login-Banner' is set | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 2.1.7 Disable USB Firmware and configuration installation | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.11 Ensure CDN is enabled for improved GUI performance | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.2.2 Ensure administrator password retries and lockout time are configured | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.3.3 Disable SNMPv3 Query Per User | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.4.2 Ensure all the login accounts having specific trusted hosts enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY |
| 2.4.7 Ensure default Admin ports are changed | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.8 Virtual patching on the local-in management interface | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.5.1 Ensure High Availability configuration is enabled | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.5.3 Ensure HA Reserved Management Interface is configured | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 3.2 Ensure that policies do not use "ALL" as Service | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1 Detect Botnet connections | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.1.2 Apply IPS Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | RISK ASSESSMENT |
| 4.2.1 Ensure Antivirus Definition Push Updates are Configured | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.1 Ensure Antivirus Definition Push Updates are Configured | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.1 Enable Botnet C&C Domain Blocking DNS Filter | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.2 Ensure DNS Filter logs all DNS queries and responses | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 4.5.2 Block applications running on non-default ports | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 6.1.2 Enable Limited TLS Versions for SSL VPN | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | ACCESS CONTROL |
| 7.1.1 Enable Event Logging | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 7.2.1 Centralized Logging and Reporting | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | AUDIT AND ACCOUNTABILITY |
| BIND-9X-001020 - The BIND 9.x secondary name server must limit the number of zones requested from a single primary name server. | DISA BIND 9.x STIG v3r3 | Unix | ACCESS CONTROL |
| BIND-9X-001140 - The BIND 9.x server private key corresponding to the zone-signing key (ZSK) pair must be the only DNSSEC key kept on a name server that supports dynamic updates. | DISA BIND 9.x STIG v3r3 | Unix | IDENTIFICATION AND AUTHENTICATION |
| BIND-9X-001220 - On a BIND 9.x server, for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001310 - Permissions assigned to the dnssec-keygen keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001350 - On the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be group owned by named. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001520 - The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| CD12-00-012300 - PostgreSQL must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| ESXi : apply-patches | VMWare vSphere 6.5 Hardening Guide | VMware | SYSTEM AND INFORMATION INTEGRITY |
| ESXi : config-snmp | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| ESXi : enable-chap-auth | VMWare vSphere 6.5 Hardening Guide | VMware | IDENTIFICATION AND AUTHENTICATION |
| ESXi : set-dcui-access | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| ESXi : set-password-policies | VMWare vSphere 6.5 Hardening Guide | VMware | IDENTIFICATION AND AUTHENTICATION |
| O19C-00-015500 - Oracle Database must use NIST-validated FIPS 140-2/140-3 compliant cryptography for authentication mechanisms. | DISA Oracle Database 19c STIG v1r5 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| O19C-00-015500 - Oracle Database must use NIST-validated FIPS 140-2/140-3 compliant cryptography for authentication mechanisms. | DISA Oracle Database 19c STIG v1r5 Windows | Windows | IDENTIFICATION AND AUTHENTICATION |
| VM : disable-unexposed-features-autologon | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
| VM : disable-unexposed-features-unity-interlock | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : disable-unexposed-features-unity-windowcontents | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : disconnect-devices-parallel | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : limit-setinfo-size | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : restrict-host-info | VMWare vSphere 6.5 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| VM : verify-network-filter | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| VM : verify-PCI-Passthrough | VMWare vSphere 6.5 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
| vNetwork : reject-mac-changes-StandardSwitch | VMWare vSphere 6.5 Hardening Guide | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| vNetwork : restrict-netflow-usage | VMWare vSphere 6.5 Hardening Guide | VMware | |
| vNetwork : verify-dvfilter-bind | VMWare vSphere 6.5 Hardening Guide | VMware | ACCESS CONTROL |
