| 1.1 Ensure DNS server is configured | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2 Ensure intra-zone traffic is not always allowed | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.2 Use https for kubelet connections | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.3 Disable all management related services on WAN port | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | CONFIGURATION MANAGEMENT |
| 1.120 APPL-14-003011 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.120 APPL-26-003011 | CIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.121 APPL-15-003011 | CIS Apple macOS 15 Sequoia STIG v1.1.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.2 Ensure 'Controls when the profile can be removed' is set to 'Always' | MobileIron - CIS Apple iOS 12 v1.0.0 End User Owned L1 | MDM | ACCESS CONTROL |
| 2.1.3 Ensure timezone is properly configured | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.2.1.7 Ensure 'Allow documents from unmanaged sources in managed destinations' is set to 'Disabled' | MobileIron - CIS Apple iOS 12 v1.0.0 End User Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.2.1.8 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | MobileIron - CIS Apple iOS 10 v2.0.0 End User Owned L1 | MDM | |
| 2.2.1.11 Ensure 'Show Control Center in Lock screen' is set to 'Disabled' | MobileIron - CIS Apple iOS 10 v2.0.0 End User Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.2.1.11 Ensure 'Show Control Center in Lock screen' is set to 'Disabled' | AirWatch - CIS Apple iOS 11 v1.0.0 End User Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.2.2 Ensure administrator password retries and lockout time are configured | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL |
| 2.3.4 Enabling SNMP trap for memory usage | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.4.6 Apply Local-in Policies | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.4 Ensure High Availability Group-ID is configured | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 3.1 Ensure that unused policies are reviewed regularly | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 3.2.1.9 Ensure 'Allow Erase All Content and Settings' is set to 'Disabled' | AirWatch - CIS Apple iOS 10 v2.0.0 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.9 Ensure 'Allow Erase All Content and Settings' is set to 'Disabled' | AirWatch - CIS Apple iOS 11 v1.0.0 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.12 Ensure 'Allow modifying cellular data app settings' is set to 'Disabled' | AirWatch - CIS Apple iOS 10 v2.0.0 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.13 Ensure 'Allow modifying cellular data app settings' is set to 'Disabled' | AirWatch - CIS Apple iOS 11 v1.0.0 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.22 Ensure 'Show Notification Center in Lock screen' is set to 'Disabled' | AirWatch - CIS Apple iOS 11 v1.0.0 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.22 Ensure 'Show Notification Center in Lock screen' is set to 'Disabled' | MobileIron - CIS Apple iOS 11 v1.0.0 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.1 Ensure 'Managed Safari Web Domains' is `Configured` | MobileIron - CIS Apple iOS 12 v1.0.0 Institution Owned L1 | MDM | |
| 4.1.2 Apply IPS Security Profile to Policies | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | RISK ASSESSMENT |
| 4.2.2 Apply Antivirus Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.5 Enable grayware detection on antivirus | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.3 Apply DNS Filter Security Profile to Policies | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.2 Block applications running on non-default ports | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.5.4 Apply Application Control Security Profile to Policies | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.1 Enable Compromised Host Quarantine | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.1.1 Ensure Security Fabric is Configured | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 6.1.2 Enable Limited TLS Versions for SSL VPN | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 90.29 Ensure 'Take Ownership' is set to 'Administrators' | CIS Microsoft Intune for Windows 10 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| BIND-9X-001010 - A BIND 9.x primary name server must limit the number of concurrent zone transfers between authorized secondary name servers. | DISA BIND 9.x STIG v3r3 | Unix | ACCESS CONTROL |
| BIND-9X-001190 - A unique TSIG key used by a BIND 9.x server must be generated for each pair of communicating hosts. | DISA BIND 9.x STIG v3r3 | Unix | IDENTIFICATION AND AUTHENTICATION |
| BIND-9X-001290 - The two files generated by the BIND 9.x server dnssec-keygen program must be owned by the administrator account or deleted once they have been copied to the key file in the name server. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001480 - On a BIND 9.x server, all authoritative name servers for a zone must be located on different network segments. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001570 - On a BIND 9.x server, all authoritative name servers for a zone must have the same version of zone information. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001630 - The host running a BIND 9.x implementation must implement a set of firewall rules that restrict traffic on the DNS interface. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001650 - A BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and must perform integrity verification and data origin verification for all DNS information. | DISA BIND 9.x STIG v3r3 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| BIND-9X-001910 - The BIND 9.x server implementation must be configured with a channel to send audit records to at least two remote syslogs. | DISA BIND 9.x STIG v3r3 | Unix | AUDIT AND ACCOUNTABILITY |
| DHCP snooping - authorized-server | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| Local password complexity - password composition uppercase | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| Server-supplied privilege level | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| TFTP vs SFTP and SCP - no tftp server | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | CONFIGURATION MANAGEMENT |
| Time synchronization - ntp authentication | ArubaOS CX 10.x Hardening Guide v1.0.0 | ArubaOS | AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION |
