| 1.3 CISC-L2-000040 | CIS Cisco IOS XE Switch L2S STIG v1.0.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.3.2 Disable TCP and UDP small servers | CIS Cisco IOS XR 7.x v1.0.1 L1 | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.1 Set 'password' for 'enable secret' | CIS Cisco IOS XE 16.x v2.2.0 L1 | Cisco | ACCESS CONTROL |
| 1.5 CISC-RT-000050 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.7 CISC-L2-000120 | CIS Cisco IOS XE Switch L2S STIG v1.0.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.29 CISC-ND-001200 | CIS Cisco NX OS Switch NDM STIG v1.1.0 CAT I | Cisco | MAINTENANCE |
| 1.35 CISC-ND-001220 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.39 CISC-RT-000580 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT III | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.58 CISC-RT-000780 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.59 CISC-RT-000580 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | CONTINGENCY PLANNING |
| 2.4.7 Ensure default Admin ports are changed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.7 Ensure default Admin ports are changed | CIS FortiGate 7.4.x v1.0.1 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Prevent unintended use of dvfilter network APIs | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | ACCESS CONTROL |
| 2.8.7 (L1) Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'. | CIS Google Chrome L1 v3.0.0 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.14.2 (L1) Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'. | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 3.4.1.2 Ensure iptables-persistent is not installed with ufw | CIS Debian Linux 10 v2.0.0 L1 Workstation | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4.1.2 Ensure iptables-persistent is not installed with ufw | CIS Debian Linux 10 v2.0.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4.1.2 Ensure iptables-persistent is not installed with ufw | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4.1.2 Ensure iptables-persistent is not installed with ufw | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Workstation | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.4.2.2 Ensure at least one nftables table exists | CIS Amazon Linux 2023 v1.0.0 L2 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6 Host should deactivate SNMP | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.6 Host should deactivate SNMP | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 4.1.2 Ensure iptables-persistent is not installed with ufw | CIS Debian Linux 11 v2.0.0 L1 Workstation | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.3 Ensure iptables-persistent is not installed with ufw | CIS Ubuntu Linux 20.04 LTS v3.0.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.7.7 Ensure 'Configure RPC over TCP port: RPC over TCP port:' is set to 'Enabled: 0' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 5.3 Ensure a client list is set for SNMPv1/v2 communities | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.6.7 Ensure Remote Login Class for Authorization through External AAA - login class | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| AADC-CL-000280 - Adobe Acrobat Pro DC Classic access to unknown websites must be restricted. | DISA STIG Adobe Acrobat Pro DC Classic Track v2r1 | Windows | CONFIGURATION MANAGEMENT |
| Apply local firewall rules | MSCT Windows 10 v1507 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Apply local firewall rules - Domain Profile | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Apply local firewall rules - Private Profile | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Apply local firewall rules - Private Profile | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Apply local firewall rules - Public Profile | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARBA-VN-000040 - AOS, when used as a VPN Gateway, must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies. | DISA HPE Aruba Networking AOS VPN STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-VN-000480 - For site-to-site VPN implementations using AOS, the Layer 2 Tunneling Protocol (L2TP) must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave. | DISA HPE Aruba Networking AOS VPN STIG v1r1 | ArubaOS | CONFIGURATION MANAGEMENT |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'NTP daemon is started at boot' | DISA STIG AIX 6.1 v1r14 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'xntpd is started at boot time' | DISA STIG AIX 6.1 v1r14 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'xntpd is started at boot time' | DISA AIX 5.3 STIG v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'xntpd|ntpd is running' | DISA STIG AIX 6.1 v1r14 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'xntpd|ntpd is running' | DISA AIX 5.3 STIG v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source. | DISA STIG for Oracle Linux 5 v2r1 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source. | DISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit | Unix | AUDIT AND ACCOUNTABILITY |
| GEN004000 - The traceroute file must have mode 0700 or less permissive. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN004000 - The traceroute file must have mode 0700 or less permissive. | DISA STIG for Oracle Linux 5 v2r1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GEN004000 - The traceroute file must have mode 0700 or less permissive. | DISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit | Unix | ACCESS CONTROL |
| JUEX-NM-000630 - The Juniper EX switch must be configured to enforce access restrictions associated with changes to the system components. | DISA Juniper EX Series Switches Network Device Management STIG v2r5 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-AG-000084 - The Juniper SRX Services Gateway Firewall must not be configured as an NTP server since providing this network service is unrelated to the role as a firewall. | DISA Juniper SRX Services Gateway ALG v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-AG-000085 - The Juniper SRX Services Gateway Firewall must not be configured as a DNS proxy since providing this network service is unrelated to the role as a Firewall. | DISA Juniper SRX Services Gateway ALG v3r3 | Juniper | CONFIGURATION MANAGEMENT |
| RHEL-06-000113 - The system must employ a local IPv4 firewall - iptables running | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | CONFIGURATION MANAGEMENT |
| VM : minimize-console-VNC-use | VMWare vSphere 6.0 Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
