| 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2 Ensure extraneous files and directories are removed | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.25 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes v2.1.0 L1 Master Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.39 WN19-00-000390 | CIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT II | Windows | CONFIGURATION MANAGEMENT |
| 1.45 VCSA-80-000281 | CIS VMware vSphere 8.0 vCenter STIG v1.0.0 CAT II | VMware | CONFIGURATION MANAGEMENT |
| 1.194 WN19-MS-000040 | CIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT II | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.1.7 Ensure ftp server services are not in use | CIS Rocky Linux 10 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.7 Ensure ftp server services are not in use | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.7 Ensure ftp server services are not in use | CIS Red Hat Enterprise Linux 10 v1.0.1 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.7 Ensure ftp server services are not in use | CIS AlmaLinux OS 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.1.8 Ensure ftp server services are not in use | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.8 Ensure ftp server services are not in use | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.1.8 Ensure ftp server services are not in use | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.1.15 Ensure telnet server services are not in use | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.15 Ensure telnet server services are not in use | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.1.15 Ensure telnet server services are not in use | CIS Rocky Linux 10 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.1.16 Ensure telnet server services are not in use | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.1.16 Ensure telnet server services are not in use | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.2.6 Ensure an ftp server is not installed | CIS Amazon Linux 2023 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.3.6 Ensure 'Require client MAPI encryption' is set to 'True' | CIS Microsoft Exchange Server 2019 L1 Mailbox v1.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1 Validate Proxy Settings | CIS Mozilla Firefox 38 ESR Windows L1 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.6 Validate Proxy Settings | CIS Mozilla Firefox 102 ESR Linux L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.6 Validate Proxy Settings | CIS Mozilla Firefox 102 ESR Windows L1 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.2.1.5 Ensure rsyslog is not configured to receive logs from a remote client | CIS Debian 9 Workstation L1 v1.0.1 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 7.4 Ensure Network Encryption is Configured and Enabled | CIS SQL Server 2016 Database L2 DB v1.4.0 | MS_SQLDB | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.8 Ensure Zones are Signed with NSEC or NSEC3 | CIS BIND DNS v1.0.0 L2 Authoritative Name Server | Unix | SYSTEM AND INFORMATION INTEGRITY |
| AS24-W2-000540 - The Apache web server must augment re-creation to a stable and known baseline. | DISA Apache Server 2.4 Windows Site STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Audit insecure guest logon - LanmanServer | MSCT Windows 11 v24H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit insecure guest logon - LanmanServer AuditInsecureGuestLogon | MSCT Windows Server 2025 DC v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit insecure guest logon - LanmanServer AuditInsecureGuestLogon | MSCT Windows Server 2025 MS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Big Sur - Disable the Built-in Web Server | NIST macOS Big Sur v1.4.0 - 800-53r5 Moderate | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| Catalina - Disable the Built-in Web Server | NIST macOS Catalina v1.5.0 - 800-53r4 Moderate | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| Monterey - Disable the Built-in Web Server | NIST macOS Monterey v1.0.0 - 800-171 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| OH12-1X-000169 - OHS must have resource mappings set to disable the serving of certain file types - Satisfy all | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | CONFIGURATION MANAGEMENT |
| OH12-1X-000226 - OHS administration must be performed over a secure path or at the local console. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | CONFIGURATION MANAGEMENT |
| OH12-1X-000283 - OHS must have the Timeout directive properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000284 - OHS must have the KeepAlive directive properly set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000288 - OHS must have the LimitRequestBody directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000293 - OHS must have the LimitInternalRecursion directive set to restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | AUDIT AND ACCOUNTABILITY |
| SQL2-00-010200 - SQL Server default account sa must have its name changed. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | CONFIGURATION MANAGEMENT |
| VCEM-70-000013 - ESX Agent Manager must have mappings set for Java servlet pages. | DISA STIG VMware vSphere 7.0 EAM Tomcat v1r2 | Unix | CONFIGURATION MANAGEMENT |
| VCWN-06-000027 - The system must minimize access to the vCenter server. | DISA VMware vSphere vCenter Server Version 6 STIG v1r4 | VMware | CONFIGURATION MANAGEMENT |
| WBLC-02-000076 - Oracle WebLogic must produce audit records containing sufficient information to establish when (date and time) the events occurred. | Oracle WebLogic Server 12c Windows v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000077 - Oracle WebLogic must produce audit records containing sufficient information to establish where the events occurred. | Oracle WebLogic Server 12c Windows v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000079 - Oracle WebLogic must produce audit records that contain sufficient information to establish the outcome (success or failure) of application server and application events. | Oracle WebLogic Server 12c Linux v2r2 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000079 - Oracle WebLogic must produce audit records that contain sufficient information to establish the outcome (success or failure) of application server and application events. | Oracle WebLogic Server 12c Windows v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000080 - Oracle WebLogic must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event. | Oracle WebLogic Server 12c Linux v2r2 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| WG330 A22 - A public web server must limit email to outbound only - netstat | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG330 W22 - A public web server must limit e-mail to outbound only. | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | CONFIGURATION MANAGEMENT |
