| 1.1 Ensure a separate user and group exist for Cassandra - group | CIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0 | Unix | ACCESS CONTROL |
| 1.1 Ensure a separate user and group exist for Cassandra - passwd | CIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0 | Unix | ACCESS CONTROL |
| 1.1 Ensure a separate user and group exist for Cassandra - user exists in group | CIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0 | Unix | ACCESS CONTROL |
| 1.3 Ensure Installation of Community Packages | CIS PostgreSQL 9.5 OS v1.1.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Ensure the Cassandra service is run as a non-root user | CIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0 | Unix | ACCESS CONTROL |
| 1.6 Ensure clocks are synchronized on all nodes | CIS Apache Cassandra 3.11 L1 Unix Audit v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.6 Support Web Access Security - b) ssl-context field | Tenable ZTE JINOS | ZTE_JINOS | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.7.4 Ensure GDM automount is configured | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.12 Ensure App Tier ELB have SSL\TLS Certificate attached | CIS Amazon Web Services Three-tier Web Architecture L2 1.0.0 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.3 Ensure avahi daemon services are not in use | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 4.1.4 Ensure ufw outgoing default is configured | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 4.10.9.1.1 Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 4.10.9.1.2 Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 5.1.24 Ensure sshd ListenAddress is configured | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.2.2.3 Enable Conditional Access policies to block legacy authentication | CIS Microsoft 365 Foundations v7.0.0 L1 E5 | microsoft_azure | CONFIGURATION MANAGEMENT |
| 5.2.2.3 Enable Conditional Access policies to block legacy authentication | CIS Microsoft 365 Foundations v7.0.0 L1 E3 | microsoft_azure | CONFIGURATION MANAGEMENT |
| 5.4.3.1 Ensure nologin is not listed in /etc/shells | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 6.2.1.2 Ensure auditd service is enabled and active | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.15 Ensure events that modify /etc/nsswitch.conf file are collected | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.23 Ensure events that modify the system's Mandatory Access Controls are collected | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.30 Ensure the running and on disk configuration is the same | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.10.5.7 Ensure REST API Explorer is Not Set | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | CONFIGURATION MANAGEMENT |
| 18.8.7.1.3 (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 8.1 v2.4.1 L2 Bitlocker | Windows | MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.7.1.1 Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 BL | Windows | MEDIA PROTECTION |
| 18.9.7.1.1 Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.9.7.1.3 Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.9.7.1.3 Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL NG | Windows | MEDIA PROTECTION |
| 18.9.7.1.3 Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.9.7.1.3 Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | MEDIA PROTECTION |
| 18.9.7.1.7 (L1) Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | MEDIA PROTECTION |
| Allow Basic authentication - Client - AllowBasic | MSCT Windows 10 v1507 v1.0.0 | Windows | ACCESS CONTROL |
| Allow Basic authentication - Client - AllowBasic | MSCT Windows Server v1909 MS v1.0.0 | Windows | ACCESS CONTROL |
| Allow Basic authentication - Client - AllowBasic | MSCT Windows Server 2025 DC v1.0.0 | Windows | ACCESS CONTROL |
| Allow Basic authentication - Client - AllowBasic | MSCT Windows Server 2025 MS v1.0.0 | Windows | ACCESS CONTROL |
| Allow Basic authentication - WinRM Client | MSCT Windows Server 2019 DC v1.0.0 | Windows | ACCESS CONTROL |
| ARST-L2-000020 - The Arista MLS layer 2 switch must uniquely identify all network-connected endpoint devices before establishing any connection. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | IDENTIFICATION AND AUTHENTICATION |
| DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes | DISA STIG IBM DB2 v10.5 LUW v2r1 OS Windows | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - Recovery Plan | DISA STIG IBM DB2 v10.5 LUW v2r1 OS Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - Recovery Plan | DISA STIG IBM DB2 v10.5 LUW v2r1 OS Windows | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-DM-300001 - The F5 BIG-IP appliance must be configured to limit the number of concurrent sessions to the Configuration Utility to 10 or an organization-defined number. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-16-010000 - Google Android 16 must have the DOD root and intermediate PKI certificates installed. | AirWatch - DISA Google Android 16 COBO STIG v1r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-16-010000 - Google Android 16 must have the DOD root and intermediate PKI certificates installed. | MobileIron - DISA Google Android 16 COBO STIG v1r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-16-010000 - Google Android 16 must have the DOD root and intermediate PKI certificates installed. | AirWatch - DISA Google Android 16 COBO STIG v1r3 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-17-008600 - Google Android 17 must have the DoW root and intermediate PKI certificates installed. | AirWatch - DISA Google Android 17 COBO STIG v1r1 | MDM | CONFIGURATION MANAGEMENT |
| GOOG-17-008600 - Google Android 17 must have the DoW root and intermediate PKI certificates installed. | MobileIron - DISA Google Android 17 COPE STIG v1r1 | MDM | CONFIGURATION MANAGEMENT |
| IIST-SI-000244 - IIS 10.0 website session IDs must be sent to the client using TLS. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| IISW-SV-000152 - IIS 8.5 web server session IDs must be sent to the client using TLS. | DISA IIS 8.5 Server v2r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| PGS9-00-010300 - PostgreSQL must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions. | DISA STIG PostgreSQL 9.x on RHEL DB v2r5 | PostgreSQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| PPS9-00-009300 - The EDB Postgres Advanced Server must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components. | EDB PostgreSQL Advanced Server OS Linux Audit v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCST-67-000028 - The Security Token Service must be configured with the appropriate ports - http | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
