| 1.4 Ensure 'application pool identity' is configured for all application pools | CIS IIS 7 L1 v1.8.0 | Windows | ACCESS CONTROL |
| 1.6 Ensure 'application pool identity' is configured for anonymous user identity | CIS IIS 7 L1 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.33 WN10-00-000155 | CIS Microsoft Windows 10 STIG v1.0.0 CAT II | Windows | CONFIGURATION MANAGEMENT |
| 2.1 Ensure 'global authorization rule' is set to restrict access | CIS IIS 7 L1 v1.8.0 | Windows | ACCESS CONTROL |
| 2.2 Ensure Access to Sensitive Site Features Is Restricted To Authenticated Principals Only - Default | CIS IIS 7 L1 v1.8.0 | Windows | |
| 2.3.11.6 (L1) Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.6 (L1) Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.7 (L1) Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Windows Server 2012 R2 DC L1 v3.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.7 (L1) Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Windows Server 2012 MS L1 v3.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.7 (L1) Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Microsoft Windows Server 2016 v4.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.7 Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.7 Ensure 'passwordFormat' is not set to clear - Applications | CIS IIS 7 L1 v1.8.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 3.6 Ensure 'httpcookie' mode is configured for session state - Default | CIS IIS 7 L2 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.7 Ensure 'cookies' are set with HttpOnly attribute - Default | CIS IIS 7 L2 v1.8.0 | Windows | ACCESS CONTROL |
| 5.8 DB2_GRP_LOOKUP Registry Variable (Windows only) | CIS IBM DB2 11 v1.2.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 5.9 DB2DOMAINLIST Registry Variable (Windows only) | CIS IBM DB2 11 v1.2.0 Windows OS Level 1 | Windows | ACCESS CONTROL |
| 5.10 Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 5.10 Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 5.10 Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 8.3 Ensure the backup and restore tool, 'pgBackRest', is installed and configured | CIS PostgreSQL 11 OS v1.0.0 | Unix | CONTINGENCY PLANNING |
| 18.10.90.1 (L1) Ensure 'Allow clipboard sharing with Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 18.10.92.1 Ensure 'Allow clipboard sharing with Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 18.10.92.3 Ensure 'Allow networking in Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.92.3 Ensure 'Allow networking in Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 82.11 Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 10 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| DTBC-0004 - Sites ability to show pop-ups must be disabled. | DISA Google Chrome Current Windows STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WBLC-01-000033 - Oracle WebLogic must enforce the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted. | Oracle WebLogic Server 12c Linux v2r2 | Unix | CONFIGURATION MANAGEMENT |
| Windows Compliance Policy - Password expiration (days) | Tenable Best Practices for Microsoft Intune Windows v1.0 | microsoft_azure | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| Windows Defender Firewall: Allow logging - LogDroppedPackets | MSCT Windows 11 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Windows Defender Firewall: Allow logging - LogFileSize | MSCT Windows 10 v20H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Windows Defender Firewall: Allow logging - LogFileSize | MSCT Windows 10 v21H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Windows Defender Firewall: Allow logging - LogFileSize | MSCT Windows 10 v21H1 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Windows Defender Firewall: Allow logging - LogSuccessfulConnections | MSCT Windows 10 v20H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Windows Device Configuration - Password expiration (days) | Tenable Best Practices for Microsoft Intune Windows v1.0 | microsoft_azure | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| Windows Device Configuration - Scan all downloads | Tenable Best Practices for Microsoft Intune Windows v1.0 | microsoft_azure | CONFIGURATION MANAGEMENT |
| Windows Device Configuration - Scan archive file | Tenable Best Practices for Microsoft Intune Windows v1.0 | microsoft_azure | CONFIGURATION MANAGEMENT |
| Windows Firewall: Protect all network connections | MSCT Windows 10 v1507 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN16-AC-000080 - Windows Server 2016 must have the built-in Windows password complexity policy enabled. | DISA Microsoft Windows Server 2016 STIG v2r10 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN19-CC-000490 - Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication. | DISA Microsoft Windows Server 2019 STIG v3r9 | Windows | MAINTENANCE |
| WN22-AC-000080 - Windows Server 2022 must have the built-in Windows password complexity policy enabled. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN22-CC-000470 - Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | MAINTENANCE |
| WN22-CC-000490 - Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | MAINTENANCE |
| WN25-AC-000080 - Windows Server 2025 must have the built-in Windows password complexity policy enabled. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-AC-000080 - Windows Server 2025 must have the built-in Windows password complexity policy enabled. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-CC-000470 - Windows Server 2025 Windows Remote Management (WinRM) client must not use Basic authentication. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | MAINTENANCE |
| WN25-CC-000490 - Windows Server 2025 Windows Remote Management (WinRM) client must not use Digest authentication. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | MAINTENANCE |
| WN25-CC-000500 - Windows Server 2025 Windows Remote Management (WinRM) service must not use Basic authentication. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | MAINTENANCE |
| WN25-CC-000500 - Windows Server 2025 Windows Remote Management (WinRM) service must not use Basic authentication. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | MAINTENANCE |
| WN25-CC-000510 - Windows Server 2025 Windows Remote Management (WinRM) service must not allow unencrypted traffic. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | MAINTENANCE |
| WN25-CC-000520 - Windows Server 2025 Windows Remote Management (WinRM) service must not store RunAs credentials. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
