| 1.6.11 Ensure update-notifier-motd.service is not in use | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Amazon Linux 2 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Debian Linux 12 v2.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.12 Ensure net.ipv4.conf.all.rp_filter is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Amazon Linux 2 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Debian Linux 12 v2.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.13 Ensure net.ipv4.conf.default.rp_filter is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 6.14 Ensure Configuration File Encryption is Set | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | CONFIGURATION MANAGEMENT |
| 18.9.65.3.9.3 (L1) Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.3.1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.56.3.9.3 (L1) Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 (L1) Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Windows Server 2012 MS L1 v3.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows Server 2022 Stand-alone v2.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPNET0071 - Remoting Services TCP channels must utilize authentication and encryption. | DISA Microsoft DotNet Framework 4.0 STIG v2r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Audit SUID executables | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure CUPS Server is not enabled | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Ensure DNS Server is not enabled | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Ensure GDM login banner is configured - file-db | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| Ensure IPv6 redirects are not accepted - sysctl ipv6 default accept | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure LDAP client is not installed - zypper | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Ensure unsuccessful unauthorized file access attempts are collected - b32 EPERM | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure updates, patches, and additional security software are installed - zypper | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | SYSTEM AND INFORMATION INTEGRITY |
| Ensure users' dot files are not group or world writable | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Ensure users' home directories permissions are 750 or more restrictive | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Ensure xinetd is not enabled | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | CONFIGURATION MANAGEMENT |
| Lockout for failed password attempts - 'auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900' | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| Lockout for failed password attempts - 'auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900' | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| Lockout for failed password attempts - 'auth sufficient pam_unix.so' | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | ACCESS CONTROL |
| NTP is not installed - restrict -4 | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| OS10-L2S-000120 - The Dell OS10 Switch must have Unknown Unicast Flood Blocking (UUFB) enabled. | DISA Dell OS10 Switch Layer 2 Switch STIG v1r1 | Dell_OS10 | SYSTEM AND COMMUNICATIONS PROTECTION |
| PGS9-00-003000 - PostgreSQL must maintain the confidentiality and integrity of information during reception. | DISA STIG PostgreSQL 9.x on RHEL OS v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| SLEM-05-254035 - SLEM 5 must not be performing Internet Protocol version 6 (IPv6) packet forwarding by default unless the system is a router. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | CONFIGURATION MANAGEMENT |
| SLES-12-030430 - The SUSE operating system must not be performing Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router. | DISA SLES 12 STIG v3r5 | Unix | CONFIGURATION MANAGEMENT |
| SLES-15-040381 - The SUSE operating system must not be performing Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router. | DISA SUSE Linux Enterprise Server 15 STIG v2r8 | Unix | CONFIGURATION MANAGEMENT |
| SQLI-22-017800 - The SQL Server Browser service must be disabled unless specifically required and approved. | DISA Microsoft SQL Server 2022 Instance STIG v1r4 Windows | Windows | CONFIGURATION MANAGEMENT |
