| 2.3.11.4 (L1) Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 (L1) Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows Server 2016 v4.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 (L1) Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows Server 2016 v4.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows Server 2025 v2.1.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.6 Ensure SSH PAM is enabled | CIS Debian Linux 10 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.2.10 Ensure sshd IgnoreRhosts is enabled | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.2.21 Ensure sshd UsePAM is enabled | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.5.1.1 Ensure minimum days between password changes is configured | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.5.1.2 Ensure password expiration is 365 days or less | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.5.1.4 Ensure inactive password lock is 30 days or less | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.7 (L2) Ensure 'Controls the mode of DNS-over-HTTPS' is set to 'Enabled: DNS-over-HTTPS without insecure fallback' | CIS Google Chrome L2 v3.0.0 | Windows | ACCESS CONTROL, AWARENESS AND TRAINING, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.10 Ensure sshd GSSAPIAuthentication is disabled | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 5.1.11 Ensure sshd HostbasedAuthentication is disabled | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 5.1.11 Ensure sshd HostbasedAuthentication is disabled | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 5.1.21 Ensure sshd PermitEmptyPasswords is disabled | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 5.2.15 Ensure only strong Key Exchange algorithms are used | CIS Debian 8 Workstation L1 v2.0.2 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Ensure password creation requirements are configured - dcredit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1 Ensure password creation requirements are configured - lcredit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1 Ensure password creation requirements are configured - password-auth try_first_pass | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1 Ensure password creation requirements are configured - ucredit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Server | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1 Ensure password creation requirements are configured - ucredit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1.1 Ensure password expiration is configured | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 8.1 Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured - Policies | CIS Palo Alto Firewall 9 v1.1.0 L1 | Palo_Alto | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| AIOS-17-006600 - Apple iOS/iPadOS 17 must be configured to not allow passwords that include more than four repeating or sequential characters. | AirWatch - DISA Apple iOS/iPadOS 17 v2r2 | MDM | IDENTIFICATION AND AUTHENTICATION |
| AIOS-17-006600 - Apple iOS/iPadOS 17 must be configured to not allow passwords that include more than four repeating or sequential characters. | MobileIron - DISA Apple iOS/iPadOS 17 v2r2 | MDM | IDENTIFICATION AND AUTHENTICATION |
| CASA-ND-000520 - The Cisco ASA must be configured to enforce password complexity by requiring that at least one uppercase character be used. | DISA STIG Cisco ASA NDM v2r5 | Cisco | IDENTIFICATION AND AUTHENTICATION |
| GOOG-13-006000 - Google Android 13 must be configured to enforce a minimum password length of six characters. | MobileIron - DISA Google Android 13 COPE STIG v2r3 | MDM | IDENTIFICATION AND AUTHENTICATION |
| JUEX-NM-000310 - The Juniper EX switch must be configured to enforce password complexity by requiring that at least one punctuation (special) character be used. | DISA Juniper EX Series Switches Network Device Management STIG v2r5 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| MYS8-00-005000 - If Database Management System (DBMS) authentication using passwords is employed, the DBMS must enforce the DOD standards for password complexity and lifetime - DBMS authentication using passwords is employed, the DBMS must enforce the DoD standards for password complexity and lifetime. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | IDENTIFICATION AND AUTHENTICATION |
| OL08-00-020130 - OL 8 must enforce password complexity by requiring that at least one numeric character be used. | DISA Oracle Linux 8 STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| OL08-00-020280 - All OL 8 passwords must contain at least one special character. | DISA Oracle Linux 8 STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-08-020130 - RHEL 8 must enforce password complexity by requiring that at least one numeric character be used. | DISA Red Hat Enterprise Linux 8 STIG v2r8 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-08-020160 - RHEL 8 must require the change of at least four character classes when passwords are changed. | DISA Red Hat Enterprise Linux 8 STIG v2r8 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-09-611065 - RHEL 9 must enforce password complexity by requiring that at least one lowercase character be used. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-09-611120 - RHEL 9 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-09-611125 - RHEL 9 must require the maximum number of repeating characters be limited to three when passwords are changed. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-10-600280 - RHEL 10 must require the maximum number of repeating characters of the same character class to be limited to four when passwords are changed. | DISA Red Hat Enterprise Linux 10 STIG v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| SQL2-00-038910 - If SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password lifetime. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| UBTU-20-010007 - The Ubuntu operating system must enforce 24 hours/1 day as the minimum password lifetime. Passwords for new users must have a 24 hours/1 day minimum password lifetime restriction. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-20-010008 - The Ubuntu operating system must enforce a 60-day maximum password lifetime restriction. Passwords for new users must have a 60-day maximum password lifetime restriction. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-20-010070 - The Ubuntu operating system must prohibit password reuse for a minimum of five generations. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-22-411025 - Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for new users must have a 24 hours/one day minimum password lifetime restriction. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-22-611015 - Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character be used. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-22-611055 - Ubuntu 22.04 LTS must store only encrypted representations of passwords. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-24-400280 - Ubuntu 24.04 LTS must enforce password complexity by requiring that at least one numeric character be used. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| WN10-SO-000280 - Passwords for enabled local Administrator accounts must be changed at least every 60 days. | DISA Microsoft Windows 10 STIG v3r6 | Windows | IDENTIFICATION AND AUTHENTICATION |
