| 1.2 Ensure the Server Is Not a Multi-Use System | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Alter the Advertised server.built Date | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Alter the Advertised server.built Date | CIS Apache Tomcat 8 L2 v1.1.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Alter the Advertised server.built Date | CIS Apache Tomcat 9 L2 v1.2.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2016 Database L1 AWS RDS v1.4.0 | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2017 Database L1 AWS RDS v1.3.0 | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2012 Database L1 AWS RDS v1.6.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2012 Database L1 DB v1.6.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2014 Database L1 DB v1.5.0 | MS_SQLDB | SYSTEM AND INFORMATION INTEGRITY |
| 2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0' | CIS SQL Server 2016 Database L1 DB v1.4.0 | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3 Ensure the Apache User Account Is Locked | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL |
| 3.4 Ensure Apache Directories and Files Are Owned By Root | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 3.8 Ensure the Lock File Is Secured | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.9 Ensure the Pid File Is Secured | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3 Ensure OverRide Is Disabled for the OS Root Directory | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1 Ensure login via 'local' UNIX Domain Socket is configured correctly - local UNIX Domain Socket is configured correctly | CIS PostgreSQL 12 OS v1.1.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.1 Ensure Options for the OS Root Directory Are Restricted | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL |
| 5.3 Ensure login via "local" UNIX Domain Socket is configured correctly | CIS PostgreSQL 13 v1.3.0 L1 OS Linux PostgreSQLDB | PostgreSQLDB | IDENTIFICATION AND AUTHENTICATION |
| 5.4 Ensure Default HTML Content Is Removed | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.8 Ensure the HTTP TRACE Method Is Disabled | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9 Ensure Old HTTP Protocol Versions Are Disallowed - 'httpd.conf RewriteCond = %{THE_REQUEST} !HTTP/1.1$' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 5.9 Ensure Old HTTP Protocol Versions Are Disallowed - Rewrite module not loaded | CIS Apache HTTP Server 2.2 L1 v3.6.0 Middleware | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 5.10 Ensure Access to .ht* Files Is Restricted | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.12 Ensure Access to .svn Files Is Restricted | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.14 Ensure IP Address Based Requests Are Disallowed | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1 Ensure the Error Log Filename and Severity Level Are Configured Correctly | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2 Ensure a Syslog Facility Is Configured for Error Logging | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3 Ensure the Server Access Log Is Configured Correctly | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 6.5 Ensure Applicable Patches Are Applied | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 6.6 Ensure ModSecurity Is Installed and Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.7 Ensure the OWASP ModSecurity Core Rule Set Is Installed and Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2 Ensure a Valid Trusted Certificate Is Installed | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 Ensure the Server's Private Key Is Protected | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 7.4 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 7.6 Ensure Insecure SSL Renegotiation Is Not Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 7.7 Ensure SSL Compression is not Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.12 Ensure Only Cipher Suites That Provide Forward Secrecy Are Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.1 Ensure ServerTokens is Set to 'Prod' or 'ProductOnly' | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 8.2 Ensure ServerSignature Is Not Enabled | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 8.3 Ensure miscellaneous configuration settings are correct | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 8.4 Ensure ETag Response Header Fields Do Not Include Inodes | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 9.5 Ensure the Timeout Limits for Request Headers is Set to 40 or Less | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 9.6 Ensure Timeout Limits for the Request Body is Set to 20 or Less | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 10.3 Ensure the LimitRequestFieldsize Directive is Set to 8190 or Less | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 10.4 Ensure the LimitRequestBody Directive is Set to 102400 or Less but not 0 | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 11.2 Ensure Apache Processes Run in the httpd_t Confined Context | CIS Apache HTTP Server 2.2 L2 v3.6.0 Middleware | Unix | ACCESS CONTROL |
| 11.2 Ensure Apache Processes Run in the httpd_t Confined Context - httpd | CIS Apache HTTP Server 2.2 L2 v3.6.0 | Unix | ACCESS CONTROL |
| SQL6-D0-004300 - SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
