| 3.2.1.1 Ensure 'Allow screenshots and screen recording' is set to 'Disabled' | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.1 Ensure 'Allow screenshots and screen recording' is set to 'Disabled' | MobileIron - CIS Apple 26 v1.0.0 L2 Institutionally Owned | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.6 Review 'Allow iCloud Keychain' settings | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.9 Ensure 'Allow network drive access in Files app' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.9 Ensure 'Allow network drive access in Files app' is set to 'Disabled' | MobileIron - CIS Apple 26 v1.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.10 Ensure 'Force encrypted backups' is set to 'Enabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | CONTINGENCY PLANNING, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1.12 Ensure 'Allow Erase All Content and Settings' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.12 Ensure 'Allow Erase All Content and Settings' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.17 Ensure 'Force automatic date and time' is set to 'Enabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | AUDIT AND ACCOUNTABILITY |
| 3.2.1.18 Ensure 'Allow modifying cellular data app settings' is set to 'Disabled' | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.18 Ensure 'Allow modifying cellular data app settings' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L2 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.20 Ensure 'Allow pairing with non-Configurator hosts' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.21 Ensure 'Allow documents from managed sources in unmanaged destinations' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.22 Ensure 'Allow documents from unmanaged sources in managed destinations' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.24 Ensure 'Allow Handoff' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.24 Ensure 'Allow Handoff' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.25 Ensure 'Allow sending diagnostic and usage data to Apple' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.25 Ensure 'Allow sending diagnostic and usage data to Apple' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.2.1.26 Ensure 'Require Touch ID / Face ID authentication before AutoFill' is set to 'Enabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.2.1 Ensure 'Force fraud warning' is set to 'Enabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.4.1 Ensure 'Allow simple value' is set to 'Disabled' | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | IDENTIFICATION AND AUTHENTICATION |
| 4.1.2 Review Emergency Reset | MobileIron - CIS Apple iOS 17 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 4.1.3 Review Lockdown Mode | MobileIron - CIS Apple iOS 17 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 4.1.3 Review Lockdown Mode | MobileIron - CIS Apple 26 v1.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT |
| 4.1.5 Review Airprint | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'Install iOS Updates' of 'Automatic Updates' is set to 'Enabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 4.5 Review 'iCloud Private Relay' settings | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| AIOS-11-080202 - Apple iOS must wipe protected or sensitive data upon unenrollment from MDM. | AirWatch - DISA Apple iOS 10 v1r3 | MDM | CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| Android Work Profile Device Configuration - Copy and paste between work and personal profiles | Tenable Best Practices for Microsoft Intune Android v1.0 | microsoft_azure | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| Android Work Profile Device Configuration - Prevent app installations from unknown sources in the personal profile | Tenable Best Practices for Microsoft Intune Android v1.0 | microsoft_azure | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| APPL-11-000008 - The macOS system must be configured with Wi-Fi support software disabled. | DISA STIG Apple macOS 11 v1r8 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| APPL-11-002014 - The macOS system must be configured to disable iCloud Address Book services. | DISA STIG Apple macOS 11 v1r8 | Unix | CONFIGURATION MANAGEMENT |
| APPL-11-002015 - The macOS system must be configured to disable the Mail iCloud services. | DISA STIG Apple macOS 11 v1r5 | Unix | CONFIGURATION MANAGEMENT |
| APPL-11-002016 - The macOS system must be configured to disable the iCloud Notes services. | DISA STIG Apple macOS 11 v1r5 | Unix | CONFIGURATION MANAGEMENT |
| APPL-11-002035 - The macOS system must be configured to disable the Cloud Setup services. | DISA STIG Apple macOS 11 v1r5 | Unix | CONFIGURATION MANAGEMENT |
| DISA_Oracle_11g_Instance_v9r1_OS_Linux.audit from DISA Oracle Database 11g Instance STIG v9r1 STIG | DISA STIG Oracle 11 Instance v9r1 OS Unix | Unix | |
| DISA_STIG_Apple_macOS_26_Tahoe_v1r4.audit from DISA Apple macOS 26 Tahoe STIG v1r4 | DISA Apple macOS 26 Tahoe STIG v1r4 | Unix | |
| DISA_STIG_IBM_WebSphere_Liberty_Server_v2r4.audit from DISA IBM WebSphere Liberty Server STIG v2r4 | DISA IBM WebSphere Liberty Server STIG v2r4 | Unix | |
| DISA_STIG_IBM_WebSphere_Traditional_9_v2r1_Middleware.audit from DISA IBM WebSphere Traditional V9.x v2r1 STIG | DISA IBM WebSphere Traditional 9 STIG v2r1 Middleware | Unix | |
| DISA_STIG_Microsoft_IIS_10.0_Server_v3r7.audit from DISA Microsoft IIS 10.0 Server STIG v3r7 | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | |
| DISA_STIG_Microsoft_Windows_Server_2025_v1r1.audit from DISA Microsoft Windows Server 2025 STIG v1r1 | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | |
| DISA_STIG_Microsoft_Windows_Server_2025_v1r4.audit from DISA Microsoft Windows Server 2025 STIG v1r4 | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | |
| DISA_STIG_Oracle_HTTP_Server_12.1.3_v2r3.audit from DISA Oracle HTTP Server 12.1.3 v2r3 STIG | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | |
| DISA_STIG_Oracle_WebLogic_Server_12c_Linux_v2r2.audit from DISA Oracle WebLogic Server 12c v2r2 STIG | Oracle WebLogic Server 12c Linux v2r2 | Unix | |
| DISA_STIG_Rancher_Government_Solutions_RKE2_v2r7.audit from DISA Rancher Government Solutions RKE2 STIG v2r7 | DISA Rancher Government Solutions RKE2 STIG v2r7 | Unix | |
| DISA_STIG_Ubuntu_16.04_LTS_v2r3.audit from DISA Canonical Ubuntu 16.04 LTS v2r3 STIG | DISA STIG Ubuntu 16.04 LTS v2r3 | Unix | |
| DISA_STIG_VMware_vSphere_6.7_ESXi_Bare_Metal_Host_v1r3.audit from DISA VMware vSphere 6.7 ESXi v1r3 STIG | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | |
| Ensure bogus ICMP responses are ignored - /etc/sysctl | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| Ensure secure ICMP redirects are not accepted - sysctl ipv4 all secure | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN11-00-000031 - Windows 11 systems must use a BitLocker PIN for pre-boot authentication. | DISA Microsoft Windows 11 STIG v2r11 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
