| 2.2.10 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users' (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.10 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.32 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' (MS only) | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled' | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.3.10.2 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled' (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.10.2 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled' (MS only) | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.10.2 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 8.8 Secure the permissions of the SSLconfig.ini file | CIS IBM DB2 9 Benchmark v3.0.1 Level 1 OS Linux | Unix | |
| 8.8 Secure the permissions of the SSLconfig.ini file | CIS IBM DB2 9 Benchmark v3.0.1 Level 1 OS Windows | Windows | |
| 18.3.1 (L1) Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | ACCESS CONTROL |
| 18.3.1 Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled' | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | ACCESS CONTROL |
| 18.3.4 (L1) Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | RISK ASSESSMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.3.5 Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled' | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.4.5 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.5 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 Stand-alone v4.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 (L1) Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows Server 2016 v4.0.0 L1 DC | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 (L1) Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows Server 2016 v4.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.26.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' (MS only) | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.24.1 (L1) Ensure 'EMET 5.52' or higher is installed | CIS Windows Server 2012 R2 MS L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Always prevent untrusted Microsoft Query files from opening | Microsoft 365 Apps for Enterprise 2306 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Always prevent untrusted Microsoft Query files from opening | MSCT M365 Apps for enterprise 2312 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| CIS_AlmaLinux_OS_9_v3.0.0_L2_Workstation.audit from CIS AlmaLinux OS 9 v3.0.0 | CIS AlmaLinux OS 9 v3.0.0 L2 Workstation | Unix | |
| CIS_AlmaLinux_OS_10_v1.0.0_L1_Workstation.audit from CIS AlmaLinux OS 10 v1.0.0 | CIS AlmaLinux OS 10 v1.0.0 L1 Workstation | Unix | |
| CIS_Kubernetes_v1.3.0_Level_2.audit from CIS Kubernetes Benchmark v1.3.0 | CIS Kubernetes 1.11 Benchmark v1.3.0 L2 | Unix | |
| CIS_Kubernetes_v1.23_v1.0.1_Level_2_Master.audit from CIS Kubernetes v1.23 Benchmark v1.0.1 | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.24_v1.0.0_Level_1_Master.audit from CIS Kubernetes v1.24 Benchmark v1.0.0 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| CIS_MongoDB_3.6_Benchmark_Level_1_OS_Unix_v1.1.0.audit from CIS MongoDB 3.6 Benchmark | CIS MongoDB 3.6 L1 Unix Audit v1.1.0 | Unix | |
| CIS_MongoDB_3.6_Benchmark_Level_1_OS_Windows_v1.1.0.audit from CIS MongoDB 3.6 Benchmark | CIS MongoDB 3.6 L1 Windows Audit v1.1.0 | Windows | |
| CIS_MongoDB_Benchmark_Level_1_OS_Unix_v1.0.0.audit from CIS MongoDB Benchmark v1.0.0 | CIS MongoDB L1 Unix Audit v1.0.0 | Unix | |
| CIS_Oracle_Database_19c_v2.0.0_L1_RDBMS_On_Host_OS_Windows.audit from CIS Oracle Database 19c v2.0.0 | CIS Oracle Database 19c v2.0.0 L1 RDBMS On Host OS Windows | Windows | |
| CIS_Oracle_Linux_9_v3.0.0_L1_Workstation.audit from CIS Oracle Linux 9 v3.0.0 | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | |
| CIS_Oracle_Linux_10_v1.0.0_L1_Workstation.audit from CIS Oracle Linux 10 v1.0.0 | CIS Oracle Linux 10 v1.0.0 L1 Workstation | Unix | |
| CIS_PostgreSQL_10_v1.0.0_L1_OS_Linux.audit from CIS Benchmark for PostgreSQL 10 | CIS PostgreSQL 10 OS v1.0.0 | Unix | |
| CIS_Rocky_Linux_8_v3.0.0_L1_Workstation.audit from CIS Rocky Linux 8 v3.0.0 | CIS Rocky Linux 8 v3.0.0 L1 Workstation | Unix | |
| CIS_Rocky_Linux_8_v3.0.0_L2_Server.audit from CIS Rocky Linux 8 v3.0.0 | CIS Rocky Linux 8 v3.0.0 L2 Server | Unix | |
| CIS_Rocky_Linux_9_v3.0.0_L1_Workstation.audit from CIS Rocky Linux 9 v3.0.0 | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | |
| CIS_VMware_ESXi_8.0_v1.4.0_L2_Unix.audit from CIS VMware ESXi 8.0 v1.4.0 | CIS VMware ESXi 8.0 v1.4.0 L2 Unix | Unix | |
| CIS_VMware_ESXi_9.0_v1.0.0_L1_Unix.audit from CIS VMware ESXi 9.0 v1.0.0 | CIS VMware ESXi 9.0 v1.0.0 L1 Unix | Unix | |
| SQL2-00-004200 - SQL Server must not grant users direct access control to the Shutdown permission. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-004900 - SQL Server must not grant users direct access to the Alter resources permission. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-006200 - SQL Server must not grant users direct access to the Create endpoint permission. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| WN12-GE-000004-MS - Only administrators responsible for the member server must have Administrator rights on the system. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | ACCESS CONTROL |
| WN12-UR-000018-MS - The Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | ACCESS CONTROL |
| WN16-MS-000040 - Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server. | DISA Microsoft Windows Server 2016 STIG v2r10 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN16-MS-000390 - The 'Deny log on as a service' user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right. | DISA Microsoft Windows Server 2016 STIG v2r10 | Windows | ACCESS CONTROL |
| WN16-MS-000400 - The 'Deny log on locally' user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems. | DISA Microsoft Windows Server 2016 STIG v2r10 | Windows | ACCESS CONTROL |
| WN19-MS-000050 - Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined member servers. | DISA Microsoft Windows Server 2019 STIG v3r9 | Windows | CONFIGURATION MANAGEMENT |
