| 3.6.3.2.4 Ensure firewall rules exist for all open ports | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.10 Ensure 'trustedHeaderOrigin' is set to trusted host names and IP addresses | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 5.1.13 Ensure sshd LoginGraceTime is configured | CIS Red Hat Enterprise Linux 10 v1.0.1 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.1.13 Ensure sshd LoginGraceTime is configured | CIS Rocky Linux 10 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.1.13 Ensure sshd LoginGraceTime is configured | CIS Oracle Linux 10 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 5.1.14 Ensure sshd LoginGraceTime is configured | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.1.14 Ensure sshd LoginGraceTime is configured | CIS SUSE Linux Enterprise 15 v2.0.1 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 5.1.14 Ensure sshd LoginGraceTime is configured | CIS SUSE Linux Enterprise 15 v2.0.1 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.1.15 Ensure sshd LoginGraceTime is configured | CIS Oracle Linux 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 5.1.15 Ensure sshd LoginGraceTime is configured | CIS Oracle Linux 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.1.15 Ensure sshd LoginGraceTime is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 5.1.15 Ensure sshd LoginGraceTime is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.2.13 Ensure SSH LoginGraceTime is set to one minute or less | CIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0 | Unix | ACCESS CONTROL |
| 5.2.17 Ensure SSH LoginGraceTime is set to one minute or less | CIS Debian 8 Server L1 v2.0.2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.2.17 Ensure SSH LoginGraceTime is set to one minute or less | CIS Fedora 19 Family Linux Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.3.2 Ensure lockout for failed password attempts is configured | CIS Debian 8 Workstation L1 v2.0.2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.3.2 Ensure lockout for failed password attempts is configured | CIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0 | Unix | ACCESS CONTROL |
| 5.3.2 Ensure lockout for failed password attempts is configured | CIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0 | Unix | ACCESS CONTROL |
| 5.3.2 Ensure lockout for failed password attempts is configured - account required | CIS SUSE Linux Enterprise Server 11 L1 v2.1.1 | Unix | ACCESS CONTROL |
| 5.3.2 Lockout for failed password attempts - 'auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900' | CIS Distribution Independent Linux Server L1 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.2 Lockout for failed password attempts - 'auth sufficient pam_unix.so' | CIS Distribution Independent Linux Workstation L1 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.2 Lockout for failed password attempts - password-auth 'auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900' | CIS Distribution Independent Linux Server L1 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.2.1 Ensure active authselect profile includes pam modules | CIS Oracle Linux 8 v4.0.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 5.3.2.1 Ensure active authselect profile includes pam modules | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 5.3.2.1 Ensure active authselect profile includes pam modules | CIS AlmaLinux OS 8 v4.0.0 L1 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 5.3.18 Ensure SSH LoginGraceTime is set to one minute or less | CIS Red Hat 6 Server L1 v3.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.3.20 Ensure SSH LoginGraceTime is set to one minute or less | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.4 Disable Moving or Resizing of Windows via Scripts | CIS Mozilla Firefox 102 ESR Linux L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.4.2 Ensure lockout for failed password attempts is configured - system-auth | CIS Red Hat 6 Workstation L1 v3.0.0 | Unix | ACCESS CONTROL |
| 5.25 Restrict container from acquiring additional privileges | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.25 Restrict container from acquiring additional privileges | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.4 Ensure directory in context.xml is a secure location | CIS Apache Tomcat 11 v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| AIOS-13-013000 - Apple iOS/iPadOS must implement the management setting: disable AirDrop. | AirWatch - DISA Apple iOS/iPadOS 13 v2r1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| AIOS-13-013000 - Apple iOS/iPadOS must implement the management setting: disable AirDrop. | MobileIron - DISA Apple iOS/iPadOS 13 v2r1 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| AMLS-L3-000160 - If Border Gateway Protocol (BGP) is enabled on The Arista Multilayer Switch, The Arista Multilayer Switch must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway. | DISA STIG Arista MLS DCS-7000 Series RTR v1r4 | Arista | ACCESS CONTROL |
| F5BI-DM-000290 - If the BIG-IP appliance is being used to authenticate users for web applications, the HTTPOnly flag must be set. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| JBOS-AS-000010 - HTTP management session traffic must be encrypted. | DISA JBoss Enterprise Application Platform 6.3 STIG v2r6 | Unix | ACCESS CONTROL |
| OH12-1X-000056 - OHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of when an event occurred. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-10-200560 - RHEL 10 must have the USBGuard package installed. | DISA Red Hat Enterprise Linux 10 STIG v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| SHPT-00-000441 - SharePoint must protect audit information from unauthorized deletion of trace log files. | DISA STIG SharePoint 2010 v1r9 | Windows | AUDIT AND ACCOUNTABILITY |
| SonicWALL - Client AV Enforcement On - DMZ | TNS SonicWALL v5.9 | SonicWALL | SYSTEM AND INFORMATION INTEGRITY |
| SonicWALL - Client AV Enforcement On - LAN | TNS SonicWALL v5.9 | SonicWALL | SYSTEM AND INFORMATION INTEGRITY |
| VCEM-67-000029 - ESX Agent Manager must be configured with the appropriate ports. | DISA STIG VMware vSphere 6.7 EAM Tomcat v1r4 | Unix | CONFIGURATION MANAGEMENT |
| VCLD-67-000016 - VAMI must only load allowed server modules - mod_accesslog | DISA STIG VMware vSphere 6.7 VAMI-lighttpd v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCLD-67-000016 - VAMI must only load allowed server modules - mod_setenv | DISA STIG VMware vSphere 6.7 VAMI-lighttpd v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-67-000028 - Performance Charts must be configured with the appropriate ports - https | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-67-000028 - The Security Token Service must be configured with the appropriate ports - http | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| WN12-CC-000038 - The Internet File Association service must be turned off. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-CC-000038 - The Internet File Association service must be turned off. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WPAW-00-001300 - A Windows PAW used to manage domain controllers and directory services must not be used to manage any other type of high-value IT resource. | DISA Microsoft Windows PAW STIG v3r2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
