| 1.1.2.6 Ensure 'Enable RPC encryption' is set to Enabled | CIS Microsoft Office Outlook 2016 v1.1.0 Level 1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.2.6 Ensure 'Enable RPC encryption' is set to Enabled | CIS Microsoft Office Outlook 2013 v1.1.0 Level 1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.22 Ensure that the --request-timeout argument is set | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 1.130 WN19-CC-000370 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL |
| 2.1.20 Ensure a graphical user interface is not in use | CIS Red Hat Enterprise Linux 9 v3.0.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.2.10 Ensure 'SQLNET.CRYPTO_CHECKSUM_CLIENT' Is Set To 'REQUIRED' | CIS Oracle Database 23ai v1.1.0 L1 RDBMS On Windows Server Host OS Windows | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.41 Ensure 'Perform volume maintenance tasks' is set to 'Administrators' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.41 Ensure 'Perform volume maintenance tasks' is set to 'Administrators' | CIS Microsoft Windows Server 2025 v2.1.0 L1 DC | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.9.5 (L1) Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.9.5 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.19 Set 'Require client MAPI encryption' to 'True' | CIS Microsoft Exchange Server 2013 CAS v1.1.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6 Do not run ssh within containers | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.12 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 5.12 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.13 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.13 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 5.13 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 6.12.2 Ensure At Least 2 External SYSLOG Hosts are Set with Any/Info | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | AUDIT AND ACCOUNTABILITY |
| 10.3 Ensure the LimitRequestFieldsize Directive is Set to 1024 or Less | CIS Apache HTTP Server 2.2 L2 v3.6.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 18.10.57.3.2.1 (L2) Ensure 'Restrict Remote Desktop Services users to a single Remote Desktop Services session' is set to 'Enabled' | CIS Windows Server 2012 DC L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.2.1 Ensure 'Restrict Remote Desktop Services users to a single Remote Desktop Services session' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.2.1 Ensure 'Restrict Remote Desktop Services users to a single Remote Desktop Services session' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.8 Ensure 'Restrict clipboard transfer from server to client' is set to 'Enabled: Disable clipboard transfers from server to client' | CIS Microsoft Windows Server 2025 v2.1.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| AS24-U1-000620 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths. | DISA STIG Apache Server 2.4 Unix Server v3r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| AS24-W1-000620 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths. | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| AS24-W1-000740 - The Apache web server must use a logging mechanism that is configured to provide a warning to the Information System Security Officer (ISSO) and System Administrator (SA) when allocated record storage volume reaches 75 percent of maximum log record storage capacity - SA when allocated record storage volume reaches 75% of maximum log record storage capacity. | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| AS24-W1-000740 - The Apache web server must use a logging mechanism that is configured to provide a warning to the Information System Security Officer (ISSO) and System Administrator (SA) when allocated record storage volume reaches 75 percent of maximum log record storage capacity - SA when allocated record storage volume reaches 75% of maximum log record storage capacity. | DISA STIG Apache Server 2.4 Windows Server v3r4 | Windows | AUDIT AND ACCOUNTABILITY |
| BIND-9X-001280 - On the BIND 9.x server, the private keys corresponding to both the zone signing key (ZSK) and the key signing key (KSK) must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| CISC-ND-001030 - The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources. | DISA Cisco IOS XR Router NDM STIG v3r6 | Cisco | AUDIT AND ACCOUNTABILITY |
| FNFG-FW-000050 - The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server. | DISA Fortigate Firewall STIG v1r4 | FortiGate | AUDIT AND ACCOUNTABILITY |
| OL09-00-002323 - OL 9 must securely compare internal information system clocks at least every 24 hours. | DISA Oracle Linux 9 STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-09-215101 - RHEL 9 must have the Postfix package installed. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | ACCESS CONTROL |
| SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Browser' | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | ACCESS CONTROL |
| SQL4-00-015300 - SQL Server security-relevant configuration settings must be monitored to discover unauthorized changes. | DISA STIG SQL Server 2014 Instance DB Audit v2r4 | MS_SQLDB | CONFIGURATION MANAGEMENT |
| SQL6-D0-006500 - SQL Server must limit privileges to change software modules and links to software external to SQL Server. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT |
| VCEM-67-000014 - ESX Agent Manager must not have the Web Distributed Authoring (WebDAV) servlet installed. | DISA STIG VMware vSphere 6.7 EAM Tomcat v1r4 | Unix | CONFIGURATION MANAGEMENT |
| VCLU-80-000034 - The vCenter Lookup service must limit privileges for creating or modifying hosted application shared files. | DISA VMware vSphere 8.0 vCenter Appliance Lookup Service STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-80-000034 - The vCenter Perfcharts service must limit privileges for creating or modifying hosted application shared files. | DISA VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-70-000014 - The Security Token Service must not have the Web Distributed Authoring (WebDAV) servlet installed. | DISA STIG VMware vSphere 7.0 STS Tomcat v1r2 | Unix | CONFIGURATION MANAGEMENT |
| WBLC-08-000237 - Oracle WebLogic must limit the use of resources by priority and not impede the host from servicing processes designated as a higher-priority. | Oracle WebLogic Server 12c Linux v2r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WBLC-10-000271 - Oracle WebLogic must be managed through a centralized enterprise tool. | Oracle WebLogic Server 12c Linux v2r2 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WDNS-AU-000006 - The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions. | DISA Microsoft Windows 2012 Server Domain Name System STIG v2r7 | Windows | AUDIT AND ACCOUNTABILITY |
| WN22-00-000400 - Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000400 - Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SH-000050 - Windows Server 2025 OpenSSH must force a frequent session key renegotiation for SSH connections to the server. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SO-000190 - The Windows Server 2025 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
