| 1.2.5.1.13 (L1) Ensure 'Saved from URL' is set to 'Enabled' | CIS Microsoft Intune for Office v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.3 (L1) Ensure 'Control use of insecure content exceptions' is set to 'Enabled: Do not allow any site to load blockable mixed content' | CIS Microsoft Intune for Edge v1.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.6 (L1) Ensure 'Control use of the File System API for writing' is set to 'Enabled: Don't allow any site to request write access to files and directories' | CIS Microsoft Edge v4.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.6 (L1) Ensure 'Control use of the File System API for writing' is set to 'Enabled: Don't allow any site to request write access to files and directories' | CIS Microsoft Intune for Edge v1.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.16 (L1) Ensure 'Enable globally scoped HTTP auth cache' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.27 O365-CO-000025 | CIS Microsoft Office 365 ProPlus STIG v1.1.0 CAT II | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.57 EX19-MB-000198 | CIS Microsoft Exchange 2019 Mailbox Server STIG v1.0.0 CAT II | Windows | CONFIGURATION MANAGEMENT |
| 1.103 (L1) Ensure 'Enable site isolation for every site' is set to 'Enabled' | CIS Microsoft Intune for Edge v1.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.104 (L1) Ensure 'Enable site isolation for every site' is set to 'Enabled' | CIS Microsoft Edge v4.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.2.24 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | ACCESS CONTROL |
| 2.2.24 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | ACCESS CONTROL |
| 2.3.5 (L2) Ensure 'Control use of the File System API for reading' is set to 'Enabled: Do not allow any site to request read access to files and directories via the File System API' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.14 (L1) Ensure 'Require Site Isolation for every site' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 2.51 (L1) Ensure 'Enable globally scoped HTTP auth cache' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 2.78 (L1) Ensure 'Require Site Isolation for every site' is set to 'Enabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 2.94 (L1) Ensure 'Allow socket pool size randomization for proxies' is set to 'Enabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 3.2 Ensure 'debug' is turned off - Default | CIS IIS 10 v1.2.1 Level 2 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 3.6 Ensure 'httpcookie' mode is configured for session state - Applications | CIS IIS 10 v1.2.1 Level 2 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 3.6 Ensure 'httpcookie' mode is configured for session state - Default | CIS IIS 10 v1.2.1 Level 2 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 3.18 Only enable Web server if absolutely necessary - Ensure file /etc/rc3.d/S50apache does NOT exist. | CIS Solaris 9 v1.3 | Unix | CONFIGURATION MANAGEMENT |
| 4.6 Ensure 'HTTP Trace Method' is disabled - Applications | CIS IIS 7 L1 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.6 Ensure 'HTTP Trace Method' is disabled - Default | CIS IIS 7 L1 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 6.3.4 Ensure Prevent Cross-site Tracking in Safari Is Enabled | CIS Apple macOS 14.0 Sonoma v3.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.4 Ensure Prevent Cross-site Tracking in Safari Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.4 Ensure Prevent Cross-site Tracking in Safari Is Enabled | CIS Apple macOS 15.0 Sequoia v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2.5 Ensure Prevent Cross-site Tracking in Safari Is Enabled | CIS Apple macOS 12.0 Monterey v4.0.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.1 Apply Applicable Updates | CIS BIND DNS v3.0.1 Authoritative Name Server | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 8.1 Apply Applicable Updates | CIS BIND DNS v3.0.1 Caching Only Name Server | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 8.5.1 Set 'Only allow approved domains to use ActiveX controls without prompt' to 'Enabled:Enable' | CIS IE 9 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.1 Apply Applicable Updates | CIS BIND DNS v1.0.0 L1 Caching Only Name Server | Unix | RISK ASSESSMENT |
| 9.1 Apply Applicable Updates | CIS BIND DNS v1.0.0 L1 Authoritative Name Server | Unix | RISK ASSESSMENT |
| ARBA-NT-000850 - The network element must authenticate all network-connected endpoint devices before establishing any connection. | DISA HPE Aruba Networking AOS Wireless STIG v1r2 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-VN-000540 - AOS, when used as a VPN Gateway, must uniquely identify all network-connected endpoint devices before establishing a connection. | DISA HPE Aruba Networking AOS VPN STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-VN-001370 - AOS, when used as a VPN Gateway, must authenticate all network-connected endpoint devices before establishing a connection. | DISA HPE Aruba Networking AOS VPN STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| DTBI042 - Userdata persistence must be disallowed (Internet zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI132 - Userdata persistence must be disallowed (Restricted Sites zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTOO282 - Outlook - RSS Feeds must be disallowed. | DISA Microsoft Outlook 2010 STIG v1r14 | Windows | CONFIGURATION MANAGEMENT |
| FFOX-00-000013 - Firefox must be configured to disable the installation of extensions. | DISA STIG Mozilla Firefox MacOS v6r8 | Unix | CONFIGURATION MANAGEMENT |
| FFOX-00-000013 - Firefox must be configured to disable the installation of extensions. | DISA Mozilla Firefox STIG v6r8 Windows | Windows | CONFIGURATION MANAGEMENT |
| Prevent certificate error overrides | MSCT Windows 10 v20H2 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Prevent certificate error overrides | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| SHPT-00-000480 - When configuring Central Administration, the port number selected must comply with DoD Ports and Protocol Management (PPSM) program requirements. | DISA STIG SharePoint 2010 v1r9 | Windows | CONFIGURATION MANAGEMENT |
| SP13-00-000190 - When configuring SharePoint Central Administration, the port number selected must comply with DoD Ports and Protocol Management (PPSM) program requirements. | DISA Microsoft SharePoint 2013 STIG v2r4 | Windows | CONFIGURATION MANAGEMENT |
| VCSA-70-000077 - The vCenter Server must enable FIPS-validated cryptography. | DISA STIG VMware vSphere 7.0 vCenter v1r3 | VMware | IDENTIFICATION AND AUTHENTICATION, MAINTENANCE, SYSTEM AND COMMUNICATIONS PROTECTION |
| WA00545 W22 - Web server options for the OS root must be disabled. | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | CONFIGURATION MANAGEMENT |
| WG110 A22 - The number of allowed simultaneous requests must be set. | DISA STIG Apache Site 2.2 Unix v1r11 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WG110 A22 - The number of allowed simultaneous requests must be set. | DISA STIG Apache Site 2.2 Unix v1r11 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WG110 W22 - The number of allowed simultaneous requests must be set. | DISA STIG Apache Site 2.2 Windows v1r13 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WG145 A22 - The private web server must use an approved DoD certificate validation process. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG145 A22 - The private web server must use an approved DoD certificate validation process. | DISA STIG Apache Server 2.2 Unix v1r11 | Unix | |
