| 1.20 SOL-11.1-010310 | CIS Solaris 11 X86 STIG v1.0.0 CAT III | Unix | ACCESS CONTROL |
| 1.31 CISC-RT-000370 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT III | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.32 EX19-MB-000123 | CIS Microsoft Exchange 2019 Mailbox Server STIG v1.0.0 CAT III | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.38 EX19-MB-000129 | CIS Microsoft Exchange 2019 Mailbox Server STIG v1.0.0 CAT III | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.41 EX19-MB-000132 | CIS Microsoft Exchange 2019 Mailbox Server STIG v1.0.0 CAT III | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.45 PHTN-40-000112 | CIS VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v1.0.0 CAT III | Unix | AUDIT AND ACCOUNTABILITY |
| 1.48 CISC-RT-000550 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT III | Cisco | ACCESS CONTROL |
| 1.55 CISC-RT-000540 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | ACCESS CONTROL |
| 1.56 CISC-RT-000540 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT III | Cisco | ACCESS CONTROL |
| 1.56 CISC-RT-000550 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | ACCESS CONTROL |
| 1.77 CISC-RT-000760 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.78 CISC-RT-000760 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT III | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.79 CISC-RT-000860 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT III | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.87 AZLX-23-002080 | CIS Amazon Linux 2023 STIG v1.0.0 CAT III | Unix | AUDIT AND ACCOUNTABILITY |
| 1.88 CISC-RT-000860 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT III | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| AIOS-18-010900 - Apple iOS/iPadOS 18 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device. | AirWatch - DISA Apple iOS/iPadOS 18 v2r3 | MDM | ACCESS CONTROL |
| AIOS-18-011600 - Apple iOS/iPadOS 18 must implement the management setting: not have any Family Members in Family Sharing. | MobileIron - DISA Apple iOS/iPadOS 18 v2r3 | MDM | IDENTIFICATION AND AUTHENTICATION |
| AIOS-26-010900 - Apple iOS/iPadOS 26 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device. | AirWatch - DISA Apple iOS/iPadOS 26 v1r3 | MDM | ACCESS CONTROL |
| AIOS-26-011600 - Apple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing. | MobileIron - DISA Apple iOS/iPadOS 26 v1r3 | MDM | IDENTIFICATION AND AUTHENTICATION |
| APPL-13-001030 - The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity. | DISA STIG Apple macOS 13 v1r5 | Unix | AUDIT AND ACCOUNTABILITY |
| ARST-RT-000060 - The Arista BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute. | DISA Arista MLS EOS 4.X Router STIG v2r2 | Arista | ACCESS CONTROL |
| ARST-RT-000290 - The MPLS router with RSVP-TE enabled must be configured with message pacing or refresh reduction to adjust maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core routers. | DISA STIG Arista MLS EOS 4.2x Router v2r1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-RT-000310 - The PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS DODIN Technical Profile. | DISA STIG Arista MLS EOS 4.2x Router v2r1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-RT-000660 - The Arista multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization. | DISA Arista MLS EOS 4.X Router STIG v2r2 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| AZLX-23-002080 - Amazon Linux 2023 must be configured to off-load audit records onto a different system from the system being audited via syslog. | DISA Amazon Linux 2023 STIG v1r4 | Unix | AUDIT AND ACCOUNTABILITY |
| EDGE-00-000004 - The list of domains for which Microsoft Defender SmartScreen will not trigger warnings must be allowlisted if used. | DISA Microsoft Edge STIG v2r5 | Windows | MAINTENANCE |
| EX19-MB-000123 - Exchange mail quota settings must not restrict sending mail. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000131 - The Exchange Outbound Connection Limit per Domain Count must be controlled. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000132 - The Exchange Outbound Connection Timeout must be 10 minutes or less. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EX19-MB-000142 - The Exchange Global Recipient Count Limit must be set. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| F5BI-AP-000241 - When the Access Profile Type is LTM+APM and it is not using any connectivity resources (such as Network Access, Portal Access, etc.) in the VPE, the F5 BIG-IP appliance must be configured to enable the HTTP Only flag. | DISA F5 BIG-IP Access Policy Manager STIG v2r4 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-000243 - The F5 BIG-IP appliance must be configured to disable the 'Persistent' cookie flag - Persistent cookie flag. | DISA F5 BIG-IP Access Policy Manager STIG v2r4 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-300153 - The F5 BIG-IP appliance must be configured to disable the persistent cookie flag. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| FNFG-FW-000150 - The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected. | DISA Fortigate Firewall STIG v1r4 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| JUEX-RT-000100 - The Juniper router configured for BGP must reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. | DISA Juniper EX Series Switches Router STIG v2r1 | Juniper | ACCESS CONTROL |
| JUEX-RT-000780 - The Juniper multicast Designated Router (DR) must be configured to filter the IGMP and MLD Report messages to allow hosts to join only multicast groups that have been approved by the organization. | DISA Juniper EX Series Switches Router STIG v2r1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| MSFT-11-005200 - The mobile operating system must allow only the Administrator (MDM) to perform the following management function: Enable/disable location services. | AirWatch - DISA Microsoft Android 11 COBO v1r2 | MDM | ACCESS CONTROL |
| PHTN-40-000112 - The Photon operating system must immediately notify the SA and ISSO when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r2 | Unix | AUDIT AND ACCOUNTABILITY |
| SLES-15-010140 - The SUSE operating system must conceal, via the session lock, information previously visible on the display with a publicly viewable image in the graphical user interface (GUI). | DISA SUSE Linux Enterprise Server 15 STIG v2r6 | Unix | ACCESS CONTROL |
| SLES-15-030680 - The SUSE operating system audit event multiplexor must be configured to use Kerberos. | DISA SUSE Linux Enterprise Server 15 STIG v2r6 | Unix | AUDIT AND ACCOUNTABILITY |
| SLES-15-030690 - Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited. | DISA SUSE Linux Enterprise Server 15 STIG v2r8 | Unix | AUDIT AND ACCOUNTABILITY |
| SLES-15-030690 - Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited. | DISA SUSE Linux Enterprise Server 15 STIG v2r6 | Unix | AUDIT AND ACCOUNTABILITY |
| SPLK-CL-000160 - Splunk Enterprise must be configured to send an immediate alert to the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity - at a minimum when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity. | DISA STIG Splunk Enterprise 8.x for Linux v2r3 STIG REST API | Splunk | AUDIT AND ACCOUNTABILITY |
| SYMP-NM-000090 - Symantec ProxySG must generate an alert to the console when a log processing failure is detected such as loss of communications with the Central Log Server or log records are no longer being sent - email addresses | DISA Symantec ProxySG Benchmark NDM v1r2 | BlueCoat | AUDIT AND ACCOUNTABILITY |
| UBTU-20-010021 - Ubuntu 20.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-22-653040 - Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) when the audit record storage volume reaches 25 percent remaining of the allocated capacity. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-24-100450 - Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-24-400340 - Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-24-600180 - Ubuntu 24.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-24-900960 - Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY |
