| 1.78 SQLI-22-018100 | CIS Microsoft SQL Server 2022 Instance STIG v1.0.0 CAT I MS_SQLDB | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 2.4 Ensure nonessential services are removed or masked | CIS Fedora 19 Family Linux Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Ensure nonessential services are removed or masked | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Ensure nonessential services are removed or masked | CIS SUSE Linux Enterprise 12 v3.2.1 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Ensure there are no 'other' writable objects | CIS IBM AIX 7.1 L1 v2.1.0 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.4 Set 'Turn on ActiveX Filtering' to 'Enabled' | CIS IE 9 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Configure TLS authentication for Docker daemon - tlscert | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Configure TLS authentication for Docker daemon '--tlskey'' | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.5.28 telnet | CIS IBM AIX 7.1 L1 v2.1.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.3.2.13 Ensure timed is not in use | CIS IBM AIX 7 v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 5.7 Do not enable the "root" account | CIS Apple OSX 10.9 L1 v1.3.0 | Unix | ACCESS CONTROL |
| DKER-EE-001880 - The Docker Enterprise self-signed certificates in Docker Trusted Registry (DTR) must be replaced with DoD trusted, signed certificates. | DISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r2 | Unix | CONFIGURATION MANAGEMENT |
| F5BI-DM-300046 - The F5 BIG-IP appliance must be configured to use multifactor authentication (MFA) for interactive logins. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION |
| Microsoft network server: Server SPN target name validation level | MSCT Windows 10 v1507 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| TCAT-AS-000030 - HTTP Strict Transport Security (HSTS) must be enabled. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL |
| TCAT-AS-000050 - AccessLogValve must be configured for each application context. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000070 - Cookies must have secure flag set. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL |
| TCAT-AS-000080 - Cookies must have http-only flag set. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL |
| TCAT-AS-000170 - Tomcat servers behind a proxy or load balancer must log client IP. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000260 - HTTP status code must be logged. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000270 - The first line of request must be logged. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000360 - $CATALINA_BASE/logs folder permissions must be set to 750. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000361 - Files in the $CATALINA_BASE/logs/ folder must have their permissions set to 640. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000390 - $CATALINA_HOME/bin folder permissions must be set to 750. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| TCAT-AS-000510 - DefaultServlet debug parameter must be disabled. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000520 - DefaultServlet directory listings parameter must be disabled. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000540 - Autodeploy must be disabled. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000570 - Tomcat default ROOT web application must be removed. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000590 - Applications in privileged mode must be approved by the ISSO. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-000600 - Tomcat management applications must use LDAP realm authentication. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-000630 - TLS must be enabled on JMX. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-000710 - Keystore file must be protected. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-000750 - Tomcat must use FIPS-validated ciphers on secured connectors. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| TCAT-AS-000860 - Clusters must operate on a trusted network. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| TCAT-AS-000920 - ErrorReportValve showServerInfo must be set to false. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | SYSTEM AND INFORMATION INTEGRITY |
| TCAT-AS-001060 - Tomcat user account must be a non-privileged user. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL |
| TCAT-AS-001080 - Application user name must be logged. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL |
| TCAT-AS-001200 - $CATALINA_HOME folder must be owned by the root user, group tomcat. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001270 - $CATALINA_BASE/temp folder permissions must be set to 750. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001280 - $CATALINA_BASE/work/ folder must be owned by tomcat user, group tomcat. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001460 - The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| TCAT-AS-001470 - Tomcat server must be patched for security vulnerabilities. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| TCAT-AS-001560 - AccessLogValve must be configured for Catalina engine. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| TCAT-AS-001591 - Changes to $CATALINA_BASE/conf/ folder must be logged. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-001592 - Changes to $CATALINA_HOME/lib/ folder must be logged. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| TCAT-AS-001660 - STRICT_SERVLET_COMPLIANCE must be set to true. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001670 - RECYCLE_FACADES must be set to true. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001680 - ALLOW_BACKSLASH must be set to false. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001700 - Tomcat users in a management role must be approved by the ISSO. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| TCAT-AS-001710 - Hosted applications must be documented in the system security plan. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
