| 4.2.4 Enable AI /heuristic based malware detection | CIS FortiGate 7.4.x v1.0.1 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| WN25-00-000040 - Windows Server 2025 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000060 - Windows Server 2025 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000090 - Windows Server 2025 systems must have a Trusted Platform Module (TPM) enabled and ready for use. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000220 - Windows Server 2025 system files must be monitored for unauthorized changes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000260 - Windows Server 2025 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-00-000332 - Windows Server 2025 must not have Wi-Fi enabled unless required by the organization. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000340 - Windows Server 2025 must not have the Peer Name Resolution Protocol installed. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000360 - Windows Server 2025 must not have the Telnet Client installed. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-00-000380 - Windows Server 2025 must not have the Server Message Block (SMB) v1 protocol installed. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-AU-000110 - Windows Server 2025 must be configured to audit Account Management - User Account Management successes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000150 - Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout successes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000160 - Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout failures. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000260 - Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change successes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000300 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000310 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-CC-000080 - Windows Server 2025 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-CC-000110 - Windows Server 2025 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-CC-000250 - Windows Server 2025 Telemetry must be configured to limit diagnostic data sent to Microsoft. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-CC-000470 - Windows Server 2025 Windows Remote Management (WinRM) client must not use Basic authentication. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | MAINTENANCE |
| WN25-CC-000480 - Windows Server 2025 Windows Remote Management (WinRM) client must not allow unencrypted traffic. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | MAINTENANCE |
| WN25-CC-000490 - Windows Server 2025 Windows Remote Management (WinRM) client must not use Digest authentication. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | MAINTENANCE |
| WN25-DC-000080 - Windows Server 2025 Active Directory SYSVOL directory must have the proper access control permissions. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-DC-000100 - Windows Server 2025 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-DC-000130 - Windows Server 2025 domain controllers must run on a machine dedicated to that function. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-DC-000170 - Windows Server 2025 Active Directory Group Policy Objects (GPOs) must be configured with proper audit settings. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000260 - Windows Server 2025 must be configured to audit DS Access - Directory Service Changes successes. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000270 - Windows Server 2025 must be configured to audit DS Access - Directory Service Changes failures. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000320 - Windows Server 2025 domain controllers must require LDAP access signing. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-DC-000340 - The Windows Server 2025 'Access this computer from the network' user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-DC-000350 - The Windows Server 2025 'Add workstations to domain' user right must only be assigned to the Administrators group on domain controllers. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-PK-000010 - Windows Server 2025 must have the DoW Root Certificate Authority (CA) certificates installed in the Trusted Root Store. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SH-000010 - Windows Server 2025 networked systems must have and implement OpenSSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SH-000070 - Windows Server 2025 OpenSSH must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL, MAINTENANCE, SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SH-000080 - The Windows Server 2025 OpenSSH configuration file must conform to minimum requirements. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SH-000090 - Windows Server 2025 OpenSSH private host key files must conform to minimum requirements. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000020 - Windows Server 2025 must prevent local accounts with blank passwords from being used from the network. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000050 - Windows Server 2025 must force audit policy subcategory settings to override audit policy category settings. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | AUDIT AND ACCOUNTABILITY |
| WN25-SO-000120 - Windows Server 2025 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-SO-000220 - Windows Server 2025 must not allow anonymous enumeration of Security Account Manager (SAM) accounts. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000270 - Windows Server 2025 must prevent NTLM from falling back to a Null session. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000280 - Windows Server 2025 must prevent PKU2U authentication using online identities. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000310 - Windows Server 2025 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000420 - Windows Server 2025 User Account Control (UAC) must be configured to detect application installations and prompt for elevation. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-UC-000010 - Windows Server 2025 must preserve zone information when saving attachments. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | CONFIGURATION MANAGEMENT |
| WN25-UR-000090 - The Windows Server 2025 'Create symbolic links' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-UR-000130 - The Windows Server 2025 'Impersonate a client after authentication' user right must only be assigned to Administrators, Service, Local Service, and Network Service. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-UR-000140 - The Windows Server 2025 'Increase scheduling priority' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-UR-000200 - The Windows Server 2025 'Profile single process' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
| WN25-UR-000210 - The Windows Server 2025 'Restore files and directories' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
