| 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.6 SQLI-22-004100 | CIS Microsoft SQL Server 2022 Instance STIG v1.0.0 CAT II MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 1.6 VCEM-80-000034 | CIS VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.6 VCPF-80-000034 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.11 VCST-80-000065 | CIS VMware vSphere 8.0 vCenter Appliance Secure Token Service STS STIG v1.0.0 CAT II | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.13 VCPF-80-000070 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.13 VCUI-80-000070 | CIS VMware vSphere 8.0 vCenter Appliance User Interface UI STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.17 VCUI-80-000126 | CIS VMware vSphere 8.0 vCenter Appliance User Interface UI STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.19 VCPF-80-000129 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.24 VCPF-80-000138 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.24 VCST-80-000139 | CIS VMware vSphere 8.0 vCenter Appliance Secure Token Service STS STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.24 VCUI-80-000138 | CIS VMware vSphere 8.0 vCenter Appliance User Interface UI STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.25 VCPF-80-000139 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS SQL Server 2008 R2 DB Engine L1 v1.7.0 | MS_SQLDB | ACCESS CONTROL |
| 2.5 Ensure that the --peer-client-cert-auth argument is set to true | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 3.1.3 Ensure that the kubelet configuration file has permissions set to 644 | CIS Google Kubernetes Engine GKE v2.0.0 L1 Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.4 Ensure that the kubelet configuration file ownership is set to root:root | CIS Google Kubernetes Engine GKE v2.0.0 L1 Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.15 Disable TCP Reverse IP Source Routing - Check tcp_rev_src_routes value. Expected value: 0. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.17 Set Maximum Number of Incoming Connections - Check tcp_conn_req_max_q value. Expected value: 1024. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.18 Lock down dtspcd(8) - Check tcp_extra_priv_ports_add value. Expected value: 6112. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1 Ensure the cluster-admin ClusterRole is only used when required | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | ACCESS CONTROL |
| 4.1.6 Avoid granting cluster admin level access through the system:masters group | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | ACCESS CONTROL |
| 4.1.6 Avoid granting cluster admin level access through the system:masters group | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L1 | GCP | ACCESS CONTROL |
| 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L1 | GCP | ACCESS CONTROL |
| 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | ACCESS CONTROL |
| 4.1.9 Avoid binding RBAC roles to all authenticated users | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L1 | GCP | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 4.3 Ensure 'CHECK_POLICY' Option is set to 'ON' for All SQL Authenticated Logins | CIS SQL Server 2017 Database L1 DB v1.3.0 | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 4.3 Ensure 'CHECK_POLICY' Option is set to 'ON' for All SQL Authenticated Logins | CIS SQL Server 2016 Database L1 DB v1.4.0 | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 4.3 Ensure 'CHECK_POLICY' Option is set to 'ON' for All SQL Authenticated Logins | CIS SQL Server 2017 Database L1 AWS RDS v1.3.0 | MS_SQLDB | IDENTIFICATION AND AUTHENTICATION |
| 4.3.1 Enable NetworkPolicy enforcement with GKE Dataplane V2 or Calico | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.1 Use namespaces to separate workload administration and resource governance | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.1 Use namespaces to separate workload administration and resource governance | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L1 | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.9 Ensure that management plane traffic is separated from data plane traffic | CIS Docker v1.8.0 L1 Docker Swarm | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.3 Ensure 'super_priv' is Not Set to 'Y' for Replication Users | CIS Oracle MySQL Enterprise Edition 8.4 v1.1.0 L1 MySQL RDBMS on Linux MySQLDB | MySQLDB | ACCESS CONTROL |
| SQL6-D0-003300 - SQL Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components. | DISA MS SQL Server 2016 Database STIG v3r5 | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| SQL6-D0-004100 - SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQLI-22-004100 - SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration. | DISA Microsoft SQL Server 2022 Instance STIG v1r4 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| VCEM-67-000022 - ESX Agent Manager must set the welcome-file node to a default web page. | DISA STIG VMware vSphere 6.7 EAM Tomcat v1r4 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCEM-80-000139 - The vCenter ESX Agent Manager service must have Autodeploy disabled. | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | CONFIGURATION MANAGEMENT |
| VCLU-70-000004 - Lookup Service must protect cookies from cross-site scripting (XSS) - XSS. | DISA STIG VMware vSphere 7.0 Lookup Service v1r2 | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| VCLU-80-000139 - The vCenter Lookup service must have Autodeploy disabled. | DISA VMware vSphere 8.0 vCenter Appliance Lookup Service STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-80-000065 - The vCenter Perfcharts service must set URIEncoding to UTF-8. | DISA VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v2r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCPF-80-000138 - The vCenter Perfcharts service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-67-000001 - The Security Token Service must limit the amount of time that each TCP connection is kept alive. | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | ACCESS CONTROL |
| VCST-80-000138 The vCenter STS service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| VCST-80-000139 The vCenter STS service must have Autodeploy disabled. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| VCST-80-000140 The vCenter STS service xpoweredBy attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| VCUI-80-000001 The vCenter UI service must limit the number of maximum concurrent connections permitted. | DISA VMware vSphere 8.0 vCenter Appliance User Interface (UI) STIG v2r1 | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| VCUI-80-000140 The vCenter UI service xpoweredBy attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance User Interface (UI) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| WBSP-AS-001770 - The WebSphere Application Server must use FIPS 140-3-approved encryption modules when authenticating users and processes. | DISA IBM WebSphere Traditional 9 Windows STIG v2r1 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
