| 1.3.2 Ensure permissions on bootloader config are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.8.4 Ensure XDCMP is not enabled | CIS CentOS 6 Server L1 v3.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.13.5 Ensure 'Allow Active X One Off Forms' is set to Enabled:Load only Outlook Controls | CIS Microsoft Office Outlook 2016 v1.1.0 Level 1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.21 CISC-RT-000270 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.47 CISC-RT-000530 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.53 CISC-RT-000510 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | ACCESS CONTROL |
| 1.55 CISC-RT-000530 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.2 Ensure the Time Service Is Enabled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.2.1.2 Ensure the Time Service Is Enabled | CIS Apple macOS 15.0 Sequoia Cloud-tailored v1.0.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3 Disable the Proxy ARP Function - a) No proxy | Tenable ZTE JINOS | ZTE_JINOS | CONFIGURATION MANAGEMENT |
| 2.3 Disable the Proxy ARP Function - c) No proxy local | Tenable ZTE JINOS | ZTE_JINOS | CONFIGURATION MANAGEMENT |
| 2.3.2.2 Ensure the Time Service Is Enabled | CIS Apple macOS 13.0 Ventura v4.0.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.11 Set Archive Log Failover Retry Limit (NUMARCHRETRY) | CIS IBM DB2 11 v1.2.0 Windows OS Level 1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.3 Ensure excessive function privileges are revoked | CIS PostgreSQL 9.6 DB v1.0.0 | PostgreSQLDB | ACCESS CONTROL |
| 4.4 Ensure excessive function privileges are revoked | CIS PostgreSQL 9.5 DB v1.1.0 | PostgreSQLDB | ACCESS CONTROL |
| 4.5.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.1 Ensure Password Account Lockout Threshold Is Configured | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL |
| 5.14 Ensure Browser Framing Is Restricted | CIS Apache HTTP Server 2.2 L2 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 6.11 Ensure all HTTP Header Logging options are enabled | CIS Palo Alto Firewall 11 v1.2.0 L1 | Palo_Alto | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.7 App Store Automatically download apps purchased on other Macs Considerations | CIS Apple OSX 10.11 El Capitan L2 v1.1.0 | Unix | |
| 18.4.5 (L2) Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Microsoft Windows Server 2008 R2 Domain Controller Level 2 v3.3.1 | Windows | CONFIGURATION MANAGEMENT |
| 18.5.5 (L2) Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Windows Server 2012 R2 DC L2 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.5 (L2) Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Windows Server 2012 DC L2 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.5 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows 10 Enterprise v5.0.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-001400 - On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001430 - The BIND 9.x server implementation must implement internal/external role separation. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations. | DISA Cisco IOS Router RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes. | DISA Cisco IOS XE Router RTR STIG v3r5 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000510 - The Cisco BGP switch must be configured to reject inbound route advertisements from a customer edge (CE) switch for prefixes that are not allocated to that customer. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | ACCESS CONTROL |
| CISC-RT-000530 - The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes belonging to the IP core. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000560 - The Cisco BGP switch must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-DM-300010 - The F5 BIG-IP appliance must be configured to assign appropriate user roles or access levels to authenticated users. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GEN003800 - Inetd or xinetd logging/tracing must be enabled. | DISA STIG Solaris 10 X86 v2r4 | Unix | AUDIT AND ACCOUNTABILITY |
| MD3X-00-000380 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations. | DISA STIG MongoDB Enterprise Advanced 3.x v2r3 OS | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000046 - OHS must have a SSL log format defined to generate adequate logs by system startup and shutdown, system access, and system authentication events. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| OH12-1X-000052 - OHS must have a SSL log format defined for log records generated to capture sufficient information to establish what type of events occurred. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| OH12-1X-000055 - OHS must have a SSL log format defined for log records generated to capture sufficient information to establish when an event occurred. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| OH12-1X-000061 - OHS must have a SSL log format defined for log records that allow the establishment of the source of events. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| OL6-00-000536 - The Oracle Linux operating system must use the invoking user's password for privilege escalation when using 'sudo' - rootpw | DISA STIG Oracle Linux 6 v2r7 | Unix | ACCESS CONTROL |
| OL07-00-010342 - The Oracle Linux operating system must use the invoking user's password for privilege escalation when using 'sudo' - sudo. | DISA Oracle Linux 7 STIG v3r5 | Unix | ACCESS CONTROL |
| OL08-00-010383 - OL 8 must use the invoking user's password for privilege escalation when using "sudo". | DISA Oracle Linux 8 STIG v2r9 | Unix | CONFIGURATION MANAGEMENT |
| SLEM-05-432010 - SLEM 5 must use the invoking user's password for privilege escalation when using "sudo". | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | CONFIGURATION MANAGEMENT |
| SLEM-05-654130 - SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| SLEM-05-654135 - SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| SLES-15-020103 - The SUSE operating system must use the invoking user's password for privilege escalation when using "sudo". | DISA SUSE Linux Enterprise Server 15 STIG v2r6 | Unix | CONFIGURATION MANAGEMENT |
| Telnet vs. Secure Shell - idle-timeout | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | ACCESS CONTROL |
| Telnet vs. Secure Shell - ip ssh | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | CONFIGURATION MANAGEMENT |
| Telnet vs. Secure Shell - no telnet-server | ArubaOS Switch 16.x Hardening Guide v1.0.0 | ArubaOS | CONFIGURATION MANAGEMENT |
