| 1.6.1.3 Ensure SELinux policy is configured | CIS Amazon Linux v2.1.0 L2 | Unix | ACCESS CONTROL |
| 2.1.1 Ensure centralized root access in AWS Organizations | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL |
| 2.1.5 Ensure delegated admin manages AWS Organizations policies | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.1.6 Ensure delegated admins manage AWS Organizations-integrated services | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2 Maintain current AWS account contact details | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | INCIDENT RESPONSE |
| 2.4 Ensure no 'root' user account access key exists | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.8 Ensure IAM password policy requires minimum length of 14 or greater | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | IDENTIFICATION AND AUTHENTICATION |
| 2.11 Ensure credentials unused for 45 days or more are disabled | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL |
| 2.12 Ensure access keys are rotated every 90 days or less | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL |
| 2.13 Ensure IAM users receive permissions only through groups | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.18 Ensure that IAM External Access Analyzer is enabled for all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION |
| 2.19 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL |
| 2.20 Ensure access to AWSCloudShellFullAccess is restricted | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 2.21 Ensure AWS resource policies do not allow unrestricted access using "Principal": "*" | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 3.1 Ensure 'deployment method retail' is set | CIS IIS 10 v1.2.1 Level 1 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 3.1 Ensure 'deployment method retail' is set | CIS IIS 8.0 v1.5.1 Level 1 | Windows | CONFIGURATION MANAGEMENT |
| 3.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 3.6 Ensure that SharePoint is configured with 'Strict' browser file handling settings | CIS Microsoft SharePoint 2016 OS v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.1 Ensure CloudTrail is enabled in all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 4.6 Ensure 'HTTP Trace Method' is disabled - Applications | CIS IIS 10 v1.2.1 Level 1 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 4.6 Ensure 'HTTP Trace Method' is disabled - Default | CIS IIS 10 v1.2.1 Level 1 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 4.6 Ensure rotation for customer-created symmetric CMKs is enabled | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.7 Ensure Unlisted File Extensions are not allowed - Applications | CIS IIS 7 L1 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.7 Ensure Unlisted File Extensions are not allowed - Default | CIS IIS 7 L1 v1.8.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.10 Ensure security group changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.12 Ensure changes to network gateways are monitored | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 6.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5 Ensure the default security group of every VPC restricts all traffic | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.8 Ensure VPC Endpoints are used for access to AWS Services | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| Access Security - J-Web - Terminate idle connections by setting the idle-time value | Juniper Hardening JunOS 12 Devices Checklist | Juniper | ACCESS CONTROL |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v132 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v133 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v134 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v129 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v140 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v141 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow unconfigured sites to be reloaded in Internet Explorer mode | MSCT Edge v124 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| AS24-U2-000240 - The Apache web server must not perform user management for hosted applications. | DISA STIG Apache Server 2.4 Unix Site v2r6 | Unix | CONFIGURATION MANAGEMENT |
| AS24-U2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files. | DISA STIG Apache Server 2.4 Unix Site v2r6 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| AS24-U2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files. | DISA STIG Apache Server 2.4 Unix Site v2r6 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| Load pictures from Web pages not created in Excel | MSCT Office 2016 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Load pictures from Web pages not created in Excel | MSCT Office 365 ProPlus 1908 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Load pictures from Web pages not created in Excel | MSCT M365 Apps for enterprise 2312 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCEM-70-000024 - ESX Agent Manager must be configured to show error pages with minimal information. | DISA STIG VMware vSphere 7.0 EAM Tomcat v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCEM-70-000030 - ESX Agent Manager must set the secure flag for cookies. | DISA STIG VMware vSphere 7.0 EAM Tomcat v1r2 | Unix | CONFIGURATION MANAGEMENT |
| Web sites in less privileged Web content zones can navigate into this zone - Internet Zone | MSCT Windows 11 v23H2 v1.0.0 | Windows | ACCESS CONTROL |
| Web sites in less privileged Web content zones can navigate into this zone - Internet Zone | MSCT Windows Server 2019 MS v1.0.0 | Windows | ACCESS CONTROL |
| Web sites in less privileged Web content zones can navigate into this zone - Internet Zone | MSCT Windows 10 1803 v1.0.0 | Windows | ACCESS CONTROL |
| WG204 W22 - A web server installation must be segregated from other services. | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | |
| WN10-00-000100 - Internet Information System (IIS) or its subcomponents must not be installed on a workstation. | DISA Microsoft Windows 10 STIG v3r6 | Windows | CONFIGURATION MANAGEMENT |
