| 1.4.1 Ensure 'Enable EDR in block mode' is set to 'Enabled' | CIS Microsoft Defender Antivirus v1.0.0 L1 Server | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.20 CISC-RT-000260 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.21 CISC-RT-000270 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.38 MADB-10-004400 | CIS MariaDB Enterprise 10.x STIG v1.1.0 CAT I Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.75 O365-OU-000007 | CIS Microsoft Office 365 ProPlus STIG v1.1.0 CAT II | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.1.2 Ensure the Time Service Is Enabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.2.2 Ensure the Time Service Is Enabled | CIS Apple macOS 14.0 Sonoma v3.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3.2.2 Ensure the Time Service Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.2 Configure Security Auditing Flags per local organizational requirements - 'audit successful/failed administrative events' | CIS Apple macOS 10.13 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.2 Configure Security Auditing Flags per local organizational requirements - 'audit successful/failed file attribute modification events' | CIS Apple macOS 10.13 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.2 Configure Security Auditing Flags per local organizational requirements - 'audit successful/failed login/logout events' | CIS Apple macOS 10.13 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Set Archive Log Failover Retry Limit (NUMARCHRETRY) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.3 Ensure excessive function privileges are revoked | CIS PostgreSQL 10 OS v1.0.0 | Unix | ACCESS CONTROL |
| 4.3 Ensure excessive function privileges are revoked | CIS PostgreSQL 11 OS v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.1.1 Secure Home Folders | CIS Apple OSX 10.9 L1 v1.3.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.3.2 Ensure lockout for failed password attempts is configured | CIS SUSE Linux Enterprise 12 v3.2.1 L1 Server | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.3.2 Ensure lockout for failed password attempts is configured | CIS SUSE Linux Enterprise 12 v3.2.1 L1 Workstation | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 6.1.1 Audit system file permissions | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 18.4.6 (L2) Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Microsoft Windows 8.1 v2.4.1 L2 | Windows | CONFIGURATION MANAGEMENT, RISK ASSESSMENT |
| 18.4.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Windows 7 Workstation Level 2 + Bitlocker v3.2.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Windows 7 Workstation Level 2 v3.2.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.5 (L2) Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows Server 2016 v4.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.5.5 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows Server 2019 Stand-alone v4.0.0 L2 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ALMA-09-021470 - AlmaLinux OS 9 SSH daemon must disable remote X connections for interactive users. | DISA Cloud Linux AlmaLinux OS 9 STIG v1r7 | Unix | CONFIGURATION MANAGEMENT |
| ARBA-ND-000267 - AOS must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | MAINTENANCE, SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-001270 - A BIND 9.x server NSEC3 must be used for all internal DNS zones. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001530 - The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| BIND-9X-001720 - A BIND 9.x server implementation must be running in a chroot(ed) directory structure. | DISA BIND 9.x STIG v3r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-001770 - A BIND 9.x server must provide secure delegation to all child zones. | DISA BIND 9.x STIG v3r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-002440 - The BIND 9.x server implementation must have QNAME minimization set to "strict". | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| CD16-00-004400 - PostgreSQL must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| CISC-RT-000260 - The Cisco perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations. | DISA Cisco IOS XE Router RTR STIG v3r5 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000270 - The Cisco perimeter router must be configured to block inbound packets with source Bogon IP address prefixes. | DISA Cisco IOS Router RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000270 - The Cisco perimeter switch must be configured to block inbound packets with source Bogon IP address prefixes. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000530 - The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core. | DISA Cisco IOS Router RTR STIG v3r4 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTAVSEL-111 - The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when programs and jokes are found. | McAfee Virus Scan Enterprise for Linux 1.9x/2.0x Managed Client v1r5 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN000700 - User passwords must be changed at least every 60 days. | DISA STIG for Red Hat Enterprise Linux 5 v1r18 Audit | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN003800 - Inetd or xinetd logging/tracing must be enabled. | DISA STIG Solaris 10 SPARC v2r4 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN007960 - The ldd command must be disabled unless it protects against the execution of untrusted files - ldd command must be disabled unless it protects against the execution of untrusted files. | DISA STIG for Oracle Linux 5 v2r1 | Unix | CONFIGURATION MANAGEMENT |
| GOOG-17-008100 - Google Android 17 must be configured to disable ad hoc wireless client-to-client connection capability. | MobileIron - DISA Google Android 17 COBO STIG v1r1 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| MADB-10-004400 - MariaDB must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations. | DISA MariaDB Enterprise 10.x STIG v2r5 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| MS.EXO.1.1v1 - Automatic forwarding to external domains SHALL be disabled. | CISA SCuBA Microsoft 365 Exchange Online v1.5.0 | microsoft_azure | ACCESS CONTROL, SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| OH12-1X-000025 - OHS must have a SSL log format defined to allow generated information to be used by external applications or entities to monitor and control remote access in accordance with the categorization of data hosted by the web server. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | ACCESS CONTROL |
| OH12-1X-000070 - OHS must have a SSL log format defined to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-07-010342 - The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using 'sudo' - sudo. | DISA Red Hat Enterprise Linux 7 STIG v3r15 | Unix | ACCESS CONTROL |
| SLEM-05-231030 - SLEM 5 file systems that are being imported via Network File System (NFS) must be mounted to prevent binary files from being executed. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | CONFIGURATION MANAGEMENT |
| SLEM-05-231035 - SLEM 5 file systems that are used with removable media must be mounted to prevent files with the setuid and setgid bit set from being executed. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | CONFIGURATION MANAGEMENT |
| SLEM-05-232105 - All SLEM 5 world-writable directories must be group-owned by root, sys, bin, or an application group. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | CONFIGURATION MANAGEMENT |
| SLEM-05-411050 - SLEM 5 must never automatically remove or disable emergency administrator accounts. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | ACCESS CONTROL |
