| 1.1.8 Session Management | CIS HPE Aruba Networking CX Switch v1.0.1 L1 | ArubaOS | ACCESS CONTROL |
| 1.2 VCEM-80-000005 | CIS VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.2 VCPF-80-000005 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.3.1 Ensure 'Minimum Password Complexity' is enabled | CIS Palo Alto Firewall 8 Benchmark L1 v1.0.0 | Palo_Alto | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 1.6 VCST-80-000034 | CIS VMware vSphere 8.0 vCenter Appliance Secure Token Service STS STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.7.6 Do not admit root containers | CIS Kubernetes 1.11 Benchmark v1.3.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 1.8 VCEM-80-000037 | CIS VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 1.18 VCPF-80-000127 | CIS VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v1.0.0 CAT II | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.25 VCUI-80-000139 | CIS VMware vSphere 8.0 vCenter Appliance User Interface UI STIG v1.0.0 CAT II | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS SQL Server 2012 Database L1 DB v1.6.0 | MS_SQLDB | ACCESS CONTROL |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS SQL Server 2014 Database L1 AWS RDS v1.5.0 | MS_SQLDB | ACCESS CONTROL |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS SQL Server 2017 Database L1 DB v1.3.0 | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0' | CIS SQL Server 2016 Database L1 AWS RDS v1.4.0 | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.4 Disable Response to ICMP Timestamp Requests - Check ip_respond_to_timestamp value. Expected value: 0. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.6 Disable Response to ICMP Netmask Requests - Check ip_respond_to_address_mask_broadcast value. Expected value: 0. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.7 Disable ICMPv6 Redirect Messages - Check ip6_send_redirects value. Expected value: 1. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.8 Disable Response to Broadcast ICMPv4 Echo Request - Check ip_respond_to_echo_broadcast value. Expected value: 0. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.16 Set Maximum Number of Half-open TCP Connections - Check tcp_conn_req_max_q0 value. Expected value: 4096. | CIS Solaris 10 L1 v5.2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.4 Ensure access on /audit and /etc/security/audit is configured | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | IDENTIFICATION AND AUTHENTICATION |
| 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured | CIS Apple macOS 11.0 Big Sur v4.0.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.2 Restrict GKE control plane access with authorized networks | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6.3 Restrict GKE control plane access with authorized networks | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 6.7 Create separate partitions for programs and data | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 9.3 Ensure 'super_priv' is Not Set to 'Y' for Replication Users | CIS MariaDB 10.11 v1.0.0 L1 MariaDB RDBMS MySQLDB | MySQLDB | ACCESS CONTROL |
| 9.3 Ensure 'super_priv' is Not Set to 'Y' for Replication Users | CIS Oracle MySQL Community Server 8.4 v1.1.0 L1 MySQL RDBMS on Linux MySQLDB | MySQLDB | ACCESS CONTROL |
| 9.4 Ensure 'super_priv' is Not Set to 'Y' for Replication Users | CIS Oracle MySQL Community Server 8.0 v1.2.0 L1 MySQL RDBMS MySQLDB | MySQLDB | ACCESS CONTROL |
| 9.4 Ensure 'super_priv' is Not Set to 'Y' for Replication Users | CIS Oracle MySQL Enterprise Edition 8.0 v1.5.0 L1 MySQL RDBMS MySQLDB | MySQLDB | ACCESS CONTROL |
| CISC-L2-000200 - The Cisco switch must have all trunk links enabled statically. | DISA Cisco IOS Switch L2S STIG v3r2 | Cisco | CONFIGURATION MANAGEMENT |
| CNTR-R2-000520 - Configuration and authentication files for Rancher RKE2 must be protected. | DISA Rancher Government Solutions RKE2 STIG v2r7 | Unix | CONFIGURATION MANAGEMENT |
| JUNI-RT-000220 - The Juniper router must be configured to produce audit records containing information to establish the source of the events. | DISA STIG Juniper Router RTR v3r2 | Juniper | AUDIT AND ACCOUNTABILITY |
| JUSX-DM-000164 - The Juniper SRX Services Gateway must implement service redundancy to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| OH12-1X-000186 - The CustomIdentityPrivateKeyPassPhrase property of the Node Manager configured to support OHS must be configured for secure communication. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | CONFIGURATION MANAGEMENT |
| SQL6-D0-013800 - SQL Server must generate audit records when successful and unsuccessful attempts to modify security objects occur. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQLD-22-003300 - SQL Server must implement cryptographic mechanisms to prevent unauthorized modification or disclosure of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components. | DISA Microsoft SQL Server 2022 Database STIG v1r3 | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCEM-67-000024 - ESX Agent Manager must be configured to show error pages with minimal information. | DISA STIG VMware vSphere 6.7 EAM Tomcat v1r4 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCEM-80-000034 - The vCenter ESX Agent Manager service must limit privileges for creating or modifying hosted application shared files. | DISA VMware vSphere 8.0 vCenter Appliance ESX Agent Manager EAM STIG v2r4 | Unix | CONFIGURATION MANAGEMENT |
| VCLU-70-000020 - Lookup Service must set URIEncoding to UTF-8. | DISA STIG VMware vSphere 7.0 Lookup Service v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCLU-80-000037 - The vCenter Lookup service must be configured to use a specified IP address and port. | DISA VMware vSphere 8.0 vCenter Appliance Lookup Service STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-70-000001 - Performance Charts must limit the amount of time that each Transport Control Protocol (TCP) connection is kept alive. | DISA STIG VMware vSphere 7.0 Perfcharts Tomcat v1r1 | Unix | ACCESS CONTROL |
| VCPF-70-000014 - Performance Charts must not have the Web Distributed Authoring (WebDAV) servlet installed. | DISA STIG VMware vSphere 7.0 Perfcharts Tomcat v1r1 | Unix | CONFIGURATION MANAGEMENT |
| VCST-80-000034 - The vCenter STS service must limit privileges for creating or modifying hosted application shared files. | DISA VMware vSphere 8.0 vCenter Appliance Secure Token Service STS STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCUI-70-000001 - vSphere UI must limit the amount of time that each Transmission Control Protocol (TCP) connection is kept alive. | DISA STIG VMware vSphere 7.0 vCA UI v1r2 | Unix | ACCESS CONTROL |
| VCUI-70-000002 - vSphere UI must limit the number of concurrent connections permitted. | DISA STIG VMware vSphere 7.0 vCA UI v1r2 | Unix | ACCESS CONTROL |
| VCUI-70-000024 - vSphere UI must be configured to hide the server version. | DISA STIG VMware vSphere 7.0 vCA UI v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCUI-80-000138 The vCenter UI service deployXML attribute must be disabled. | DISA VMware vSphere 8.0 vCenter Appliance User Interface (UI) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
| VCUI-80-000139 The vCenter UI service must have Autodeploy disabled. | DISA VMware vSphere 8.0 vCenter Appliance User Interface (UI) STIG v2r1 | Unix | CONFIGURATION MANAGEMENT |
