| 1.16 VMCH-80-000204 | CIS VMware vSphere 8.0 Virtual Machine STIG v1.0.0 CAT II | VMware | CONFIGURATION MANAGEMENT |
| 5.1 (L1) Ensure the DCUI timeout is set to 600 seconds or less | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 5.4 (L1) Ensure CIM access is limited | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 5.10 (L1) Ensure DCUI has a trusted users list for lockdown mode | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 5.11 (L2) Ensure contents of exposed configuration files have not been modified | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 6.3 (L1) Ensure storage area network (SAN) resources are segregated properly | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.4 (L1) Ensure port groups are not configured to the value of the native VLAN | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.5 (L1) Ensure port groups are not configured to VLAN values reserved by upstream physical switches | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.2.1 (L1) Ensure unnecessary floppy devices are disconnected | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.2 (L2) Ensure unnecessary CD/DVD devices are disconnected | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.3 (L1) Ensure unnecessary parallel ports are disconnected | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.4 (L1) Ensure unnecessary serial ports are disconnected | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.5 (L1) Ensure unnecessary USB devices are disconnected | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.6 (L1) Ensure unauthorized modification and disconnection of devices is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.7 (L1) Ensure unauthorized connection of devices is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.2.8 (L1) Ensure PCI and PCIe device passthrough is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.3.1 (L1) Ensure unnecessary or superfluous functions inside VMs are disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.3.2 (L1) Ensure use of the VM console is limited | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.3.4 (L1) Ensure standard processes are used for VM deployment | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.4.22 (L1) Ensure VM Console Drag and Drop operations is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.23 (L1) Ensure VM Console GUI Options is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.7.1 (L1) Ensure the number of VM log files is configured properly | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | AUDIT AND ACCOUNTABILITY |
| 8.7.3 (L1) Ensure VM log file size is limited | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | AUDIT AND ACCOUNTABILITY |
| ESXI-06-000002 - The system must verify the DCUI.Access list. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | ACCESS CONTROL |
| ESXI-06-000005 - The system must enforce the limit of three consecutive invalid logon attempts by a user. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | ACCESS CONTROL |
| ESXI-06-000006 - The system must enforce the unlock timeout of 15 minutes after a user account is locked out. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | ACCESS CONTROL |
| ESXI-06-000035 - The VMM must be configured to disable non-essential capabilities by disabling SSH. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-06-000038 - The system must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | IDENTIFICATION AND AUTHENTICATION |
| ESXI-06-000039 - Active Directory ESX Admin group membership must not be used. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | IDENTIFICATION AND AUTHENTICATION |
| ESXI-06-000045 - The system must enable a persistent log location for all locally stored logs. | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | AUDIT AND ACCOUNTABILITY |
| ESXI-06-000057 - The system must configure the firewall to block network traffic by default - Outgoing | DISA VMware vSphere ESXi 6.0 STIG v1r5 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-65-000007 - The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | ACCESS CONTROL |
| ESXI-65-000043 - The ESXi host must logout of the console UI after 10 minutes. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-65-000046 - The ESXi host must configure NTP time synchronization. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | AUDIT AND ACCOUNTABILITY |
| ESXI-65-000057 - The ESXi host must configure the firewall to block network traffic by default - outgoing | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-65-000060 - The virtual switch MAC Address Change policy must be set to reject on the ESXi host. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-65-000067 - All ESXi host-connected physical switch ports must be configured with spanning tree disabled. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-65-100037 - The ESXi host must require individuals to be authenticated with an individual authenticator prior to using a group authenticator by using Active Directory for local user authentication. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | IDENTIFICATION AND AUTHENTICATION |
| ESXI-67-000004 - Remote logging for ESXi hosts must be configured. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| ESXI-67-000046 - The ESXi host must configure NTP time synchronization. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | AUDIT AND ACCOUNTABILITY |
| ESXI-67-000048 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-67-000052 - The ESXi host must protect the confidentiality and integrity of transmitted information by using different TCP/IP stacks where possible. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-67-000060 - The virtual switch MAC Address Change policy must be set to reject on the ESXi host. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000065 - For the ESXi host, all port groups must not be configured to VLAN values reserved by upstream physical switches. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000068 - All ESXi host-connected virtual switch VLANs must be fully documented and have only the required VLANs. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000070 - The ESXi host must not provide root/administrator-level access to CIM-based hardware monitoring tools or other third-party applications. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000071 - The SA must verify the integrity of the installation media before installing ESXi. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| ESXI-67-000079 - The ESXi host must not suppress warnings that the local or remote shell sessions are enabled. | DISA STIG VMware vSphere 6.7 ESXi v1r3 | VMware | CONFIGURATION MANAGEMENT |
| VCRP-67-000002 - The rhttpproxy must set a limit on established connections. | DISA STIG VMware vSphere 6.7 RhttpProxy v1r3 | Unix | ACCESS CONTROL |
| VCRP-67-000004 - The rhttpproxy must use cryptography to protect the integrity of remote sessions. | DISA STIG VMware vSphere 6.7 RhttpProxy v1r3 | Unix | ACCESS CONTROL |
