| 1.4 CISC-RT-000040 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.7 Set 'logging source interface' | CIS Cisco IOS XR 7.x v1.0.1 L1 | Cisco | AUDIT AND ACCOUNTABILITY |
| 1.15 APPL-14-000033 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.15 APPL-15-000033 | CIS Apple macOS 15 Sequoia STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.15 CISC-ND-000460 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT II | Cisco | CONFIGURATION MANAGEMENT |
| 1.16 CISC-RT-000236 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT III | Cisco | CONFIGURATION MANAGEMENT |
| 1.16 CISC-RT-000236 | CIS Cisco IOS Switch RTR STIG v1.1.0 CAT III | Cisco | CONFIGURATION MANAGEMENT |
| 1.50 CISC-RT-000580 | CIS Cisco IOS XE Switch RTR STIG v1.1.0 CAT III | Cisco | CONFIGURATION MANAGEMENT |
| 1.52 CISC-RT-000510 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II | Cisco | ACCESS CONTROL |
| 1.70 CISC-RT-000690 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | CONFIGURATION MANAGEMENT |
| 1.90 CISC-RT-000890 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.3 Set 'no ip bootp server' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.7 Set 'logging source interface' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | AUDIT AND ACCOUNTABILITY |
| 3.1.1.1 OSPF Passive Interfaces | CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations | ArubaOS | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.2 Ensure access profile is set to use CHAP | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Default deny configured' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 192.168.0.0' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 224.0.0.0' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny host 255.255.255.255' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks -'External interface has ACL applied' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.2 Set inbound 'ip access-group' on the External Interface | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 5.2 Ensure SNMPv1/2 are set to Read Only | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | ACCESS CONTROL |
| 6.21 Ensure ICMP Redirects are Disabled for IPv4 | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | CONFIGURATION MANAGEMENT |
| AOSX-14-003025 - The macOS system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access. | DISA STIG Apple Mac OSX 10.14 v2r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-11-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple macOS 11 v1r5 | Unix | ACCESS CONTROL |
| APPL-11-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities to verify the establishment of protected sessions. | DISA STIG Apple macOS 11 v1r5 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-12-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions - PIV credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities to verify the establishment of protected sessions. | DISA STIG Apple macOS 12 v1r9 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-14-001060 - The macOS system must set smart card certificate trust to moderate. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-15-000033 - The macOS system must disable FileVault automatic login. | DISA Apple macOS 15 Sequoia STIG v1r7 | Unix | ACCESS CONTROL |
| APPL-15-001060 - The macOS system must set smart card certificate trust to moderate. | DISA Apple macOS 15 Sequoia STIG v1r7 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-RT-000040 - The Cisco switch must be configured to use encryption for routing protocol authentication. | DISA Cisco NX OS Switch RTR STIG v3r4 | Cisco | IDENTIFICATION AND AUTHENTICATION |
| CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | CONFIGURATION MANAGEMENT |
| IIST-SV-000142 - The IIS 10.0 web server must restrict inbound connections from non-secure zones. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | ACCESS CONTROL |
| IIST-SV-000142 - The IIS 10.0 web server must restrict inbound connections from non-secure zones. | DISA IIS 10.0 Server v2r10 | Windows | ACCESS CONTROL |
| MD3X-00-001100 - MongoDB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs. | DISA STIG MongoDB Enterprise Advanced 3.x v2r3 OS | Unix | CONFIGURATION MANAGEMENT |
| SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only. | DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API | Splunk | ACCESS CONTROL |
| TCAT-AS-000970 - Idle timeout for the management application must be set to 10 minutes. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-001680 - ALLOW_BACKSLASH must be set to false. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 | Unix | |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
