| 1.1.1.1 Ensure the Management VRF Exists | CIS Arista EOS benchmark v1.0.0 L1 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.3 Enable 'aaa authentication enable default' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | ACCESS CONTROL |
| 1.1.7 - AirWatch - Disable 'Wi-Fi' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.3 CISC-ND-000100 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT II | Cisco | ACCESS CONTROL |
| 1.4.2 Enable 'service password-encryption' | CIS Cisco IOS XE 16.x v2.2.0 L1 | Cisco | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.2 Enable 'service password-encryption' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.10 CISC-ND-000530 | CIS Cisco IOS XR Router NDM STIG v1.0.0 CAT II | Cisco | IDENTIFICATION AND AUTHENTICATION |
| 1.26 CISC-ND-000880 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT II | Cisco | ACCESS CONTROL |
| 1.30 CISC-ND-001130 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT II | Cisco | IDENTIFICATION AND AUTHENTICATION |
| 1.37 CISC-RT-000394 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.38 CISC-RT-000395 | CIS Cisco IOS XE Router RTR STIG v1.1.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.38 CISC-RT-000396 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.42 CISC-ND-001450 | CIS Cisco IOS Router NDM STIG v1.1.0 CAT I | Cisco | AUDIT AND ACCOUNTABILITY |
| 1.51 APPL-14-001060 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.52 APPL-15-001060 | CIS Apple macOS 15 Sequoia STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.60 CISC-RT-000590 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | CONTINGENCY PLANNING |
| 1.82 CISC-RT-000810 | CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT III | Cisco | ACCESS CONTROL |
| 3.7.2.12 /var/ct/RMstart.log | CIS IBM AIX 7.1 L1 v2.1.0 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.13 Ensure access on /var/ct/RMstart.log is configured | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.10 Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1.4 Ensure the 'PROFILE' Audit Option Is Enabled | CIS Oracle Server 12c DB Traditional Auditing v3.0.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| ALMA-09-034340 - AlmaLinux OS 9 must use the CAC smart card driver. | DISA Cloud Linux AlmaLinux OS 9 STIG v1r7 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-13-000033 - The macOS system must be configured to disable password forwarding for FileVault. | DISA STIG Apple macOS 13 v1r5 | Unix | CONFIGURATION MANAGEMENT |
| APPL-13-003020 - The macOS system must use multifactor authentication for local access to privileged and nonprivileged accounts. | DISA STIG Apple macOS 13 v1r5 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-14-001060 - The macOS system must set smart card certificate trust to moderate. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-15-001060 - The macOS system must set smart card certificate trust to moderate. | DISA Apple macOS 15 Sequoia STIG v1r7 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-002010 - The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer, and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit. | DISA BIND 9.x STIG v3r3 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| CISC-ND-000330 - The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands. | DISA Cisco IOS XE Router NDM STIG v3r7 | Cisco | AUDIT AND ACCOUNTABILITY |
| Ensure timezone is properly configured | Tenable Cisco Firepower Best Practices Audit | Cisco | CONFIGURATION MANAGEMENT |
| ESXI5-VM-000012 - The system must disable VM logging, unless required. | DISA VMware ESXi Version 5 Virtual Machine STIG v2r1 | VMware | CONFIGURATION MANAGEMENT |
| ESXI5-VM-000051 - The system must control access to VMs through the dvfilter network APIs. | DISA VMware ESXi Version 5 Virtual Machine STIG v2r1 | VMware | ACCESS CONTROL |
| GEN000790-ESXI5-000085 - The system must prevent the use of dictionary words for passwords - V-39246 | DISA VMWare ESXi 5.0 Server STIG v2r1 | VMware | CONFIGURATION MANAGEMENT |
| GEN002420-ESXI5-00878 - Removable media, remote file systems, and any file system that does not contain approved setuid files must be mounted with the nosuid option. | DISA VMWare ESXi 5.0 Server STIG v2r1 | VMware | CONFIGURATION MANAGEMENT |
| OL6-00-000005 - The audit system must alert designated staff members when the audit storage volume approaches capacity. | DISA STIG Oracle Linux 6 v2r7 | Unix | AUDIT AND ACCOUNTABILITY |
| OL6-00-000050 - The system must require passwords to contain a minimum of 15 characters - /etc/login.defs | DISA STIG Oracle Linux 6 v2r7 | Unix | IDENTIFICATION AND AUTHENTICATION |
| Physical Security - Diagnostic Ports - Password protect Diagnostic ports - diag-port | Juniper Hardening JunOS 12 Devices Checklist | Juniper | IDENTIFICATION AND AUTHENTICATION |
| Physical Security - Diagnostic Ports - Password protect Diagnostic ports - pic-console | Juniper Hardening JunOS 12 Devices Checklist | Juniper | IDENTIFICATION AND AUTHENTICATION |
| PPS9-00-002300 - The EDB Postgres Advanced Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure. | EDB PostgreSQL Advanced Server OS Linux Audit v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-06-000050 - The system must require passwords to contain a minimum of 15 characters. | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| RHEL-10-200621 - RHEL 10 must use the common access card (CAC) smart card driver. | DISA Red Hat Enterprise Linux 10 STIG v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| SLES-12-030140 - The SUSE operating system must deny direct logons to the root account using remote access via SSH. | DISA SLES 12 STIG v3r5 | Unix | IDENTIFICATION AND AUTHENTICATION |
| SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only. | DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API | Splunk | ACCESS CONTROL |
| SRG-OS-000072-ESXI5 - The system must require at least four characters be changed between the old and new passwords during a password change. | DISA VMWare ESXi 5.0 Server STIG v2r1 | VMware | IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-000970 - Idle timeout for the management application must be set to 10 minutes. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-001680 - ALLOW_BACKSLASH must be set to false. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| UBTU-16-010080 - The Ubuntu operating system must prevent direct login into the root account. | DISA STIG Ubuntu 16.04 LTS v2r3 | Unix | IDENTIFICATION AND AUTHENTICATION |
| UBTU-24-400110 - Ubuntu 24.04 LTS must prevent direct login to the root account. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| VCTR-67-000015 - The vCenter Server must set the distributed port group Promiscuous Mode policy to reject. | DISA STIG VMware vSphere 6.7 vCenter v1r4 | VMware | CONFIGURATION MANAGEMENT |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 | Unix | |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
