| 2.1.1 Ensure centralized root access in AWS Organizations | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL |
| 2.1.2 Ensure authorization guardrails for all AWS Organization accounts | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL |
| 2.1.4 Ensure Organizational Units are structured by environment and sensitivity | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.5 Ensure delegated admin manages AWS Organizations policies | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.1.6 Ensure delegated admins manage AWS Organizations-integrated services | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2 Maintain current AWS account contact details | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | INCIDENT RESPONSE |
| 2.3 Ensure security contact information is registered | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | CONTINGENCY PLANNING, INCIDENT RESPONSE |
| 2.4 Ensure no 'root' user account access key exists | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.6 Ensure hardware MFA is enabled for the 'root' user account | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | IDENTIFICATION AND AUTHENTICATION |
| 2.7 Eliminate use of the 'root' user for administrative and daily tasks | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL |
| 2.8 Ensure IAM password policy requires minimum length of 14 or greater | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | IDENTIFICATION AND AUTHENTICATION |
| 2.11 Ensure credentials unused for 45 days or more are disabled | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL |
| 2.12 Ensure access keys are rotated every 90 days or less | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL |
| 2.13 Ensure IAM users receive permissions only through groups | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.14 Ensure IAM policies that allow full "*:*" administrative privileges are not attached | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.16 Ensure IAM instance roles are used for AWS resource access from instances | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.17 Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 2.18 Ensure that IAM External Access Analyzer is enabled for all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION |
| 2.19 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL |
| 2.20 Ensure access to AWSCloudShellFullAccess is restricted | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 2.21 Ensure AWS resource policies do not allow unrestricted access using "Principal": "*" | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 3.1.1 Ensure S3 Bucket Policy is set to deny HTTP requests | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 3.2.4 Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1 Ensure CloudTrail is enabled in all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 4.6 Ensure rotation for customer-created symmetric CMKs is enabled | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.3 Ensure usage of the 'root' account is monitored | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 5.5 Ensure CloudTrail configuration changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 5.9 Ensure AWS Config configuration changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 5.10 Ensure security group changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.11 Ensure Network Access Control List (NACL) changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 5.12 Ensure changes to network gateways are monitored | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 5.15 Ensure AWS Organizations changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 6.1.2 Ensure CIFS access is restricted to trusted networks to prevent unauthorized access | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.4 Ensure no security groups allow ingress from ::/0 to remote server administration ports | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5 Ensure the default security group of every VPC restricts all traffic | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.8 Ensure VPC Endpoints are used for access to AWS Services | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 12 - Remove and mask informational headers - Server Property Override | TNS Best Practice JBoss 7 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| DISA_STIG_Apache_Server-2.2_Windows_v1r13.audit from DISA APACHE 2.2 Server for Windows v1r13 STIG | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | |
| DISA_STIG_Apache_Site-2.4_Unix_v2r6.audit from DISA Apache Server 2.4 UNIX Site v2r6 STIG | DISA STIG Apache Server 2.4 Unix Site v2r6 | Unix | |
| DISA_STIG_EDB_PostgreSQL_Advanced_Server_v11_Windows_v2r4_OS.audit from DISA EDB Postgres Advanced Server v11 on Windows v2r4 STIG | EDB PostgreSQL Advanced Server v11 Windows OS Audit v2r4 | Windows | |
| DISA_STIG_Microsoft_Exchange_2013_Client_Access_Server_v2r2.audit from DISA Microsoft Exchange 2013 Client Access Server v2r2 STIG | DISA Microsoft Exchange 2013 Client Access Server STIG v2r2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| VCEM-70-000030 - ESX Agent Manager must set the secure flag for cookies. | DISA STIG VMware vSphere 7.0 EAM Tomcat v1r2 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-67-000026 - Performance Charts must properly configure log sizes and rotation - MaxBackupIndex | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| VCPF-67-000026 - Performance Charts must properly configure log sizes and rotation - MaxFileSize | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000073 - Oracle WebLogic must produce process events and severity levels to establish what type of HTTPD-related events and severity levels occurred. | Oracle WebLogic Server 12c Windows v2r2 | Windows | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000073 - Oracle WebLogic must produce process events and severity levels to establish what type of HTTPD-related events and severity levels occurred. | Oracle WebLogic Server 12c Linux v2r2 | Unix | AUDIT AND ACCOUNTABILITY |
| WBLC-02-000073 - Oracle WebLogic must produce process events and severity levels to establish what type of HTTPD-related events and severity levels occurred. | Oracle WebLogic Server 12c Linux v2r2 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| WN10-00-000100 - Internet Information System (IIS) or its subcomponents must not be installed on a workstation. | DISA Microsoft Windows 10 STIG v3r6 | Windows | CONFIGURATION MANAGEMENT |
