| 1.3 Disable all management related services on WAN port | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 1.3.1.3 Ensure SELinux policy is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3.1.3 Ensure SELinux policy is configured | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L1 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3.1.3 Ensure SELinux policy is configured | CIS Oracle Linux 10 v1.0.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3.1.3 Ensure SELinux policy is configured | CIS AlmaLinux OS 10 v1.0.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.4 (L2) Ensure the default value of individual salt per vm is configured | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 1.4.3 Set the SELinux Policy - SELINUXTYPE=targeted | CIS Red Hat Enterprise Linux 5 L2 v2.2.1 | Unix | ACCESS CONTROL |
| 1.6.1.3 Ensure SELinux policy is configured | CIS Debian 9 Server L2 v1.0.1 | Unix | ACCESS CONTROL |
| 1.6.1.3 Ensure SELinux policy is configured | CIS Amazon Linux 2023 v1.0.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.1.1 Ensure 'Pre-Login Banner' is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AWARENESS AND TRAINING, PROGRAM MANAGEMENT |
| 2.1.7 Disable USB Firmware and configuration installation | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.2.2 Ensure administrator password retries and lockout time are configured | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.4.2 Ensure all the login accounts having specific trusted hosts enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY |
| 2.5.1 Ensure High Availability configuration is enabled | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.2 (L1) Ensure persistent logging is configured for all ESXi hosts | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | AUDIT AND ACCOUNTABILITY |
| 3.3 (L1) Ensure remote logging is configured for ESXi hosts | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | AUDIT AND ACCOUNTABILITY |
| 4.1.2 Apply IPS Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | RISK ASSESSMENT |
| 4.2.1 Ensure Antivirus Definition Push Updates are Configured | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3 (L1) Ensure the maximum failed login attempts is set to 5 | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 4.3.1 Enable Botnet C&C Domain Blocking DNS Filter | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.2 Ensure DNS Filter logs all DNS queries and responses | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 4.4.2 Block applications running on non-default ports | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.7 (L1) Ensure only authorized users and groups belong to the esxAdminsGroup group | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 5.2.1.1 Ensure Security Fabric is Configured | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 5.5 (L1) Ensure Normal Lockdown mode is enabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 6.1 (L1) Ensure bidirectional CHAP authentication for iSCSI traffic is enabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1.2 Enable Limited TLS Versions for SSL VPN | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 6.2 (L2) Ensure the uniqueness of CHAP authentication secrets for iSCSI traffic | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | IDENTIFICATION AND AUTHENTICATION |
| 7.6 (L1) Ensure port groups are not configured to VLAN 4095 and 0 except for Virtual Guest Tagging (VGT) | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.4.16 (L2) Ensure Unity Interlock is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.24 (L1) Ensure VM Console Paste operations are disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| Access data sources across domains - Internet Zone | MSCT Windows 11 v23H2 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows 10 1803 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows 10 1909 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server 1903 DC v1.19.9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server v2004 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server 2016 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server 2016 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server 2025 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Internet Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 10 v22H2 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 11 v22H2 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 11 v24H2 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 11 v23H2 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 10 v1507 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows 10 1909 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows Server 1903 DC v1.19.9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows Server 1903 MS v1.19.9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows Server v2004 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| SYMP-AG-000140 - Symantec ProxySG providing user access control intermediary services must generate audit records when successful/unsuccessful attempts to access web resources occur. | DISA Symantec ProxySG Benchmark ALG v1r3 | BlueCoat | AUDIT AND ACCOUNTABILITY |
