| 1.1 (L1) Ensure ESXi is properly patched | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.3.1.3 Ensure all AppArmor Profiles are enforcing | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.1.4 Ensure correct system time is configured through NTP | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.1.5 Ensure hostname is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.6 Ensure the latest firmware is installed | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 2.1.8 Disable static keys for TLS | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.9 Enable Global Strong Encryption | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL |
| 2.1.10 Ensure management GUI listens on secure TLS version | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.1.11 Ensure CDN is enabled for improved GUI performance | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.12 Ensure single CPU core overloaded event is logged | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure 'Password Policy' is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | IDENTIFICATION AND AUTHENTICATION |
| 2.3.1 Ensure only SNMPv3 is enabled | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.3 Ensure admin accounts with different privileges have their correct profiles assigned | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.4.7 Ensure default Admin ports are changed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.2 Ensure "Monitor Interfaces" for High Availability devices is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.1 Ensure that unused policies are reviewed regularly | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 3.2 Ensure that policies do not use "ALL" as Service | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.3 Apply DNS Filter Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.1 Block high risk categories on Application Control | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.8 (L1) Ensure the Exception Users list is properly configured | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6 (L2) Ensure Strict Lockdown mode is enabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | ACCESS CONTROL |
| 5.8 (L1) Ensure idle ESXi shell and SSH sessions time out after 300 seconds or less | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 5.9 (L1) Ensure the shell services timeout is set to 1 hour or less | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 7.1 (L1) Ensure the vSwitch Forged Transmits policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.1.1 Enable Event Logging | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 7.2 (L1) Ensure the vSwitch MAC Address Change policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2.1 Encrypt Log Transmission to FortiAnalyzer / FortiManager | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 (L1) Ensure the vSwitch Promiscuous Mode policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.1.1 (L2) Ensure only one remote console connection is permitted to a VM at any time | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.3.3 (L1) Ensure secure protocols are used for virtual serial port access | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 8.4.1 (L1) Ensure access to VMs through the dvfilter network APIs is configured correctly | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.4.7 (L2) Ensure Unity Window Contents is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.14 (L2) Ensure Guest Host Interaction Tray Icon is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.15 (L2) Ensure Unity is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.18 (L2) Ensure Host Guest File System Server is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.20 (L2) Ensure memSchedFakeSampleStats is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.21 (L1) Ensure VM Console Copy operations are disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.6.2 (L1) Ensure virtual disk shrinking is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows Server 2025 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Access data sources across domains - Restricted Sites Zone | MSCT Windows Server v20H2 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ADBP-XI-001325 - Adobe Acrobat Pro XI privileged site locations must be disabled. | DISA Adobe Acrobat Pro XI STIG v1r2 | Windows | CONFIGURATION MANAGEMENT |
| AS24-W1-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts. | DISA STIG Apache Server 2.4 Windows Server v3r4 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI112 - The Download signed ActiveX controls property must be disallowed (Restricted Site zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI515 - Web sites in less privileged web content zones must be disallowed to navigate into the Internet zone. | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | ACCESS CONTROL |
| OH12-1X-000266 - OHS accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| Prevent bypassing Windows Defender SmartScreen prompts for sites | MSCT Windows 10 1903 v1.19.9 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Prevent bypassing Windows Defender SmartScreen prompts for sites | MSCT Windows 10 v20H2 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Prevent bypassing Windows Defender SmartScreen prompts for sites | MSCT Windows 10 v21H1 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| SHPT-00-000100 - SharePoint must enforce dual authorization, based on organizational policies and procedures for organizationally defined privileged commands. | DISA STIG SharePoint 2010 v1r9 | Windows | ACCESS CONTROL |
| VCPF-67-000004 - Performance Charts must protect cookies from cross-site scripting (XSS). | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
