| 1.7.2 Disable iPXE (Pre-boot eXecution Environment) | CIS Cisco NX-OS v1.2.0 L2 | Cisco | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.2.1.13 Ensure 'Allow pairing with non-Configurator hosts' is set to 'Disabled' | AirWatch - CIS Apple iOS 10 v2.0.0 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| 3.2.1.14 Ensure 'Allow pairing with non-Configurator hosts' is set to 'Disabled' | AirWatch - CIS Apple iOS 12 v1.0.0 Institution Owned L2 | MDM | CONFIGURATION MANAGEMENT |
| AIOS-16-013500 - Apple iOS must implement the management setting: Not allow a user to remove Apple iOS configuration profiles that enforce DoD security requirements. | AirWatch - DISA Apple iOS-iPadOS 16 STIG v2r2 | MDM | CONFIGURATION MANAGEMENT |
| AIOS-17-013500 - Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements. | AirWatch - DISA Apple iOS/iPadOS 17 v2r2 | MDM | CONFIGURATION MANAGEMENT |
| AIOS-17-013500 - Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements. | MobileIron - DISA Apple iOS/iPadOS 17 v2r2 | MDM | CONFIGURATION MANAGEMENT |
| AMLS-NM-000280 - The Arista Multilayer Switch must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources - NTP Server 2 | DISA STIG Arista MLS DCS-7000 Series NDM v1r4 | Arista | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| AMLS-NM-000370 - The Arista Multilayer Switch must generate audit records showing starting and ending time for administrator access to the system - trap logging | DISA STIG Arista MLS DCS-7000 Series NDM v1r4 | Arista | AUDIT AND ACCOUNTABILITY |
| ARST-L2-000090 - The Arista MLS layer 2 switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources. | DISA Arista MLS EOS 4.X L2S STIG v2r3 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD12-00-000200 - PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-000300 - Security-relevant software updates to PostgreSQL must be installed within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs). | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | SYSTEM AND INFORMATION INTEGRITY |
| CD12-00-001100 - PostgreSQL must associate organization-defined types of security labels having organization-defined security label values with information in transmission. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | ACCESS CONTROL |
| CD12-00-001900 - PostgreSQL and associated applications must reserve the use of dynamic code execution for situations that require it. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | SYSTEM AND INFORMATION INTEGRITY |
| CD12-00-002100 - PostgreSQL must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | AUDIT AND ACCOUNTABILITY |
| CD12-00-002500 - PostgreSQL must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| CD12-00-002700 - PostgreSQL must provide an immediate alert to appropriate support staff of all audit log failures. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-002800 - PostgreSQL must be configurable to overwrite audit log records, oldest first (First-In-First-Out [FIFO]), in the event of unavailability of space for more audit log records. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-002900 - PostgreSQL must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-003600 - Execution of software modules (to include functions and trigger procedures) with elevated privileges must be restricted to necessary cases only. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | ACCESS CONTROL |
| CD12-00-003700 - When invalid inputs are received, PostgreSQL must behave in a predictable and documented manner that reflects organizational and system objectives. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | SYSTEM AND INFORMATION INTEGRITY |
| CD12-00-004000 - PostgreSQL must isolate security functions from non-security functions. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD12-00-004500 - PostgreSQL must generate audit records when unsuccessful attempts to access security objects occur. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-005000 - PostgreSQL must generate audit records when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-005100 - PostgreSQL must generate audit records when successful logons or connections occur. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-005600 - PostgreSQL must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-006100 - PostgreSQL must generate audit records when privileges/permissions are deleted. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-008700 - PostgreSQL must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD12-00-008800 - PostgreSQL must produce audit records containing sufficient information to establish the sources (origins) of the events. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-009400 - PostgreSQL must associate organization-defined types of security labels having organization-defined security label values with information in process. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | ACCESS CONTROL |
| CD12-00-009500 - If passwords are used for authentication, PostgreSQL must store only hashed, salted representations of passwords. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | IDENTIFICATION AND AUTHENTICATION |
| CD12-00-010400 - PostgreSQL must produce audit records containing sufficient information to establish what type of events occurred. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-010700 - PostgreSQL must protect its audit features from unauthorized access. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | AUDIT AND ACCOUNTABILITY |
| CD12-00-011300 - PostgreSQL must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-011500 - PostgreSQL must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| CD12-00-011900 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD12-00-012500 - Audit records must be generated when categorized information (e.g., classification levels/security levels) is deleted. | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-012700 - PostgreSQL must generate audit records for all direct access to the database(s). | DISA STIG Crunchy Data PostgreSQL DB v3r2 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD12-00-012900 - PostgreSQL products must be a version supported by the vendor. | DISA STIG Crunchy Data PostgreSQL OS v3r2 | Unix | SYSTEM AND SERVICES ACQUISITION |
| PANW-IP-000010 - In the event of a logging failure caused by the lack of audit record storage capacity, the Palo Alto Networks security platform must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | AUDIT AND ACCOUNTABILITY |
| PANW-IP-000020 - The Palo Alto Networks security platform must detect and deny any prohibited mobile or otherwise malicious code at the enclave boundary. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND COMMUNICATIONS PROTECTION |
| PANW-IP-000026 - The Palo Alto Networks security platform must detect and drop any prohibited mobile or otherwise malicious code at internal boundaries. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PANW-IP-000033 - To protect against unauthorized data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | ACCESS CONTROL |
| PANW-IP-000043 - The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND COMMUNICATIONS PROTECTION |
| PANW-IP-000045 - Palo Alto Networks security platform components, including sensors, event databases, and management consoles must integrate with a network-wide monitoring capability. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PANW-IP-000046 - The Palo Alto Networks security platform must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PANW-IP-000050 - The Palo Alto Networks security platform must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PANW-IP-000051 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when intrusion detection events are detected which indicate a compromise or potential for compromise. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PANW-IP-000056 - The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected. | DISA Palo Alto Networks IDPS STIG v3r2 | Palo_Alto | SYSTEM AND INFORMATION INTEGRITY |
| PHTN-40-000246 - The Photon operating system must restrict core dumps. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r3 | Unix | CONFIGURATION MANAGEMENT |
| vCenter: vcenter-8.network-mac-learning | VMware vSphere Security Configuration and Hardening Guide | VMware | CONFIGURATION MANAGEMENT |
