| 1.1.3 Enable 'aaa authentication enable default' | CIS Cisco IOS XE 16.x v2.2.0 L1 | Cisco | ACCESS CONTROL |
| 1.4 CISC-RT-000040 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT II | Cisco | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.2 Enable 'service password-encryption' | CIS Cisco IOS XE 16.x v2.2.0 L1 | Cisco | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.1.1 OSPF Passive Interfaces | CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations | ArubaOS | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.2 Ensure access profile is set to use CHAP | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Default deny configured' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny host 255.255.255.255' | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.2 Set inbound 'ip access-group' on the External Interface | CIS Cisco IOS 12 L2 v4.0.0 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.9 Ensure net.ipv4.conf.default.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Debian Linux 13 v1.1.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.3 Ensure net.ipv6.conf.all.accept_redirects is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS AlmaLinux OS 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Oracle Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2.4 Ensure net.ipv6.conf.default.accept_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 6.21 Ensure ICMP Redirects are Disabled for IPv4 | CIS Juniper OS Benchmark v2.1.0 L1 | Juniper | CONFIGURATION MANAGEMENT |
| CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - logging severity | DISA STIG Cisco ASA FW v2r1 | Cisco | SYSTEM AND INFORMATION INTEGRITY |
| CASA-ND-000090 - The Cisco ASA must be configured to automatically audit account creation. | DISA STIG Cisco ASA NDM v2r5 | Cisco | ACCESS CONTROL |
| CASA-ND-000160 - The Cisco ASA must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. | DISA STIG Cisco ASA NDM v2r5 | Cisco | ACCESS CONTROL |
| CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts. | DISA STIG Cisco ASA NDM v2r5 | Cisco | IDENTIFICATION AND AUTHENTICATION |
| CASA-ND-000690 - The Cisco ASA must be configured to terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements. | DISA STIG Cisco ASA NDM v2r5 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CASA-ND-000920 - The Cisco ASA must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. | DISA STIG Cisco ASA NDM v2r5 | Cisco | AUDIT AND ACCOUNTABILITY |
| CASA-VN-000090 - The Cisco ASA must be configured to generate an alert that can be forwarded as an alert to organization-defined personnel and/or firewall administrator of all log failure events. | DISA STIG Cisco ASA VPN v2r2 | Cisco | AUDIT AND ACCOUNTABILITY |
| CASA-VN-000180 - The Cisco ASA must be configured to specify Perfect Forward Secrecy (PFS) for the IPsec Security Association (SA) during IKE Phase 2 negotiation. | DISA STIG Cisco ASA VPN v2r2 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CASA-VN-000190 - The Cisco ASA must be configured to use a FIPS-validated cryptographic module to generate cryptographic hashes. | DISA STIG Cisco ASA VPN v2r2 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| CASA-VN-000440 - The Cisco ASA remote access VPN server must be configured to enforce certificate-based authentication before granting access to the network. | DISA STIG Cisco ASA VPN v2r2 | Cisco | IDENTIFICATION AND AUTHENTICATION |
| CASA-VN-000550 - The Cisco ASA remote access VPN server must be configured to use TLS 1.2 or higher to protect the confidentiality of remote access connections. | DISA STIG Cisco ASA VPN v2r2 | Cisco | ACCESS CONTROL |
| CASA-VN-000730 - The Cisco ASA VPN remote access server must be configured to validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation. | DISA STIG Cisco ASA VPN v2r2 | Cisco | IDENTIFICATION AND AUTHENTICATION |
| CISC-RT-000236 - The Cisco switch must be configured to advertise a hop limit of at least 32 in Switch Advertisement messages for IPv6 stateless auto-configuration deployments. | DISA Cisco IOS XE Switch RTR STIG v3r4 | Cisco | CONFIGURATION MANAGEMENT |
| SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only. | DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API | Splunk | ACCESS CONTROL |
| TCAT-AS-001680 - ALLOW_BACKSLASH must be set to false. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 | Unix | |
| WG040 A22 - Public web server resources must not be shared with private assets. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
