| 1.2 Ensure Single-Function Member Servers are Used | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.2 Ensure the latest software package is installed | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.2 Ensure the latest software package is installed | CIS NGINX v3.0.0 L1 Proxy | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.2 Ensure the latest software package is installed | CIS NGINX v3.0.0 L1 Webserver | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.10 Set 'exec-timeout' to less than or equal to 10 min on 'ip http' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4 Remove all non-essential services from the host - DPKG | CIS Docker 1.12.0 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 1.4 Remove all non-essential services from the host - RPM | CIS Docker 1.12.0 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 1.303 OL08-00-040100 | CIS Oracle Linux 8 STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 2.2 Ensure 'CLR Enabled' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT |
| 2.3.2 Ensure rsh client is not installed - rsh-redone-client | CIS Debian 9 Server L1 v1.0.1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 2.6 Ensure 'Remote Access' Server Configuration Option is set to '0' | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.11 Ensure SQL Server is configured to use non-standard ports | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.14 Ensure centralized and remote logging is configured | CIS Docker v1.8.0 L2 OS Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.15 Ensure 'AUTO_CLOSE' is set to 'OFF' on contained databases | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 3.3.1 Ensure Information Protection sensitivity label policies are published | CIS Microsoft 365 Foundations v7.0.0 L1 E3 | microsoft_azure | RISK ASSESSMENT |
| 3.3.1 Ensure Information Protection sensitivity label policies are published | CIS Microsoft 365 Foundations v7.0.0 L1 E5 | microsoft_azure | RISK ASSESSMENT |
| 3.4 (L1) Host must deactivate SLP | CIS VMware ESXi 8.0 v1.3.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.4 Ensure SQL Authentication is not used in contained databases | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.4 Ensure SQL Authentication is not used in contained databases | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS Windows | Windows | ACCESS CONTROL |
| 3.8 Ensure only the default permissions specified by Microsoft are granted to the public server role | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.8 Ensure only the default permissions specified by Microsoft are granted to the public server role | CIS Microsoft SQL Server 2019 v1.6.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.10 Ensure Windows local groups are not SQL Logins | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2 Ensure 'CHECK_EXPIRATION' Option is set to 'ON' for All SQL Authenticated Logins Within the Sysadmin Role | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 4.2 Ensure 'CHECK_EXPIRATION' Option is set to 'ON' for All SQL Authenticated Logins Within the Sysadmin Role | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 4.10 Do not store secrets in Dockerfiles | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.1 Ensure 'Maximum number of error log files' is set to greater than or equal to '12' | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 5.2 Ensure 'Default Trace Enabled' Server Configuration Option is set to '1' | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 5.3 Ensure 'Login Auditing' is set to 'failed logins' | CIS Microsoft SQL Server 2022 v1.3.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| 6.3.3.14 Ensure events that modify /etc/shadow and /etc/gshadow are collected | CIS Oracle Linux 10 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.25 Ensure rename file deletion events by users are collected | CIS Oracle Linux 10 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.8 Audit AutoFill | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.8 Audit AutoFill | CIS Apple macOS 15.0 Sequoia v2.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.8 Audit AutoFill | CIS Apple macOS 14.0 Sonoma v3.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5.1 (L1) Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated ciphers | CIS VMware ESXi 8.0 v1.3.0 L1 Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2 Set Password Expiration Parameters on Active Accounts - Check MAXWEEKS is set to 13 | CIS Solaris 10 L1 v5.2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 7.2 Set Password Expiration Parameters on Active Accounts - Check MINWEEKS is set to 1 | CIS Solaris 10 L1 v5.2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 7.2 Set Password Expiration Parameters on Active Accounts - Check WARNWEEKS is set to 4 | CIS Solaris 10 L1 v5.2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 7.2.9 Audit AutoFill | CIS Apple macOS 12.0 Monterey v4.0.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.5.4 Ensure users dialing in can't bypass the lobby | CIS Microsoft 365 Foundations v7.0.0 L1 E5 | microsoft_azure | ACCESS CONTROL |
| 8.5.4 Ensure users dialing in can't bypass the lobby | CIS Microsoft 365 Foundations v7.0.0 L1 E3 | microsoft_azure | ACCESS CONTROL |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2025 v2.1.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| ALMA-09-018720 - The firewalld service on AlmaLinux OS 9 must be active. | DISA Cloud Linux AlmaLinux OS 9 STIG v1r7 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| DG0097-ORACLE11 - Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation. | DISA STIG Oracle 11 Installation v9r1 Linux | Unix | |
| DG0097-ORACLE11 - Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation. | DISA STIG Oracle 11 Installation v9r1 Windows | Windows | |
| DG0138-ORACLE11 - Access grants to sensitive data should be restricted to authorized user roles. | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | |
| OL09-00-000220 - OL 9 must have the firewalld package installed. | DISA Oracle Linux 9 STIG v1r6 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| RHEL-09-251015 - The firewalld service on RHEL 9 must be active. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| WG170 IIS6 - Each readable web document directory must contain a default, home, index or equivalent file. - 'EnableDefaultDoc set to True' | DISA STIG IIS 6.0 Site Checklist v6r16 | Windows | CONFIGURATION MANAGEMENT |
