| 2.2.22 Ensure TFTP daemon is configured to operate in secure mode | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 2.5 Enable SSL for Network File copy (NFC) | CIS VMware ESXi 5.1 v1.0.1 Level 2 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.1 Ensure source routed packets are not accepted | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2 Ensure ICMP redirects are not accepted | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 4.1.3 Ensure network interface zone is configured | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.3.7 Ensure kernel module loading and unloading is collected | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.15 Ensure all uses of the passwd command are audited. | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.26 Ensure audit of the rmdir syscall | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.32 Ensure auditing of all privileged functions | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | ACCESS CONTROL |
| 4.1.3.33 Ensure audit of semanage command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.36 Ensure audit of the userhelper command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.38 Ensure audit of the su command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.7 Ensure firewalld services and ports are configured | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.1.4 Ensure logging is configured | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.2.7 Ensure sudo authentication timeout is configured | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.4 Ensure permissions on SSH private host key files are configured | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.3.26 Ensure RSA rhosts authentication is not allowed | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.3.30 Ensure SSH does not permit GSSAPI | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.3.37 Ensure no "shosts.equiv" files exist on the system | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.4.2.1.4 Ensure password failed attempts lockout includes root account | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | ACCESS CONTROL |
| 5.4.8 Ensure date and time of last successful logon | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 5.4.10 Ensure certificate status checking for PKI authentication | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.5.1.6 Ensure shadow file is configured to use only encrypted representations of passwords | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.5.1.8 Ensure password expiration is 60 Day maximum for existing passwords | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.1.10 Ensure no world writable files exist | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | CONFIGURATION MANAGEMENT |
| 6.2.1.4 Ensure auditd service is enabled and active | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.7 Ensure unsuccessful file access attempts are collected | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.9 Ensure discretionary access control permission modification events are collected | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.19 Ensure kernel module loading unloading and modification is collected | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.22 Ensure the running and on disk configuration is the same | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.4.7 Ensure audit configuration files group owner is configured | CIS Amazon Linux 2 v4.0.0 L2 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.4 Zero out VMDK files prior to deletion | CIS VMware ESXi 5.5 v1.2.0 Level 2 | VMware | CONFIGURATION MANAGEMENT |
| 8.1.2 Ensure only one remote console connection is permitted to a VM at any time | CIS VMware ESXi 6.5 v1.0.0 Level 2 | VMware | SYSTEM AND INFORMATION INTEGRITY |
| 8.2.1 Disconnect unauthorized devices - Floppy Devices | CIS VMware ESXi 5.5 v1.2.0 Level 2 | VMware | MEDIA PROTECTION |
| 8.2.2 Ensure unnecessary CD/DVD devices are disconnected | CIS VMware ESXi 6.5 v1.0.0 Level 2 | VMware | SYSTEM AND INFORMATION INTEGRITY |
| 8.2.5 Disconnect unauthorized devices - USB Devices | CIS VMware ESXi 5.5 v1.2.0 Level 2 | VMware | MEDIA PROTECTION |
| 8.4.26 Ensure all but VGA mode on virtual machines is disabled | CIS VMware ESXi 6.7 v1.3.0 Level 2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.29 Ensure all but VGA mode on virtual machines is disabled | CIS VMware ESXi 6.5 v1.0.0 Level 2 | VMware | SYSTEM AND INFORMATION INTEGRITY |
| 8.5.1 Ensure VM limits are configured correctly - Mem Share Level | CIS VMware ESXi 6.7 v1.3.0 Level 2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.5.1 Ensure VM limits are configured correctly - Num Mem Shares | CIS VMware ESXi 6.5 v1.0.0 Level 2 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.5.1 Ensure VM limits are configured correctly - Num Mem Shares | CIS VMware ESXi 6.7 v1.3.0 Level 2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.5.2 Ensure hardware-based 3D acceleration is disabled | CIS VMware ESXi 6.7 v1.3.0 Level 2 | VMware | CONFIGURATION MANAGEMENT |
| 8.7.3 Ensure host information is not sent to guests | CIS VMware ESXi 6.5 v1.0.0 Level 2 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.7.3 Ensure host information is not sent to guests | CIS VMware ESXi 6.7 v1.3.0 Level 2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.6.8.1 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.1 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.4 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| WN11-UR-000090 - The 'Deny log on through Remote Desktop Services' user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems. | DISA Microsoft Windows 11 STIG v2r9 | Windows | ACCESS CONTROL |
