| 1.1 (L1) Ensure ESXi is properly patched | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.1.4 Ensure correct system time is configured through NTP | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.1.5 Ensure hostname is set | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.6 Ensure the latest firmware is installed | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | SECURITY ASSESSMENT AND AUTHORIZATION, RISK ASSESSMENT |
| 2.1.8 Disable static keys for TLS | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.9 Enable Global Strong Encryption | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | ACCESS CONTROL |
| 2.1.10 Ensure management GUI listens on secure TLS version | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.1.11 Ensure CDN is enabled for improved GUI performance | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 2.1.12 Ensure single CPU core overloaded event is logged | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure 'Password Policy' is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | IDENTIFICATION AND AUTHENTICATION |
| 2.2.27 Ensure 'Log on as a batch job' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L2 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.28 (L1) Ensure 'Log on as a batch job' is set to 'Administrators' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.1 Ensure only SNMPv3 is enabled | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.3 Ensure admin accounts with different privileges have their correct profiles assigned | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL |
| 2.4.7 Ensure default Admin ports are changed | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, MEDIA PROTECTION, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.2 Ensure "Monitor Interfaces" for High Availability devices is enabled | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.5.10.8.1.2.1 (L1) Ensure 'Access to published calendars' is set to 'Enabled' | CIS Microsoft Intune for Office v1.1.0 L1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1 Ensure that unused policies are reviewed regularly | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | CONFIGURATION MANAGEMENT |
| 3.2 Ensure that policies do not use "ALL" as Service | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.3 Apply DNS Filter Security Profile to Policies | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.1 Block high risk categories on Application Control | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.8 (L1) Ensure the Exception Users list is properly configured | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6 (L2) Ensure Strict Lockdown mode is enabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | ACCESS CONTROL |
| 5.8 (L1) Ensure idle ESXi shell and SSH sessions time out after 300 seconds or less | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 5.9 (L1) Ensure the shell services timeout is set to 1 hour or less | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | ACCESS CONTROL |
| 7.1 (L1) Ensure the vSwitch Forged Transmits policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.1.1 Enable Event Logging | CIS Fortigate 7.0.x v1.4.0 L2 | FortiGate | AUDIT AND ACCOUNTABILITY |
| 7.1.4 Ensure that there are no unused ports on a distributed virtual port group | CIS VMware ESXi 5.1 v1.0.1 Level 1 | VMware | |
| 7.2 (L1) Ensure the vSwitch MAC Address Change policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2.1 Encrypt Log Transmission to FortiAnalyzer / FortiManager | CIS Fortigate 7.0.x v1.4.0 L1 | FortiGate | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 (L1) Ensure the vSwitch Promiscuous Mode policy is set to reject | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.1.1 (L2) Ensure only one remote console connection is permitted to a VM at any time | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.3.3 (L1) Ensure secure protocols are used for virtual serial port access | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 8.4.1 (L1) Ensure access to VMs through the dvfilter network APIs is configured correctly | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.4.7 (L2) Ensure Unity Window Contents is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.8 (L2) Ensure Unity Push Update is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.14 (L2) Ensure Guest Host Interaction Tray Icon is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.15 (L2) Ensure Unity is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.18 (L2) Ensure Host Guest File System Server is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.20 (L2) Ensure memSchedFakeSampleStats is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.21 (L1) Ensure VM Console Copy operations are disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT |
| 8.6.2 (L1) Ensure virtual disk shrinking is disabled | CIS VMware ESXi 7.0 v1.5.0 L1 | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - SSLRandomSeed connect | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-65-000038 - The ESXi host must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory. | DISA STIG VMware vSphere ESXi 6.5 v2r4 | VMware | IDENTIFICATION AND AUTHENTICATION |
| OH12-1X-000231 - Remote authors or content providers must have all files scanned for viruses and malicious code before uploading files to the Document Root directory. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | CONFIGURATION MANAGEMENT |
| VCWN-65-000018 - The vCenter Server for Windows must configure all port groups to a value other than that of the native VLAN. | DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3 | VMware | CONFIGURATION MANAGEMENT |
| VMCH-65-000032 - Unauthorized USB devices must be disconnected on the virtual machine. | DISA STIG VMware vSphere Virtual Machine 6.5 v2r2 | VMware | CONFIGURATION MANAGEMENT |
| VMCH-67-000012 - Unauthorized USB devices must be disconnected on the virtual machine. | DISA STIG VMware vSphere 6.7 Virtual Machine v1r3 | VMware | CONFIGURATION MANAGEMENT |
| WBSP-AS-000080 - The WebSphere Application Server groups in the user registry mapped to WebSphere auditor roles must be configured in accordance with the security plan. | DISA IBM WebSphere Traditional 9 Windows STIG v2r1 | Windows | ACCESS CONTROL |
| WG460 IIS6 - PERL scripts must use the TAINT option. | DISA STIG IIS 6.0 Site Checklist v6r16 | Windows | SYSTEM AND INFORMATION INTEGRITY |
