| 1.42 PHTN-40-000107 | CIS VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v1.0.0 CAT II | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.66 WN16-AU-000120 | CIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.66 WN16-AU-000120 | CIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.66 WN22-AU-000100 | CIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.67 WN16-AU-000140 | CIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.67 WN16-AU-000140 | CIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.68 PHTN-40-000204 | CIS VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v1.0.0 CAT II | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.68 WN16-AU-000150 | CIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.68 WN16-AU-000150 | CIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.68 WN19-AU-000120 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.107 SLES-15-030040 | CIS SUSE Linux Enterprise Server 15 STIG v1.0.0 CAT II | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.169 WN19-DC-000230 | CIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| CISC-ND-000090 - The Cisco switch must be configured to automatically audit account creation. | DISA Cisco NX OS Switch NDM STIG v3r6 | Cisco | ACCESS CONTROL |
| CISC-ND-000110 - The Cisco switch must be configured to automatically audit account disabling actions. | DISA Cisco NX OS Switch NDM STIG v3r6 | Cisco | ACCESS CONTROL |
| F5BI-DM-000021 - The BIG-IP appliance must automatically audit account modification. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL |
| F5BI-DM-000155 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are created. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000157 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are modified. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000159 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are disabled. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000161 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are removed. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000173 - The BIG-IP appliance must be configured to generate an immediate alert for account-enabling actions. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| JUNI-ND-000090 - The Juniper router must be configured to automatically audit account creation. | DISA STIG Juniper Router NDM v3r2 | Juniper | ACCESS CONTROL |
| JUNI-ND-000120 - The Juniper router must be configured to automatically audit account removal actions. | DISA STIG Juniper Router NDM v3r2 | Juniper | ACCESS CONTROL |
| JUSX-DM-000023 - The Juniper SRX Services Gateway must automatically generate a log event when accounts are enabled. | DISA Juniper SRX Services Gateway NDM v3r3 | Juniper | ACCESS CONTROL |
| OL6-00-000175 - The operating system must automatically audit account modification - '/etc/shadow' | DISA STIG Oracle Linux 6 v2r7 | Unix | ACCESS CONTROL |
| OL07-00-030873 - The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. | DISA Oracle Linux 7 STIG v3r5 | Unix | ACCESS CONTROL |
| PHTN-40-000107 - The Photon operating system must audit the execution of privileged functions. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r2 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| PHTN-40-000204 - The Photon operating system must audit all account modifications. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r2 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| RHEL-06-000174 - The operating system must automatically audit account creation - /etc/shadow | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | ACCESS CONTROL |
| RHEL-06-000175 - The operating system must automatically audit account modification - /etc/passwd | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | ACCESS CONTROL |
| RHEL-06-000176 - The operating system must automatically audit account disabling actions - /etc/security/opasswd. | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | ACCESS CONTROL |
| RHEL-06-000177 - The operating system must automatically audit account termination - /etc/security/opasswd. | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | ACCESS CONTROL |
| RHEL-06-000177 - The operating system must automatically audit account termination - /etc/shadow. | DISA Red Hat Enterprise Linux 6 STIG v2r2 | Unix | ACCESS CONTROL |
| SLEM-05-654130 - SLEM 5 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| SLES-15-030040 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. | DISA SUSE Linux Enterprise Server 15 STIG v2r6 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| SLES-15-030040 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. | DISA SUSE Linux Enterprise Server 15 STIG v2r8 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| SOL-11.1-010230 - The audit system must be configured to audit account creation. | DISA Solaris 11 X86 STIG v3r6 | Unix | ACCESS CONTROL |
| SPLK-CL-000020 - Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling) - creation, deletion, modification, or disabling. | DISA STIG Splunk Enterprise 8.x for Linux v2r3 STIG REST API | Splunk | ACCESS CONTROL |
| UBTU-20-010103 - The Ubuntu operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| UBTU-22-654140 - Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. | DISA Canonical Ubuntu 22.04 LTS STIG v2r9 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| VCSA-70-000123 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action. | DISA STIG VMware vSphere 7.0 vCenter v1r3 | VMware | ACCESS CONTROL |
| WBLC-01-000018 - Oracle WebLogic must automatically audit account creation - Auditing Provider | Oracle WebLogic Server 12c Linux v2r2 Middleware | Unix | ACCESS CONTROL |
| WBLC-01-000019 - Oracle WebLogic must automatically audit account modification - Configuration Audit Type | Oracle WebLogic Server 12c Linux v2r2 | Unix | ACCESS CONTROL |
| WN12-AU-000031 - Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN12-AU-000031 - Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN16-AU-000230 - Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures. | DISA Microsoft Windows Server 2016 STIG v2r10 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN19-AU-000160 - Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures. | DISA Microsoft Windows Server 2019 STIG v3r9 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN22-AU-000120 - Windows Server 2022 must be configured to audit Account Management - User Account Management failures. | DISA Microsoft Windows Server 2022 STIG v2r10 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN22-DC-000230 - Windows Server 2022 must be configured to audit Account Management - Computer Account Management successes. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000110 - Windows Server 2025 must be configured to audit Account Management - User Account Management successes. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000230 - Windows Server 2025 must be configured to audit Account Management - Computer Account Management successes. | DISA Microsoft Windows Server 2025 STIG v1r3 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
