| 1.3 Ensure no unauthorized kernel modules are loaded on the host | CIS VMware ESXi 6.7 v1.3.0 Level 1 Bare Metal | Unix | SYSTEM AND SERVICES ACQUISITION |
| 4.4 Verify Active Directory group membership for the 'ESX Admins' group | CIS VMware ESXi 5.5 v1.2.0 Level 1 | VMware | ACCESS CONTROL |
| 8.7.3 Do not send host information to guests | CIS VMware ESXi 5.5 v1.2.0 Level 2 | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| AIOS-26-015500 - Apple iOS/iPadOS 26 must disable the download of iOS/iPadOS beta updates. | AirWatch - DISA Apple iOS/iPadOS 26 v1r3 | MDM | CONFIGURATION MANAGEMENT |
| DG0096-ORACLE11 - The DBMS IA policies and procedures should be reviewed annually or more frequently. | DISA STIG Oracle 11 Installation v9r1 Linux | Unix | |
| GEN005140 - Any active TFTP daemon must be authorized and approved in the system accreditation package. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN005220 - .Xauthority or X*.hosts (or equivalent) file(s) must be used to restrict access to the X server. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005360 - The snmpd.conf file must be owned by root - '/etc/snmpd.conf' | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005420 - The /etc/syslog.conf file must be group-owned by bin, sys, or system. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005480 - The syslog daemon must not accept remote messages unless it is a syslog server documented using site-defined procedures. | DISA AIX 5.3 STIG v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN005505 - The SSH daemon must be configured to only use FIPS 140-2 approved ciphers. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN005521 - The SSH daemon must restrict login ability to specific users and/or groups. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN005523 - The SSH private host key files must have mode 0600 or less permissive. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005538 - The SSH daemon must not allow rhosts RSA authentication. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN005539 - The SSH daemon must not allow compression or must only allow compression after successful authentication. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005540 - The SSH daemon must be configured for IP filtering - '/etc/hosts.allow' | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN005550 - The SSH daemon must be configured with the Department of Defense (DoD) logon banner - 'Banner file has been defined' | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN005740 - The NFS export configuration file must be owned by root. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005760 - The NFS export configuration file must have mode 0644 or less permissive. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN005880 - The NFS server must not allow remote root access. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN005900 - The nosuid option must be enabled on all NFS client mounts. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN006000 - The system must not have a public Instant Messaging (IM) client installed. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN006080 - The Samba Web Administration Tool (SWAT) must be restricted to the local host or require SSL. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006100 - The /usr/lib/smb.conf file must be owned by root. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006160 - The /var/private/smbpasswd file must be owned by root. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006220 - The smb.conf file must use the hosts option to restrict access to Samba. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN006225 - Samba must be configured to use an authentication mechanism other than share. | DISA AIX 5.3 STIG v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN006230 - Samba must be configured to use encrypted passwords. | DISA AIX 5.3 STIG v1r2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN006260 - The /etc/news/hosts.nntp (or equivalent) must have mode 0600 or less permissive. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006310 - The /etc/news/nnrp.access file must not have an extended ACL. | DISA AIX 5.3 STIG v1r2 | Unix | ACCESS CONTROL |
| GEN006340 - Files in /etc/news must be owned by root or news. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006360 - The files in /etc/news must be group-owned by system or news. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006460 - Any NIS+ server must be operating at security level 2. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006480 - The system must have a host-based intrusion detection tool installed. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN006570 - The file integrity tool must be configured to verify ACLs. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN006620 - The system's access control program must be configured to grant or deny system access to specific hosts - '/etc/hosts.allow' | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN006620 - The system's access control program must be configured to grant or deny system access to specific hosts - 'hosts.deny ALL:ALL' | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN007020 - The Stream Control Transmission Protocol (SCTP) must be disabled unless required. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN007820 - The system must not have IP tunnels configured - 'lstun -a' | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN007950 - The system must not respond to ICMPv6 echo requests sent to a broadcast address. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN008000 - Certificates used to authenticate to the LDAP server must be provided from DoD-approved external PKI - 'useSSL = yes' | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN008020 - The LDAP TLS connection must require a certificate and this certificate has a valid path to a trusted CA - 'ldapsslkeyf exists' | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN008060 - If the system is using LDAP the /etc/ldap.conf file must have mode 0644 or less permissive | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN008480 - The system must have USB Mass Storage disabled unless needed. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN008600 - The system must be configured to only boot from the system boot device. | DISA AIX 5.3 STIG v1r2 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN009180 - The system must not have the tool-talk database server (ttdbserver) service active. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN009260 - The system must not have the talk or ntalk services active. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN009310 - The system must not have the rusersd service active. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN009330 - The system must not have the rstatd service active. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
| GEN009340 - Xserver login managers must not be running unless needed for X11 session management. | DISA AIX 5.3 STIG v1r2 | Unix | CONFIGURATION MANAGEMENT |
