| 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SYSTEM AND SERVICES ACQUISITION |
| 1.1 Host hardware must have auditable, authentic, and up to date system & device firmware | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | SYSTEM AND SERVICES ACQUISITION |
| 3.2.1 BGP Authentication | CIS Arista EOS benchmark v1.0.0 L2 | Arista | IDENTIFICATION AND AUTHENTICATION |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Oracle Linux 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Rocky Linux 10 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS AlmaLinux OS 10 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS AlmaLinux OS 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Red Hat Enterprise Linux 10 v1.0.1 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Red Hat Enterprise Linux 10 v1.0.1 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Oracle Linux 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS AlmaLinux OS 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Rocky Linux 10 v1.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Oracle Linux 8 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Red Hat Enterprise Linux 8 v4.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 4.10 Ensure RCS Messaging Is Enabled Instead of SMS/MMS Where Available | AirWatch - CIS Apple iPadOS 26 v1.0.0 L1 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.4.4 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.3.1 | Windows | CONFIGURATION MANAGEMENT |
| 18.4.4 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.3.1 | Windows | CONFIGURATION MANAGEMENT |
| 18.5.4 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Windows Server 2012 R2 DC L1 v3.0.0 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.5.4 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Windows Server 2012 DC L1 v3.0.0 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.5.5 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| Management Access Policy - Telnet - Admin State | Tenable Cisco ACI | Cisco_ACI | CONFIGURATION MANAGEMENT |
| MD4X-00-006600 - MongoDB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs. | DISA STIG MongoDB Enterprise Advanced 4.x v1r4 OS | Unix | CONFIGURATION MANAGEMENT |
| OL08-00-040261 - OL 8 must not accept router advertisements on all IPv6 interfaces. | DISA Oracle Linux 8 STIG v2r9 | Unix | CONFIGURATION MANAGEMENT |
| OL09-00-006040 - OL 9 must not accept router advertisements on all IPv6 interfaces. | DISA Oracle Linux 9 STIG v1r6 | Unix | CONFIGURATION MANAGEMENT |
| OS10-NDM-000490 - The Dell OS10 Switch, for PKI-based authentication, must be configured to map validated certificates to unique user accounts. | DISA Dell OS10 Switch NDM STIG v1r1 | Dell_OS10 | AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000016 - The Palo Alto Networks security platform must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | ACCESS CONTROL |
| PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | AUDIT AND ACCOUNTABILITY |
| PANW-NM-000046 - The Palo Alto Networks security platform must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | CONFIGURATION MANAGEMENT |
| PANW-NM-000048 - The Palo Alto device must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | ACCESS CONTROL |
| PANW-NM-000051 - The Palo Alto Networks security platform must implement replay-resistant authentication mechanisms for network access to privileged accounts. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000053 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce a minimum 15-character password length. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000055 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one uppercase character be used. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000058 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one special character be used. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000059 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must require that when a password is changed, the characters are changed in at least 8 of the positions within the password. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-000069 - The Palo Alto Networks security platform must terminate management sessions after 10 minutes of inactivity except to fulfill documented and validated mission requirements. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | SYSTEM AND COMMUNICATIONS PROTECTION |
| PANW-NM-000098 - The Palo Alto Networks security platform must compare internal information system clocks at least every 24 hours with an authoritative time server. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| PANW-NM-000101 - The Palo Alto Networks security platform must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | AUDIT AND ACCOUNTABILITY |
| PANW-NM-000117 - The Palo Alto Networks security platform must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | MAINTENANCE |
| PANW-NM-000118 - The Palo Alto Networks security platform must not use SNMP Versions 1 or 2. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | MAINTENANCE |
| PANW-NM-000136 - The Palo Alto Networks security platform must employ centrally managed authentication server(s). | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | CONFIGURATION MANAGEMENT |
| PANW-NM-000144 - The Palo Alto Networks security platform must generate an audit log record when the Data Plane CPU utilization is 100%. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | CONFIGURATION MANAGEMENT |
| PANW-NM-000145 - The Palo Alto Networks security platform must authenticate Network Time Protocol sources. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | IDENTIFICATION AND AUTHENTICATION |
| PANW-NM-999999 - The version of the Palo Alto Networks security platform must be a supported version. | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | SYSTEM AND SERVICES ACQUISITION |
| SHPT-00-000600 - SharePoint managed service accounts must be set to enable automatic password change. | DISA STIG SharePoint 2010 v1r9 | Windows | IDENTIFICATION AND AUTHENTICATION |
| SNMP Destination - Host | Tenable Cisco ACI | Cisco_ACI | AUDIT AND ACCOUNTABILITY |
