| 2.2.1.6 Ensure 'Force automatic date and time' is set to 'Enabled' | AirWatch - CIS Apple iOS 26 Benchmark v1.0.0 L1 End User Owned | MDM | AUDIT AND ACCOUNTABILITY |
| 2.2.1.8 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iOS 11 v1.0.0 End User Owned L1 | MDM | ACCESS CONTROL |
| 2.2.1.9 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iOS 26 Benchmark v1.0.0 L1 End User Owned | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 2.2.1.10 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iOS 17 Benchmark v1.1.0 End User Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 2.6.1 Ensure 'Allow user to move messages from this account' is set to 'Disabled' | AirWatch - CIS Apple iOS 10 v2.0.0 End User Owned L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.3.1.4 Ensure net.ipv4.conf.all.send_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Amazon Linux 2 v4.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Debian Linux 12 v2.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS Rocky Linux 9 v3.0.0 L1 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1.5 Ensure net.ipv4.conf.default.send_redirects is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.4.4 Ensure 'Maximum Auto-Lock' is set to '2 minutes' or less | MobileIron - CIS Apple iOS 17 Institution Owned L1 | MDM | ACCESS CONTROL |
| 3.4.4 Ensure 'Maximum Auto-Lock' is set to '2 minutes' or less | AirWatch - CIS Apple iOS 26 v1.0.0 L1 Institution Owned | MDM | ACCESS CONTROL |
| 3.4.4 Ensure 'Maximum Auto-Lock' is set to '2 minutes' or less | MobileIron - CIS Apple iPadOS 18 v2.0.0 L1 Institution Owned | MDM | ACCESS CONTROL |
| AIOS-10-080102 - Apple iOS must implement the management setting: remove managed applications upon unenrollment from MDM. | MobileIron - DISA Apple iOS 10 v1r3 | MDM | CONFIGURATION MANAGEMENT |
| AMLS-L3-000140 - The Arista Multilayer Switch must be configured so inactive router interfaces are disabled. | DISA STIG Arista MLS DCS-7000 Series RTR v1r4 | Arista | ACCESS CONTROL |
| AMLS-L3-000150 - The Arista Multilayer Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space. | DISA STIG Arista MLS DCS-7000 Series RTR v1r4 | Arista | ACCESS CONTROL |
| AMLS-L3-000180 - The Arista Multilayer Switch must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain. | DISA STIG Arista MLS DCS-7000 Series RTR v1r4 | Arista | ACCESS CONTROL |
| ARBA-ND-000200 - AOS must limit the number of concurrent sessions to a maximum of three for each administrator account and/or administrator account type. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-ND-000215 - AOS must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-ND-000245 - AOS must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | CONFIGURATION MANAGEMENT |
| ARBA-ND-000262 - AOS must be configured to use DOD-approved Online Certificate Status Protocol (OCSP) responders or Certificate Revocation Lists (CRLs) to validate certificates used for public key infrastructure (PKI)-based authentication. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000298 - AOS must be configured to synchronize internal information system clocks using redundant authoritative time sources. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| ARBA-ND-000310 - AOS must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000313 - AOS must prohibit the use of cached authenticators after an organization-defined time period. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000325 - AOS must off-load audit records onto a different system or media than the system being audited. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | AUDIT AND ACCOUNTABILITY |
| ARBA-ND-000329 - AOS must require that when a password is changed, the characters are changed in at least eight of the positions within the password. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000341 - AOS must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING |
| ARBA-ND-000346 - AOS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARST-ND-000010 - The Arista network device must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type. | DISA STIG Arista MLS EOS 4.2x NDM v2r1 | Arista | ACCESS CONTROL |
| ARST-ND-000120 - The Arista network device must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. | DISA STIG Arista MLS EOS 4.2x NDM v2r1 | Arista | ACCESS CONTROL |
| ARST-ND-000660 - The Arista network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). | DISA STIG Arista MLS EOS 4.2x NDM v2r1 | Arista | IDENTIFICATION AND AUTHENTICATION |
| ARST-ND-000700 - The Arista network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions. | DISA STIG Arista MLS EOS 4.2x NDM v2r1 | Arista | MAINTENANCE |
| ARST-RT-000570 - The Arista BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer. | DISA Arista MLS EOS 4.X Router STIG v2r2 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| ARST-RT-000600 - The Arista BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM). | DISA Arista MLS EOS 4.X Router STIG v2r2 | Arista | SYSTEM AND COMMUNICATIONS PROTECTION |
| BGP: Disable Capability Negotiation | TNS Alcatel-Lucent TiMOS/Nokia SR-OS Best Practice Audit | Alcatel | SYSTEM AND COMMUNICATIONS PROTECTION |
| DG0071-ORACLE11 - New passwords must be required to differ from old passwords by more than four characters - 'PASSWORD_VERIFY_FUNCTION is not set to NULL or DEFAULT' | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | |
| F5BI-DM-300009 - The F5 BIG-IP appliance must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL |
| F5BI-DM-300039 - The F5 BIG-IP appliance must be configured to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | CONFIGURATION MANAGEMENT |
| F5BI-DM-300041 - The F5 BIG-IP appliance must be running an operating system release that is currently supported by the vendor. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | CONFIGURATION MANAGEMENT |
| F5BI-DM-300045 - The F5 BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | CONFIGURATION MANAGEMENT |
| F5BI-DM-300048 - The F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300049 - The F5 BIG-IP appliance must enforce a minimum 15-character password length. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300054 - The F5 BIG-IP appliance must require that when a password is changed, the characters are changed in at least eight of the positions within the password. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300056 - The F5 BIG-IP appliance must be configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300098 - The F5 BIG-IP appliance must be configured to display the Standard Mandatory DOD Notice and Consent Banner when accessing via SSH. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL |
| Huawei: Insecure HTTP is not configured. | TNS Huawei VRP Best Practice Audit | Huawei | CONFIGURATION MANAGEMENT |
| JUEX-RT-000660 - The Juniper BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer. | DISA Juniper EX Series Switches Router STIG v2r1 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| OL09-00-006026 - OL 9 must not forward IPv4 source-routed packets by default. | DISA Oracle Linux 9 STIG v1r6 | Unix | CONFIGURATION MANAGEMENT |
