| 1.1.9.1 (L1) Ensure 'Lock Encrypted Media Extensions' is set to 'Enabled' | CIS Mozilla Firefox ESR GPO v1.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.6 CISC-RT-000060 | CIS Cisco NX OS Switch RTR STIG v1.1.0 CAT III | Cisco | ACCESS CONTROL, RISK ASSESSMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 1.013 - System information backups are not created, updated, and protected according to DISA requirements. | DISA Windows Vista STIG v6r41 | Windows | CONFIGURATION MANAGEMENT |
| 1.123 APPL-26-003020 | CIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.124 APPL-14-003020 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.8 Disable Host-based Authentication for Login-based Services - rlogin auth sufficient pam_rhosts_auth.so.1 | CIS Solaris 11.1 L1 v1.0.0 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 6.8 Disable Host-based Authentication for Login-based Services - rsh auth sufficient pam_rhosts_auth.so.1 | CIS Solaris 11.2 L1 v1.1.0 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 6.10 Disable Host-based Authentication for Login-based Services | CIS Oracle Solaris 11.4 L1 v1.1.0 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.1 Ensure PostgreSQL configuration files are outside the data cluster | CIS PostgreSQL 11 DB v1.0.0 | PostgreSQLDB | CONFIGURATION MANAGEMENT |
| 8.6 Set default group for root account | CIS Solaris 9 v1.3 | Unix | ACCESS CONTROL |
| AIX7-00-001101 - AIX CDE must conceal, via the session lock, information previously visible on the display with a publicly viewable image. | DISA IBM AIX 7.x STIG v3r3 | Unix | ACCESS CONTROL |
| AOSX-14-003002 - The macOS system must enable certificate for smartcards. | DISA STIG Apple Mac OSX 10.14 v2r6 | Unix | IDENTIFICATION AND AUTHENTICATION |
| APPL-11-000005 - The macOS system must be configured to lock the user session when a smart token is removed. | DISA STIG Apple macOS 11 v1r8 | Unix | ACCESS CONTROL |
| APPL-11-001060 - The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities to verify the establishment of protected sessions. | DISA STIG Apple macOS 11 v1r8 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| APPL-12-003020 - The macOS system must use multifactor authentication for local access to privileged and non-privileged accounts. | DISA STIG Apple macOS 12 v1r9 | Unix | IDENTIFICATION AND AUTHENTICATION |
| CIS_Palo_Alto_Firewall_11_Benchmark_v1.2.0_L2.audit from CIS Palo Alto Firewall 11 Benchmark v1.2.0 | CIS Palo Alto Firewall 11 v1.2.0 L2 | Palo_Alto | |
| CISC-RT-000060 - The Cisco switch must be configured to have all inactive layer 3 interfaces disabled. | DISA Cisco NX OS Switch RTR STIG v3r4 | Cisco | ACCESS CONTROL |
| DG0175-ORACLE11 - The DBMS host platform and other dependent applications should be configured in compliance with applicable STIG requirements. | DISA STIG Oracle 11 Installation v9r1 Linux | Unix | |
| DG0175-ORACLE11 - The DBMS host platform and other dependent applications should be configured in compliance with applicable STIG requirements. | DISA STIG Oracle 11 Installation v9r1 Windows | Windows | |
| ESXI-65-000012 - The ESXi host SSH daemon must ignore .rhosts files. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| ESXI-65-000016 - The ESXi host SSH daemon must not permit user environment settings. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-65-000018 - The ESXi host SSH daemon must not permit GSSAPI authentication. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-65-000024 - The ESXi host SSH daemon must not accept environment variables from the client. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-65-000032 - The ESXi host must prohibit the reuse of passwords within five iterations. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | IDENTIFICATION AND AUTHENTICATION |
| ESXI-65-000047 - The ESXi Image Profile and VIB Acceptance Levels must be verified. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-65-000078 - The ESXi host must use DoD-approved certificates. | DISA STIG VMware vSphere ESXi OS 6.5 v2r4 | Unix | CONFIGURATION MANAGEMENT |
| EX13-CA-000010 - Exchange must use Encryption for OWA access. | DISA Microsoft Exchange 2013 Client Access Server STIG v2r2 | Windows | ACCESS CONTROL |
| EX16-MB-002910 - Exchange must use encryption for Outlook Web App (OWA) access. | DISA Microsoft Exchange 2016 Mailbox Server STIG v2r6 | Windows | ACCESS CONTROL |
| F5BI-DM-000087 - The BIG-IP appliance must be configured to use NIAP evaluated cryptographic mechanisms to protect the integrity of audit information at rest. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| F5BI-DM-000093 - The BIG-IP appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT |
| F5BI-DM-000111 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one upper-case character be used. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000113 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one lower-case character be used. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000115 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must enforce password complexity by requiring that at least one numeric character be used. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000119 - If multifactor authentication is not supported and passwords must be used, the BIG-IP appliance must require that when a password is changed, the characters are changed in at least eight (8) of the positions within the password. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000121 - The BIG-IP appliance must only store encrypted representations of passwords. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000127 - The BIG-IP appliance must be configured to enforce a 60-day maximum password lifetime restriction. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-000151 - The application must be configured to reveal error messages only to authorized individuals (ISSO, ISSM, and SA). | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| F5BI-DM-000155 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are created. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000159 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are disabled. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000173 - The BIG-IP appliance must be configured to generate an immediate alert for account-enabling actions. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000175 - The BIG-IP appliance must be configured to transmit access authorization information using approved security safeguards to authorized information systems that enforce access control decisions. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| F5BI-DM-000193 - The BIG-IP appliance must be configured to generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| F5BI-DM-000215 - The BIG-IP appliance must be configured to audit the enforcement actions used to restrict access associated with changes to the device. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT |
| F5BI-DM-000257 - The BIG-IP appliance must be configured to off-load audit records onto a different system or media than the system being audited. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | AUDIT AND ACCOUNTABILITY |
| F5BI-DM-000279 - The BIG-IP appliance must be configured to create backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING |
| F5BI-DM-000281 - The BIG-IP appliance must be configured to employ automated mechanisms to assist in the tracking of security incidents. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | CONFIGURATION MANAGEMENT, INCIDENT RESPONSE |
| F5BI-DM-000290 - If the BIG-IP appliance is being used to authenticate users for web applications, the HTTPOnly flag must be set. | DISA F5 BIG-IP Device Management STIG v2r4 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| GOOG-11-006100 - Google Android 11 must be configured to generate audit records for the following auditable events: detected integrity violations. | AirWatch - DISA Google Android 11 COBO v2r1 | MDM | AUDIT AND ACCOUNTABILITY |
| SQL2-00-010000 - DBA OS or domain accounts must be granted only those host system privileges necessary for the administration of SQL Server. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| ZEBR-11-006100 - Zebra Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations. | MobileIron - DISA Zebra Android 11 COBO STIG v1r4 | MDM | AUDIT AND ACCOUNTABILITY |
