| CD16-00-002100 - The audit information produced by PostgreSQL must be protected from unauthorized modification. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| CD16-00-002500 - PostgreSQL must protect its audit features from unauthorized removal. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| CD16-00-002800 - Database software, including PostgreSQL configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | CONFIGURATION MANAGEMENT |
| CD16-00-003000 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to PostgreSQL, etc.) must be restricted to authorized users. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | CONFIGURATION MANAGEMENT |
| CD16-00-003600 - PostgreSQL must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| CD16-00-004200 - PostgreSQL must map the PKI-authenticated identity to an associated user account. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| CD16-00-004400 - PostgreSQL must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | IDENTIFICATION AND AUTHENTICATION |
| CD16-00-005200 - PostgreSQL must protect the confidentiality and integrity of all information at rest. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD16-00-005400 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD16-00-005600 - Access to database files must be limited to relevant processes and to authorized, administrative users. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CD16-00-005800 - PostgreSQL and associated applications must reserve the use of dynamic code execution for situations that require it. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | SYSTEM AND INFORMATION INTEGRITY |
| CD16-00-007400 - PostgreSQL must provide an immediate real-time alert to appropriate support staff of all audit log failures. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| CD16-00-009100 - When updates are applied to the PostgreSQL software, any software components that have been replaced or made unnecessary must be removed. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | SYSTEM AND INFORMATION INTEGRITY |
| CD16-00-009500 - PostgreSQL must generate audit records when unsuccessful attempts to access security objects occur. | DISA Crunchy Data Postgres 16 STIG v1r3 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| CD16-00-010100 - PostgreSQL must generate audit records when unsuccessful attempts to modify privileges/permissions occur. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD16-00-011000 - PostgreSQL must generate audit records when categories of information (e.g., classification levels/security levels) are deleted. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD16-00-011600 - PostgreSQL must generate audit records showing starting and ending time for user access to the database(s). | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD16-00-012300 - PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners' requirements. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-67-000009 - The ESXi host SSH daemon must be configured with the DoD logon banner - DoD login banner. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | ACCESS CONTROL |
| ESXI-67-000010 - The ESXi host SSH daemon must use DoD-approved encryption to protect the confidentiality of remote access sessions. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | ACCESS CONTROL |
| ESXI-67-000013 - The ESXi host SSH daemon must not allow host-based authentication. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-67-000024 - The ESXi host SSH daemon must not accept environment variables from the client. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-67-000044 - The ESXi host must enable kernel core dumps. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-67-000047 - The ESXi Image Profile and vSphere Installation Bundle (VIB) Acceptance Levels must be verified. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-67-000076 - The ESXi host must enable Secure Boot. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-67-000078 - The ESXi host must use DoD-approved certificates. | DISA STIG VMware vSphere 6.7 ESXi OS v1r3 | Unix | CONFIGURATION MANAGEMENT |
| F5BI-AP-300003 - The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-300008 - To protect against data mining, the F5 BIG-IP appliance providing content filtering must prevent SQL injection attacks launched against data storage objects, including, at a minimum, databases, database records, and database fields. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | ACCESS CONTROL |
| F5BI-AP-300012 - The F5 BIG-IP appliance providing user access control intermediary services must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | ACCESS CONTROL |
| F5BI-AP-300018 - The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| F5BI-AP-300042 - The F5 BIG-IP appliance that intermediary services for FTP must inspect inbound and outbound FTP communications traffic for protocol compliance and protocol anomalies. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-300047 - The F5 BIG-IP appliance providing user authentication intermediary services must uniquely identify and authenticate users using redundant authentication servers and multifactor authentication (MFA). | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-AP-300155 - The F5 BIG-IP appliance must not use the On-demand Cert Auth VPE agent as part of the APM Policy Profiles. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-300159 - The F5 BIG-IP appliance must be configured to use cryptographic algorithms approved by NSA to protect NSS for remote access to a classified network. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-AP-300164 - The F5 BIG-IP appliance must be configured to set the "Max In Progress Sessions per Client IP" value to 10 or an organizational-defined number. | DISA F5 BIG-IP TMOS ALG STIG v1r3 | F5 | ACCESS CONTROL |
| VCPF-67-000004 - Performance Charts must protect cookies from cross-site scripting (XSS). | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| VCPF-67-000009 - Performance Charts must only run one web app. | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-67-000011 - Performance Charts must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled. | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-67-000013 - Performance Charts must not have the Web Distributed Authoring (WebDAV) servlet installed. | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCPF-67-000020 - Performance Charts must use the 'setCharacterEncodingFilter' filter - filter-mapping | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCPF-67-000028 - Performance Charts must be configured with the appropriate ports - http | DISA STIG VMware vSphere 6.7 Perfcharts Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-67-000006 - The Security Token Service must generate log records during Java startup and shutdown - prefix | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| VCST-67-000016 - The Security Token Service must not have any symbolic links in the web content directory tree. | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | CONFIGURATION MANAGEMENT |
| VCST-67-000021 - The Security Token Service must use the 'setCharacterEncodingFilter' filter - filter-mapping | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCST-67-000023 - The Security Token Service must not show directory listings. | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCST-67-000025 - The Security Token Service must not enable support for TRACE requests. | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCST-67-000030 - The Security Token Service must set the secure flag for cookies. | DISA STIG VMware vSphere 6.7 STS Tomcat v1r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCUI-67-000006 - vSphere UI must generate log records for system startup and shutdown. | DISA STIG VMware vSphere 6.7 UI Tomcat v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| VCUI-67-000020 - vSphere UI must set the welcome-file node to a default web page. | DISA STIG VMware vSphere 6.7 UI Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| VCUI-67-000022 - vSphere UI must be configured to hide the server version. | DISA STIG VMware vSphere 6.7 UI Tomcat v1r3 | Unix | SYSTEM AND INFORMATION INTEGRITY |
