| 1.1.6 Default admin account password | CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| 1.15.2 Ensure 'Guided Switch Enabled' is set to 'Disabled' | CIS Microsoft Edge v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 1.62 VCSA-80-000300 | CIS VMware vSphere 8.0 vCenter STIG v1.0.0 CAT II | VMware | CONFIGURATION MANAGEMENT |
| 2.2.1.7 Ensure 'Force automatic date and time' is set to 'Enabled' | AirWatch - CIS Apple iOS 17 Benchmark v1.1.0 End User Owned L1 | MDM | AUDIT AND ACCOUNTABILITY |
| 2.2.1.10 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iPadOS 26 v1.0.0 L1 End User Owned | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 2.2.1.10 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iPadOS 17 v1.1.0 End User Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.14 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | ACCESS CONTROL |
| 3.2.1.17 Ensure 'Force automatic date and time' is set to 'Enabled' | AirWatch - CIS Apple iOS 17 Institution Owned L1 | MDM | AUDIT AND ACCOUNTABILITY |
| 3.4.4 Ensure 'Maximum Auto-Lock' is set to '2 minutes' or less | MobileIron - CIS Apple iPadOS 26 v1.0.0 L1 Institutionally Owned | MDM | ACCESS CONTROL |
| 3.4.4 Ensure 'Maximum Auto-Lock' is set to '2 minutes' or less | MobileIron - CIS Apple iOS 18 v2.0.0 L1 Institution Owned | MDM | ACCESS CONTROL |
| AMLS-L2-000140 - The Arista Multilayer Switch must re-authenticate all endpoint devices every 60 minutes or less - dot1x reauthentication | DISA STIG Arista MLS DCS-7000 Series L2S v1r3 | Arista | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000200 - AOS must limit the number of concurrent sessions to a maximum of three for each administrator account and/or administrator account type. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-ND-000214 - AOS must be configured to enforce the limit of three consecutive invalid login attempts, after which time it must block any login attempt for 15 minutes. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-ND-000216 - AOS must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL |
| ARBA-ND-000250 - AOS must implement replay-resistant authentication mechanisms for network access to privileged accounts. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000252 - AOS must enforce a minimum 15-character password length. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000256 - AOS must enforce password complexity by requiring that at least one numeric character be used. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000257 - AOS must enforce password complexity by requiring that at least one special character be used. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000287 - AOS must enforce role-based access control policies over defined subjects and objects. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| ARBA-ND-000295 - AOS must generate an immediate real-time alert of all audit failure events requiring real-time alerts. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | AUDIT AND ACCOUNTABILITY |
| ARBA-ND-000299 - AOS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | AUDIT AND ACCOUNTABILITY |
| ARBA-ND-000310 - AOS must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC). | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000313 - AOS must prohibit the use of cached authenticators after an organization-defined time period. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000329 - AOS must require that when a password is changed, the characters are changed in at least eight of the positions within the password. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARBA-ND-000334 - AOS must generate log records for a locally developed list of auditable events. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| ARBA-ND-000340 - AOS must be configured to conduct backups of system-level information contained in the information system when changes occur. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING |
| ARBA-ND-000344 - AOS must obtain its public key certificates from an appropriate certificate policy through an approved service provider. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| ARBA-ND-000347 - AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based. | DISA HPE Aruba Networking AOS NDM STIG v1r1 | ArubaOS | IDENTIFICATION AND AUTHENTICATION |
| ARST-ND-000860 - The Arista network device must be running an operating system release that is currently supported by the vendor. | DISA STIG Arista MLS EOS 4.2x NDM v2r1 | Arista | CONFIGURATION MANAGEMENT |
| CIS_Cisco_Firewall_v8.x_Level_1_v4.2.0.audit for Cisco ASA 8 from CIS Cisco Firewall v8.x Benchmark v4.2.0 | CIS Cisco Firewall v8.x L1 v4.2.0 | Cisco | |
| DG0071-ORACLE11 - New passwords must be required to differ from old passwords by more than four characters - 'PASSWORD_VERIFY_FUNCTION is not set to NULL or DEFAULT' | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | |
| ESXI-70-000048 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic. | DISA VMware vSphere 7.0 ESXi STIG v1r4 VMware | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| ESXI-80-000160 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic. | DISA VMware vSphere 8.0 ESXi STIG v2r3 VMware | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| F5BI-DM-300003 - The F5 BIG-IP appliance must terminate shared/group account credentials when members leave the group. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL |
| F5BI-DM-300013 - The F5 BIG-IP appliance must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for at least 15 minutes. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL |
| F5BI-DM-300014 - The F5 BIG-IP appliance must be configured to display the Standard Mandatory DOD Notice and Consent Banner upon access to the TMOS User Interface. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | ACCESS CONTROL |
| F5BI-DM-300033 - The F5 BIG-IP appliance must manage local audit storage capacity in accordance with organization-defined audit record storage requirements. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | AUDIT AND ACCOUNTABILITY |
| F5BI-DM-300037 - The F5 BIG-IP appliance must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC). | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | AUDIT AND ACCOUNTABILITY |
| F5BI-DM-300052 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one numeric character be used. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300053 - The F5 BIG-IP appliance must enforce password complexity by requiring that at least one special character be used. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300055 - The F5 BIG-IP appliance must prohibit the use of cached authenticators after eight hours or less. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | IDENTIFICATION AND AUTHENTICATION |
| F5BI-DM-300060 - The F5 BIG-IP appliance must conduct backups of the configuration at a weekly or organization-defined frequency and store on a separate device. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING |
| F5BI-DM-300099 - The F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session. | DISA F5 BIG-IP TMOS NDM STIG v1r2 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUSX-VN-000015 - The Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture. | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-VN-000016 - The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations. | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | CONFIGURATION MANAGEMENT |
| JUSX-VN-000018 - The Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | IDENTIFICATION AND AUTHENTICATION |
| JUSX-VN-000025 - The Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions. | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUSX-VN-000027 - The Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations. | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| JUSX-VN-000028 - The Juniper SRX Services Gateway VPN must disable split-tunneling for remote clients VPNs. | DISA Juniper SRX Services Gateway VPN v3r2 | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| vNetwork : restrict-netflow-usage | VMWare vSphere 6.5 Hardening Guide | VMware | |
