| 1.3 Host hardware must enable Intel TXT, if available | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.4 Host hardware must enable and configure a TPM 2.0 | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.5 Host integrated hardware management controller must be secure | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.31 O19C-00-009300 | CIS Oracle Database 19c STIG v1.1.0 CAT II OracleDB | OracleDB | CONFIGURATION MANAGEMENT |
| 2.1 Enable Secure Socket Layer (SSL) Encryption - enable ssl | CIS Sybase 15.0 L2 DB v1.1.0 | SybaseDB | |
| 2.2 Host must have all software updates installed | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.2.8 Ensure 'SQLNET.ENCRYPTION_TYPES_CLIENT' Is Set To 'AES256' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS Windows | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.8 Ensure 'SQLNET.ENCRYPTION_TYPES_CLIENT' Is Set To 'AES256' | CIS Oracle Database 19c v2.0.0 L1 RDBMS On Host OS Windows | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.8 Ensure 'SQLNET.ENCRYPTION_TYPES_CLIENT' Is Set To 'AES256' | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.8 Ensure 'SQLNET.ENCRYPTION_TYPES_CLIENT' Is Set To 'AES256' | CIS Oracle Database 19c v2.0.0 L1 RDBMS On Host OS Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.9 Ensure 'SQLNET.ENCRYPTION_TYPES_SERVER' Is Set To AES256 | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Linux Host OS Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.9 Ensure 'SQLNET.ENCRYPTION_TYPES_SERVER' Is Set To AES256 | CIS Oracle Database 23ai v1.1.0 L1 RDBMS On Linux Host OS Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.9 Ensure 'SQLNET.ENCRYPTION_TYPES_SERVER' Is Set To AES256 | CIS Oracle Database 19c v2.0.0 L1 RDBMS On Host OS Windows | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.9 Ensure 'SQLNET.ENCRYPTION_TYPES_SERVER' Is Set To AES256 | CIS Oracle Database 26ai v1.0.0 L1 RDBMS On Windows Server Host OS Windows | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.9 Ensure 'SQLNET.ENCRYPTION_TYPES_SERVER' Is Set To AES256 | CIS Oracle Database 19c v2.0.0 L1 RDBMS On Host OS Unix | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.30 (L1) Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' and (when the Web Server (IIS) Role with Web Services Role Service is installed) 'IIS_IUSRS' (MS only) | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 MS | Windows | ACCESS CONTROL |
| 3.2 Host must deactivate the ESXi shell | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.7 Host must automatically terminate idle DCUI sessions | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | ACCESS CONTROL |
| 3.10 Host must not suppress warnings that the shell is enabled | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SYSTEM AND INFORMATION INTEGRITY |
| 3.20 Host must enable lockdown mode | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | ACCESS CONTROL |
| 4.3 Host must log sufficient information for events | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| 4.5 Host must deactivate log filtering | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | AUDIT AND ACCOUNTABILITY |
| 4.7 Ensure that a Cloudwatch Alarm is created for the "VPC Flow Logs" metric filter, and an Alarm Action is configured | CIS Amazon Web Services Three-tier Web Architecture L1 1.0.0 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 4.11 Host must use strict x509 verification for TLS-enabled remote logging endpoints | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.4 Host must filter Bridge Protocol Data Unit (BPDU) packets | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7 Host should reject MAC address changes on standard virtual switches and port groups | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.8 Host should reject promiscuous mode requests on standard virtual switches and port groups | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10 Ensure security group changes are monitored | CIS Amazon Web Services Foundations v7.0.0 L2 | amazon_aws | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.1.1 Ensure 'AuditDisabled' organizationally is set to 'False' | CIS Microsoft 365 Foundations v7.0.0 L1 E3 | microsoft_azure | AUDIT AND ACCOUNTABILITY |
| 6.1.1 Host CIM services, if enabled, must limit access | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT |
| 6.4.1 Host SNMP services, if enabled, must limit access | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5 Ensure 'Superuser' Runtime Parameters are Configured | CIS PostgreSQL 18 v1.0.0 L1 Database PostgreSQLDB | PostgreSQLDB | CONFIGURATION MANAGEMENT |
| 6.5.3 Host SSH daemon, if enabled, must not allow use of gateway ports | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT |
| 6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.6 Host SSH daemon, if enabled, must set a timeout interval on idle sessions | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.12 Host SSH daemon, if enabled, must not permit user environment settings | CIS VMware ESXi 8.0 v1.4.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 7.6 Virtual machines must limit console sharing. | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.10 Virtual machines must remove unnecessary audio devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.11 Virtual machines must remove unnecessary AHCI devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.16 Virtual machines must remove unnecessary floppy devices | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.22 Virtual machines must deactivate virtual disk wiping operations | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.24 Virtual machines must not be able to obtain host information from the hypervisor | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.3 VMware Tools should configure automatic upgrades as appropriate for the environment | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 8.5 VMware Tools must limit the automatic addition of features | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 8.6 VMware Tools must limit the automatic removal of features | CIS VMware ESXi 8.0 v1.4.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 18.9.6.1 (L1) Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled' | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 MS | Windows | ACCESS CONTROL |
| DO3540-ORACLE11 - The Oracle SQL92_SECURITY parameter should be set to TRUE - 'sql92_security = true' | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | |
| EP11-00-008800 - The EDB Postgres Advanced Server must require users to re-authenticate when organization-defined circumstances or situations require re-authentication. | EDB PostgreSQL Advanced Server v11 DB Audit v2r4 | PostgreSQLDB | IDENTIFICATION AND AUTHENTICATION |
| SQL2-00-015400 - SQL Server software installation account(s) must be restricted to authorized users. | DISA STIG SQL Server 2012 Database OS Audit v1r20 | Windows | CONFIGURATION MANAGEMENT |
| SQLI-22-012300 - SQL Server must maintain a separate execution domain for each executing process. | DISA Microsoft SQL Server 2022 Instance STIG v1r4 MS_SQLDB | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
