CCI-000381
Configure the system to provide only organization-defined mission essential capabilities.
2 rules found Severity: Medium
2 rules found Severity: Medium
The Firefox New Tab page must not show Top Sites, Sponsored Top sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The CA API Gateway must be configured to remove or disable unrelated or unneeded application proxy services.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.
1 rule found Severity: Medium
The insecure registry capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.
1 rule found Severity: Medium
On Linux, a non-AUFS storage driver in the Docker Engine - Enterprise component of Docker Enterprise must be used.
1 rule found Severity: Medium
The userland proxy capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.
1 rule found Severity: Medium
Experimental features in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.
1 rule found Severity: Medium
The Docker Enterprise self-signed certificates in Universal Control Plane (UCP) must be replaced with DoD trusted, signed certificates.
1 rule found Severity: Medium
The Docker Enterprise self-signed certificates in Docker Trusted Registry (DTR) must be replaced with DoD trusted, signed certificates.
1 rule found Severity: Medium
The option in Universal Control Plane (UCP) allowing users and administrators to schedule containers on all nodes, including UCP managers and Docker Trusted Registry (DTR) nodes must be disabled in Docker Enterprise.
1 rule found Severity: Medium
The Create repository on push option in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.
1 rule found Severity: Medium
Periodic data usage and analytics reporting in Universal Control Plane (UCP) must be disabled in Docker Enterprise.
1 rule found Severity: Medium
Periodic data usage and analytics reporting in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Linux Kernel capabilities must be restricted within containers as defined in the System Security Plan (SSP) for Docker Enterprise.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: High
The FortiGate firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
1 rule found Severity: Medium
2 rules found Severity: Medium
The storage system in a hardened configuration must be configured to disable the Remote Copy feature, unless needed.
1 rule found Severity: High
7 rules found Severity: Medium
9 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The WebSphere Application Server process must not be started from the command line with the -password option.
1 rule found Severity: Medium
1 rule found Severity: Medium
The WebSphere Application Server must remove JREs left by web server and plug-in installers for web servers and plugins running in the DMZ.
1 rule found Severity: Low
Microsoft Android 11 must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.
1 rule found Severity: Medium
Motorola Solutions Android 11 must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Motorola Solutions Android 11 must allow only the Administrator (EMM) to perform the following management function: Enable/disable location services.
1 rule found Severity: Low
Firefox must be configured to not automatically check for updated versions of installed search plugins.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Firefox New Tab page must not show Top Sites, Sponsored Top Sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.
1 rule found Severity: Medium
Microsoft Android 11 must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the product's Common Criteria evaluation.
1 rule found Severity: Medium
1 rule found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
The ability to automatically hyperlink screenshots within Word, PowerPoint, Excel and Outlook must be disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
Roaming settings must be stored locally and not synchronized to the Microsoft Office roaming settings web service.
1 rule found Severity: Medium
The ability of the Office Telemetry Agent to periodically upload telemetry data to a shared folder must be disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SQL Server must have the SQL Server Reporting Services (SSRS) software component removed if it is unused.
1 rule found Severity: Medium
SQL Server must have the SQL Server Integration Services (SSIS) software component removed if it is unused.
1 rule found Severity: Medium
SQL Server must have the SQL Server Analysis Services (SSAS) software component removed if it is unused.
1 rule found Severity: Medium
SQL Server must have the SQL Server Distributed Replay Client software component removed if it is unused.
1 rule found Severity: Medium
SQL Server must have the SQL Server Distributed Replay Controller software component removed if it is unused.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Low
OHS must have the IfModule cgid_module directive disabled for the OHS server, virtual host, and directory configuration.
1 rule found Severity: Medium
OHS must have the LoadModule cgi_module directive disabled within the IfModule mpm_winnt_module directive.
1 rule found Severity: Low
OHS must have the ScriptAlias /cgi-bin/ directive within a IfModule alias_module directive disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Users and scripts running on behalf of users must be contained to the document root or home directory tree of OHS.
1 rule found Severity: Medium
If WebLogic is not in use with OHS, OHS must have the include mod_wl_ohs.conf directive disabled at the server level.
1 rule found Severity: Medium
1 rule found Severity: Medium
Oracle WebLogic must adhere to the principles of least functionality by providing only essential capabilities.
1 rule found Severity: Medium
The Riverbed Optimization System (RiOS) must not have unrelated or unnecessary services enabled on the host.
1 rule found Severity: Medium
1 rule found Severity: Medium
The SEL-2740S must be configured to permit the allowed and necessary ports, functions, protocols, and services.
1 rule found Severity: Medium
Samsung Android must be configured to disable trust agents. NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product Common Criteria evaluation.
2 rules found Severity: Medium
Samsung Android must be configured to disable Face Recognition. NOTE: This requirement is not applicable (NA) for specific biometric authentication factors included in the product Common Criteria evaluation.
2 rules found Severity: Medium
1 rule found Severity: Medium
Symantec ProxySG must be configured to remove or disable unrelated or unneeded application proxy services.
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
Apple iOS/iPadOS 16 must implement the management setting: Encrypt iTunes backups/Encrypt local backup.
2 rules found Severity: Medium
5 rules found Severity: High
1 rule found Severity: Low
2 rules found Severity: Medium
The macOS system must be configured to disable the Network File System (NFS) daemon unless it is required.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Low
The macOS system must be configured to prevent password proximity sharing requests from nearby Apple Devices.
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: High
2 rules found Severity: High
Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.
4 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Unused database components that are integrated in the DBMS and cannot be uninstalled must be disabled.
3 rules found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
Unused database components which are integrated in PostgreSQL and cannot be uninstalled must be disabled.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
Zebra Android 11 must allow only the Administrator (EMM) to perform the following management function: Enable/disable location services.
1 rule found Severity: Low
2 rules found Severity: Medium
Unused database components, EDB Postgres Advanced Server software, and database objects must be removed.
2 rules found Severity: Medium
Unused database components which are integrated in the EDB Postgres Advanced Server and cannot be uninstalled must be disabled.
2 rules found Severity: Medium
The BIG-IP Core implementation must be configured so that only functions, ports, protocols, and/or services that are documented for the server/application for which the virtual servers are providing connectivity.
1 rule found Severity: Medium
The BIG-IP Core implementation must be configured to remove or disable any functions, ports, protocols, and/or services that are not documented as required.
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Low
Apple iOS/iPadOS 16 must implement the management setting: Not allow automatic completion of Safari browser passcodes.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Low
Apple iOS/iPadOS 17 must implement the management setting: not allow automatic completion of Safari browser passcodes.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
The macOS system must be configured to prevent password proximity sharing requests from nearby Apple devices.
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
Unused database components that are integrated in PostgreSQL and cannot be uninstalled must be disabled.
2 rules found Severity: Medium
The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
1 rule found Severity: Medium
1 rule found Severity: Low
The Enterprise Voice, Video, and Messaging Endpoint must be configured to disable or remove nonessential capabilities.
1 rule found Severity: Medium
The F5 BIG-IP appliance must be configured to prohibit or restrict the use of unnecessary or prohibited functions, ports, protocols, and/or services, including those defined in the PPSM CAL and vulnerability assessments.
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Session Manager must be configured to disable nonessential capabilities.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
If AIX system does not act as a remote print server for other servers, the lpd daemon must be disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Azure SQL Database default demonstration and sample databases, database objects, and applications must be removed.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
All IIS 10.0 web server sample code, example applications, and tutorials must be removed from a production IIS 10.0 server.
1 rule found Severity: High
The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 10.0 server.
1 rule found Severity: Medium
The IIS 10.0 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.
1 rule found Severity: Medium
The IIS 10.0 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: High
2 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
3 rules found Severity: Medium
The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
3 rules found Severity: Low
1 rule found Severity: Medium
Windows 11 must be configured to prevent users from receiving suggestions for third-party or additional applications.
1 rule found Severity: Low
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
Unused database components, MySQL Database Server 8.0 software, and database objects must be removed.
1 rule found Severity: Medium
Unused database components which are integrated in the MySQL Database Server 8.0 and cannot be uninstalled must be disabled.
1 rule found Severity: Medium
Unused database components that are integrated in Redis Enterprise DBMS and cannot be uninstalled must be disabled.
1 rule found Severity: Medium
All Automation Controller NGINX front-end web servers must not perform user management for hosted applications.
1 rule found Severity: Medium
All Automation Controller NGINX web servers must not be a proxy server for any process other than the Automation Controller application.
1 rule found Severity: Medium
All Automation Controller NGINX webserver accounts not utilized by installed features (i.e., tools, utilities, specific services, etc.) must not be created and must be deleted when the web server feature is uninstalled.
1 rule found Severity: Medium
All Automation Controller NGINX web servers must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
All Automation Controller NGINX web servers must protect system resources and privileged operations from hosted applications.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.
2 rules found Severity: Medium
The SMS must be configured to remove or disable nonessential capabilities on SMS and TPS, which are not required for operation or not related to IDPS functionality.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
1 rule found Severity: Medium
Web server accounts not utilized by installed features (i.e., tools, utilities, specific services, etc.) must not be created and must be deleted when the web server feature is uninstalled.
1 rule found Severity: Medium
The web server must provide install options to exclude installation of utility programs, services, plug-ins, and modules not necessary for operation.
1 rule found Severity: Medium
The web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Users and scripts running on behalf of users must be contained to the document root or home directory tree of the web server.
1 rule found Severity: Medium
4 rules found Severity: Medium
2 rules found Severity: Medium
The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
2 rules found Severity: High
4 rules found Severity: Medium
3 rules found Severity: Medium
2 rules found Severity: Medium
Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
2 rules found Severity: High
The Apache web server must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server.
2 rules found Severity: Medium
Apple iOS/iPadOS 18 must implement the management setting: not allow automatic completion of Safari browser passcodes.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The application server must adhere to the principles of least functionality by providing only essential capabilities.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The container platform registry must contain only container images for those capabilities being offered by the container platform.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
1 rule found Severity: Medium
Google Android 14 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
2 rules found Severity: Low
Google Android 15 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
2 rules found Severity: Low
1 rule found Severity: Medium
The IDPS must be configured to remove or disable non-essential capabilities which are not required for operation or not related to IDPS functionality (e.g., DNS, email client or server, FTP server, or web server).
1 rule found Severity: Medium
The IDPS must be configured to remove or disable non-essential features, functions, and services of the IDPS application.
1 rule found Severity: Medium
IBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s).
3 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Low
The Juniper SRX Services Gateway Firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
1 rule found Severity: Medium
The Juniper SRX Services Gateway Firewall must not be configured as an NTP server since providing this network service is unrelated to the role as a firewall.
1 rule found Severity: Medium
The Juniper SRX Services Gateway Firewall must not be configured as a DNS proxy since providing this network service is unrelated to the role as a Firewall.
1 rule found Severity: Medium
The Juniper SRX Services Gateway Firewall must not be configured as a DHCP server since providing this network service is unrelated to the role as a Firewall.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.
1 rule found Severity: Medium
1 rule found Severity: Medium
Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.
1 rule found Severity: Medium
SQL Server execute permissions to access the registry must be revoked, unless specifically required and approved.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SQL Server External Scripts Enabled feature must be disabled, unless specifically required and approved.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
1 rule found Severity: Medium
Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen.
1 rule found Severity: Medium
Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
1 rule found Severity: Medium
Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 network selection user interface (UI) must not be displayed on the logon screen.
1 rule found Severity: Medium
Windows Server 2022 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Prisma Cloud Compute Cloud Native Network Firewall (CNNF) automatically monitors layer 4 (TCP) intercontainer communications. Enforcement policies must be created.
1 rule found Severity: High
Images stored within the container registry must contain only images to be run as containers within the container platform.
1 rule found Severity: Medium
Prisma Cloud Compute must be configured to scan images that have not been instantiated as containers.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
OpenShift must contain only container images for those capabilities being offered by the container platform.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
The SUSE operating system must not have the vsftpd package installed if not required for operational support.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
The SUSE operating system must not have the vsftpd package installed if not required for operational support.
1 rule found Severity: Medium
2 rules found Severity: Medium
Samsung Android must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
4 rules found Severity: Low
1 rule found Severity: Medium
The ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).
3 rules found Severity: Medium
1 rule found Severity: Medium
The NSX Tier-0 Gateway router must be configured to have the Dynamic Host Configuration Protocol (DHCP) service disabled if not in use.
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Low
1 rule found Severity: Medium
ESX Agent Manager must have Multipurpose Internet Mail Extensions (MIMEs) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
VAMI must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
VAMI must explicitly disable Multipurpose Internet Mail Extensions (MIME) mime mappings based on "Content-Type".
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Lookup Service must have Multipurpose Internet Mail Extensions (MIMEs) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The ESXi host must be configured to disable nonessential capabilities by disabling the Managed Object Browser (MOB).
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
Performance Charts must have Multipurpose Internet Mail Extensions (MIMEs) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
The Security Token Service must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
vSphere UI must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The vCenter PostgreSQL service must not load unused database components, software, and database objects.
2 rules found Severity: Medium
Zebra Android 13 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP).
2 rules found Severity: Low
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The vCenter VAMI service must explicitly disable Multipurpose Internet Mail Extensions (MIME) mime mappings based on "Content-Type".
2 rules found Severity: Medium
The vCenter VAMI service must have resource mappings set to disable the serving of certain file types.
2 rules found Severity: Medium
2 rules found Severity: Medium
The vCenter VAMI service must protect system resources and privileged operations from hosted applications.
2 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
CL/SuperSession must be properly configured to generate SMF records for audit trail and accounting reports.
3 rules found Severity: Medium
3 rules found Severity: Medium
CL/SuperSession APPCLASS member is not configured in accordance with the proper security requirements.
3 rules found Severity: Medium
CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements.
3 rules found Severity: Medium
Transparent Data Migration Facility (TDMF) configuration/parameter/option values are not specified properly.
3 rules found Severity: Medium
1 rule found Severity: Medium