Definition of NIST Special Publication 800-171 Revision 3 for rhel10

03.01.01: Account Management

Description: None

• default

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
  • CCE-88163-1
• inactivity_timeout_value = 15_minutes
• no_invalid_shell_accounts_unlocked: Verify Non-Interactive Accounts Are Locked
  • CCE-86751-5
• no_password_auth_for_systemaccounts: Ensure that System Accounts Are Locked
  • CCE-90273-4
• no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login
  • CCE-87448-7
• var_accounts_tmout = 15_min

03.01.02: Access Enforcement

Description: None

• default

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-88580-6
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-89314-9
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-87651-6
• accounts_umask_root: Ensure the Root Bash Umask is Set Correctly
  • CCE-87074-1
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-89816-3
• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-88397-5
• directory_groupowner_sshd_config_d: Verify Group Who Owns SSH Server Configuration Files
  • CCE-89991-4
• directory_owner_sshd_config_d: Verify Owner on SSH Server Configuration Files
  • CCE-89747-0
• directory_permissions_sshd_config_d: Verify Permissions on SSH Server Config File
  • CCE-89963-3
• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  • CCE-89099-6
• file_at_allow_exists: Ensure that /etc/at.allow exists
  • CCE-86855-4
• file_at_deny_not_exist: Ensure that /etc/at.deny does not exist
  • CCE-89507-8
• file_cron_allow_exists: Ensure that /etc/cron.allow exists
  • CCE-87235-8
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
  • CCE-88579-8
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
  • CCE-90598-4
• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
  • CCE-89477-4
• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
  • CCE-88453-6
• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
  • CCE-89914-6
• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
  • CCE-88235-7
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
  • CCE-90094-4
• file_groupowner_cron_d: Verify Group Who Owns cron.d
  • CCE-89321-4
• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
  • CCE-90342-7
• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
  • CCE-88140-9
• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
  • CCE-88986-5
• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
  • CCE-89080-6
• file_groupowner_cron_yearly: Verify Group Who Owns cron.yearly
  • CCE-88898-2
• file_groupowner_crontab: Verify Group Who Owns Crontab
  • CCE-89062-4
• file_groupowner_etc_group: Verify Group Who Owns group File
  • CCE-90261-9
• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
  • CCE-90043-1
• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
  • CCE-89209-1
• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
  • CCE-88343-9
• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
  • CCE-87687-0
• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
  • CCE-89210-9
• file_groupowner_etc_security_opasswd: Verify Group Who Owns /etc/security/opasswd File
  • CCE-90453-2
• file_groupowner_etc_security_opasswd_old: Verify Group Who Owns /etc/security/opasswd.old File
  • CCE-89419-6
• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
  • CCE-87579-9
• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
  • CCE-90020-9
• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
  • CCE-86992-5
• file_groupowner_sshd_drop_in_config: Verify Group Who Owns SSH Server Configuration Files
  • CCE-86254-0
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-90288-2
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-90469-8
• file_owner_at_allow: Verify User Who Owns /etc/at.allow file
  • CCE-88524-4
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
  • CCE-89017-8
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
  • CCE-86957-8
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
  • CCE-90377-3
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
  • CCE-87502-1
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
  • CCE-88914-7
• file_owner_cron_d: Verify Owner on cron.d
  • CCE-88741-4
• file_owner_cron_daily: Verify Owner on cron.daily
  • CCE-87499-0
• file_owner_cron_hourly: Verify Owner on cron.hourly
  • CCE-89705-8
• file_owner_cron_monthly: Verify Owner on cron.monthly
  • CCE-90753-5
• file_owner_cron_weekly: Verify Owner on cron.weekly
  • CCE-88943-6
• file_owner_cron_yearly: Verify Owner on cron.yearly
  • CCE-90735-2
• file_owner_crontab: Verify Owner on crontab
  • CCE-87294-5
• file_owner_etc_group: Verify User Who Owns group File
  • CCE-86870-3
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
  • CCE-87701-9
• file_owner_etc_issue: Verify ownership of System Login Banner
  • CCE-88544-2
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
  • CCE-86969-3
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
  • CCE-87043-6
• file_owner_etc_passwd: Verify User Who Owns passwd File
  • CCE-87827-2
• file_owner_etc_security_opasswd: Verify User Who Owns /etc/security/opasswd File
  • CCE-86791-1
• file_owner_etc_security_opasswd_old: Verify User Who Owns /etc/security/opasswd.old File
  • CCE-88528-5
• file_owner_etc_shadow: Verify User Who Owns shadow File
  • CCE-86857-0
• file_owner_etc_shells: Verify Who Owns /etc/shells File
  • CCE-89594-6
• file_owner_sshd_config: Verify Owner on SSH Server config file
  • CCE-89829-6
• file_owner_sshd_drop_in_config: Verify Owner on SSH Server Configuration Files
  • CCE-86268-0
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-90624-8
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-87297-8
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
  • CCE-90283-3
• file_permissions_backup_etc_group: Verify Permissions on Backup group File
  • CCE-86579-0
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File
  • CCE-89056-6
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File
  • CCE-86854-7
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File
  • CCE-87423-0
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file
  • CCE-89121-8
• file_permissions_cron_d: Verify Permissions on cron.d
  • CCE-86651-7
• file_permissions_cron_daily: Verify Permissions on cron.daily
  • CCE-88919-6
• file_permissions_cron_hourly: Verify Permissions on cron.hourly
  • CCE-88664-8
• file_permissions_cron_monthly: Verify Permissions on cron.monthly
  • CCE-86632-7
• file_permissions_cron_weekly: Verify Permissions on cron.weekly
  • CCE-89733-0
• file_permissions_cron_yearly: Verify Permissions on cron.yearly
  • CCE-90732-9
• file_permissions_crontab: Verify Permissions on crontab
  • CCE-90078-7
• file_permissions_etc_group: Verify Permissions on group File
  • CCE-88868-5
• file_permissions_etc_gshadow: Verify Permissions on gshadow File
  • CCE-86975-0
• file_permissions_etc_issue: Verify permissions on System Login Banner
  • CCE-86812-5
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections
  • CCE-87831-4
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner
  • CCE-90411-0
• file_permissions_etc_passwd: Verify Permissions on passwd File
  • CCE-90644-6
• file_permissions_etc_security_opasswd: Verify Permissions on /etc/security/opasswd File
  • CCE-89580-5
• file_permissions_etc_security_opasswd_old: Verify Permissions on /etc/security/opasswd.old File
  • CCE-87434-7
• file_permissions_etc_shadow: Verify Permissions on shadow File
  • CCE-88433-8
• file_permissions_etc_shells: Verify Permissions on /etc/shells File
  • CCE-89912-0
• file_permissions_sshd_config: Verify Permissions on SSH Server config file
  • CCE-86264-9
• file_permissions_sshd_drop_in_config: Verify Permissions on SSH Server Config File
  • CCE-86442-1
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-88018-7
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-87454-5
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-87656-5
• grub2_enable_selinux: Ensure SELinux Not Disabled in /etc/default/grub
  • CCE-88989-9
• grub2_password: Set Boot Loader Password in grub2
  • CCE-87614-4
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-86783-8
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-86775-4
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-88358-7
• mount_option_home_nodev: Add nodev Option to /home
  • CCE-87344-8
• mount_option_home_nosuid: Add nosuid Option to /home
  • CCE-88987-3
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-87095-6
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-87318-2
• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit
  • CCE-87220-0
• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit
  • CCE-88957-6
• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit
  • CCE-90694-1
• mount_option_var_log_nodev: Add nodev Option to /var/log
  • CCE-89389-1
• mount_option_var_log_noexec: Add noexec Option to /var/log
  • CCE-89129-1
• mount_option_var_log_nosuid: Add nosuid Option to /var/log
  • CCE-90639-6
• mount_option_var_nodev: Add nodev Option to /var
  • CCE-87070-9
• mount_option_var_nosuid: Add nosuid Option to /var
  • CCE-89496-4
• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp
  • CCE-89441-0
• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp
  • CCE-87347-1
• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp
  • CCE-87892-6
• package_libselinux_installed: Install libselinux Package
  • CCE-90410-2
• package_mcstrans_removed: Uninstall mcstrans Package
  • CCE-88183-9
• package_setroubleshoot_removed: Uninstall setroubleshoot Package
  • CCE-89902-1
• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured
  • CCE-88819-8
• rsyslog_files_groupownership: Ensure Log Files Are Owned By Appropriate Group
  • CCE-90074-6
• rsyslog_files_ownership: Ensure Log Files Are Owned By Appropriate User
  • CCE-88780-2
• rsyslog_files_permissions: Ensure System Log Files Have Correct Permissions
  • CCE-89058-2
• selinux_not_disabled: Ensure SELinux is Not Disabled
  • CCE-90205-6
• selinux_policytype: Configure SELinux Policy
  • CCE-88366-0
• selinux_state: Ensure SELinux State is Enforcing
  • CCE-89386-7
• sshd_limit_user_access: Limit Users' SSH Access
  • CCE-90003-5
• sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks
  • CCE-86689-7
• sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks
  • CCE-88796-8
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  • CCE-87119-4
• var_accounts_user_umask = 027
• var_pam_wheel_group_for_su = cis
• var_selinux_policy_name = targeted
• var_selinux_state = enforcing

03.01.03: Information Flow Enforcement

Description: None

• default

Automated: yes

No rules selected

03.01.04: Separation of Duties

Description: None

• default

Automated: yes

No rules selected

03.01.05: Least Privilege

Description: None

• default

Automated: yes

• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
  • CCE-89126-7
• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive
  • CCE-90129-8
• package_sudo_installed: Install sudo Package
  • CCE-87100-4
• sshd_disable_root_login: Disable SSH Root Login
  • CCE-89730-6
• sudo_add_use_pty: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
  • CCE-89073-1
• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
  • CCE-88892-5
• sudo_remove_nopasswd: Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
  • CCE-87015-4

03.01.06: Least Privilege - Privileged Accounts

Description: None

• default

Automated: yes

• package_sudo_installed: Install sudo Package
  • CCE-87100-4

03.01.07: Least Privilege - Privileged Functions

Description: None

• default

Automated: yes

No rules selected

03.01.08: Unsuccessful Logon Attempts

Description: None

• default

Automated: yes

• account_password_pam_faillock_password_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
  • CCE-87657-3
• account_password_pam_faillock_system_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
  • CCE-88810-7
• accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
  • CCE-87388-5
• accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time: Ensure Root Account Lockout on Failed Password Attempts
  • CCE-86631-9
• accounts_passwords_pam_faillock_unlock_time_with_zero: Set Lockout Time for Failed Password Attempts
  • CCE-87367-9
• var_accounts_passwords_pam_faillock_deny = 5
• var_accounts_passwords_pam_faillock_dir = run
• var_accounts_passwords_pam_faillock_root_unlock_time = 60
• var_accounts_passwords_pam_faillock_unlock_time = 900

03.01.09: System Use Notification

Description: None

• default

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
  • CCE-87417-2
• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
  • CCE-88901-4

03.01.10: Device Lock

Description: None

• default

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
  • CCE-87170-7
• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
  • CCE-88417-1
• dconf_gnome_screensaver_user_locks: Ensure Users Cannot Change GNOME3 Screensaver Settings
  • CCE-88349-6
• dconf_gnome_session_idle_user_locks: Ensure Users Cannot Change GNOME3 Session Idle Settings
  • CCE-88587-1
• var_screensaver_lock_delay = 5_seconds

03.01.11: Session Termination

Description: None

• default

Automated: yes

No rules selected

03.01.12: Remote Access

Description: None

• default

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88902-2

03.01.16: Wireless Access

Description: None

• default

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-88576-4

03.01.18: Access Control for Mobile Devices

Description: None

• default

Automated: yes

No rules selected

03.01.20: Use of External Systems

Description: None

• default

Automated: yes

No rules selected

03.01.22: Publicly Accessible Content

Description: None

• default

Automated: yes

No rules selected

03.02.01: Literacy Training and Awareness

Description: None

• default

Automated: yes

No rules selected

03.02.02: Role-Based Training

Description: None

• default

Automated: yes

No rules selected

03.03.01: Event Logging

Description: None

• default

Automated: yes

• aide_build_database: Build and Test AIDE Database
  • CCE-86942-0
• aide_periodic_cron_checking: Configure Periodic Execution of AIDE
  • CCE-86738-2
• audit_rules_execution_chacl: Record Any Attempts to Run chacl
  • CCE-88467-6
• audit_rules_execution_chcon: Record Any Attempts to Run chcon
  • CCE-87762-1
• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl
  • CCE-87662-3
• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
  • CCE-87659-9
• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-87470-1
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-88198-7
• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
  • CCE-89081-4
• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
  • CCE-89040-0
• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
  • CCE-88897-4
• ensure_journald_and_rsyslog_not_active_together: Ensure journald and rsyslog Are Not Active Together
  • CCE-90723-8
• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
  • CCE-88192-0
• journald_disable_forward_to_syslog: Ensure journald ForwardToSyslog is disabled
  • CCE-88340-5
• package_aide_installed: Install AIDE
  • CCE-90477-1
• package_audit-libs_installed: Ensure the audit-libs package as a part of audit Subsystem is Installed
  • CCE-90611-5
• package_audit_installed: Ensure the audit Subsystem is Installed
  • CCE-88240-7
• package_systemd-journal-remote_installed: Install systemd-journal-remote Package
  • CCE-89465-9
• service_auditd_enabled: Enable auditd Service
  • CCE-87955-1
• service_systemd-journal-upload_enabled: Enable systemd-journal-upload Service
  • CCE-86711-9
• service_systemd-journald_enabled: Enable systemd-journald Service
  • CCE-89396-6
• socket_systemd-journal-remote_disabled: Disable systemd-journal-remote Socket
  • CCE-87754-8
• var_audit_backlog_limit = 8192
• var_auditd_action_mail_acct = root
• var_auditd_admin_space_left_action = cis_rhel10
• var_auditd_space_left_action = cis_rhel10

03.03.02: Audit Record Content

Description: None

• default

Automated: yes

• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
  • CCE-90466-4
• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
  • CCE-89540-9
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
  • CCE-88200-1
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
  • CCE-89356-0
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
  • CCE-90685-9
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
  • CCE-90651-1
• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
  • CCE-88352-0
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
  • CCE-89370-1
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown
  • CCE-88243-1
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
  • CCE-90100-9
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
  • CCE-88052-6
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
  • CCE-89677-9
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr
  • CCE-89571-4
• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
  • CCE-89982-3
• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
  • CCE-88638-2
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module
  • CCE-90172-8
• audit_rules_kernel_module_loading_query: Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module
  • CCE-90015-9
• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
  • CCE-89479-0
• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
  • CCE-88938-6
• audit_rules_mac_modification_etc_selinux: Record Events that Modify the System's Mandatory Access Controls (/etc/selinux)
  • CCE-90737-8
• audit_rules_mac_modification_usr_share: Record Events that Modify the System's Mandatory Access Controls in usr/share
  • CCE-88117-7
• audit_rules_networkconfig_modification_etc_hosts: Record Events that Modify the System's Network Environment - /etc/hosts
  • CCE-89920-3
• audit_rules_networkconfig_modification_etc_issue: Record Events that Modify the System's Network Environment - /etc/issue
  • CCE-89917-9
• audit_rules_networkconfig_modification_etc_issue_net: Record Events that Modify the System's Network Environment - /etc/issue.net
  • CCE-89919-5
• audit_rules_networkconfig_modification_etc_networkmanager_system_connections: Record Events that Modify the System's Network Environment - /etc/NetworkManager/system-connections/
  • CCE-89923-7
• audit_rules_networkconfig_modification_etc_sysconfig_network: Record Events that Modify the System's Network Environment - /etc/sysconfig/network
  • CCE-89922-9
• audit_rules_networkconfig_modification_hostname_file: Record Events that Modify the System's Network Environment - /etc/hostname
  • CCE-89921-1
• audit_rules_networkconfig_modification_networkmanager: Record Events that Modify the System's Network Environment - /etc/NetworkManager/
  • CCE-89924-5
• audit_rules_networkconfig_modification_setdomainname: Record Events that Modify the System's Network Environment - setdomainname
  • CCE-89916-1
• audit_rules_networkconfig_modification_sethostname: Record Events that Modify the System's Network Environment - sethostname
  • CCE-89913-8
• audit_rules_privileged_commands: Ensure auditd Collects Information on the Use of Privileged Commands
  • CCE-88170-6
• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
  • CCE-86727-5
• audit_rules_session_events_btmp: Record Attempts to Alter Process and Session Initiation Information btmp
  • CCE-86190-6
• audit_rules_session_events_utmp: Record Attempts to Alter Process and Session Initiation Information utmp
  • CCE-86193-0
• audit_rules_session_events_wtmp: Record Attempts to Alter Process and Session Initiation Information wtmp
  • CCE-86206-0
• audit_rules_suid_auid_privilege_function: Record Events When Executables Are Run As Another User
  • CCE-86599-8
• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions
  • CCE-89678-7
• audit_rules_time_adjtimex: Record attempts to alter time through adjtimex
  • CCE-87633-4
• audit_rules_time_clock_settime: Record Attempts to Alter Time Through clock_settime
  • CCE-88533-5
• audit_rules_time_settimeofday: Record attempts to alter time through settimeofday
  • CCE-90548-9
• audit_rules_time_watch_localtime: Record Attempts to Alter the localtime File
  • CCE-89928-6
• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
  • CCE-87052-7
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
  • CCE-86729-1
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
  • CCE-87349-7
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
  • CCE-89291-9
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
  • CCE-89869-2
• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
  • CCE-87111-1
• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
  • CCE-87736-5
• audit_rules_usergroup_modification_nsswitch_conf: Record Events that Modify User/Group Information - /etc/nsswitch.conf
  • CCE-90524-0
• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
  • CCE-90664-4
• audit_rules_usergroup_modification_pam_conf: Record Events that Modify User/Group Information - /etc/pam.conf
  • CCE-90525-7
• audit_rules_usergroup_modification_pamd: Record Events that Modify User/Group Information - /etc/pam.d/
  • CCE-90526-5
• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
  • CCE-88286-0
• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
  • CCE-88637-4
• chronyd_run_as_chrony_user: Ensure that chronyd is running under chrony user account
  • CCE-89296-8
• chronyd_specify_remote_server: A remote time server for Chrony is configured
  • CCE-86811-7
• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive
  • CCE-86750-7
• file_groupownership_audit_binaries: Verify that audit tools are owned by group root
  • CCE-87965-0
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89939-3
• file_permissions_audit_binaries: Verify that audit tools Have Mode 0755 or less
  • CCE-86166-6
• journald_storage: Ensure journald is configured to write log files to persistent disk
  • CCE-90077-9
• sshd_max_auth_tries_value = 4
• sshd_set_loglevel_verbose: Set SSH Daemon LogLevel to VERBOSE
  • CCE-86241-7
• sshd_set_max_auth_tries: Set SSH authentication attempt limit
  • CCE-90071-2
• sudo_custom_logfile: Ensure Sudo Logfile Exists - sudo logfile
  • CCE-89611-8
• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-89499-8
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-87672-2
• var_multiple_time_servers = rhel

03.03.03: Audit Record Generation

Description: None

• default

Automated: yes

• audit_rules_continue_loading: Ensure the Audit Configuration is Loaded Regardless of Errors
  • CCE-90697-4
• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
  • CCE-90466-4
• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
  • CCE-89540-9
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
  • CCE-88200-1
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
  • CCE-89356-0
• audit_rules_dac_modification_fchmodat2: Record Events that Modify the System's Discretionary Access Controls - fchmodat2
  • CCE-86535-2
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
  • CCE-90685-9
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
  • CCE-90651-1
• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
  • CCE-88352-0
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
  • CCE-89370-1
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown
  • CCE-88243-1
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
  • CCE-90100-9
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
  • CCE-88052-6
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
  • CCE-89677-9
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr
  • CCE-89571-4
• audit_rules_execution_chcon: Record Any Attempts to Run chcon
  • CCE-87762-1
• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
  • CCE-90733-7
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
  • CCE-90237-9
• audit_rules_file_deletion_events_renameat2: Ensure auditd Collects File Deletion Events by User - renameat2
  • CCE-86188-0
• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
  • CCE-86737-4
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat
  • CCE-87813-2
• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
  • CCE-89982-3
• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
  • CCE-88638-2
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module
  • CCE-90172-8
• audit_rules_kernel_module_loading_query: Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module
  • CCE-90015-9
• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
  • CCE-89479-0
• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
  • CCE-88938-6
• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-86590-7
• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
  • CCE-86727-5
• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
  • CCE-87659-9
• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions
  • CCE-89678-7
• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
  • CCE-87052-7
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
  • CCE-86729-1
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
  • CCE-87349-7
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
  • CCE-89291-9
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate
  • CCE-89869-2
• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group
  • CCE-87111-1
• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
  • CCE-87736-5
• audit_rules_usergroup_modification_nsswitch_conf: Record Events that Modify User/Group Information - /etc/nsswitch.conf
  • CCE-90524-0
• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd
  • CCE-90664-4
• audit_rules_usergroup_modification_pam_conf: Record Events that Modify User/Group Information - /etc/pam.conf
  • CCE-90525-7
• audit_rules_usergroup_modification_pamd: Record Events that Modify User/Group Information - /etc/pam.d/
  • CCE-90526-5
• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd
  • CCE-88286-0
• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow
  • CCE-88637-4
• audit_sudo_log_events: Record Attempts to perform maintenance activities
  • CCE-89542-5
• file_permissions_audit_configuration: Audit Configuration Files Permissions are 640 or More Restrictive
  • CCE-88067-4
• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon
  • CCE-88376-9
• service_auditd_enabled: Enable auditd Service
  • CCE-87955-1

03.03.04: Response to Audit Logging Process Failures

Description: None

• default

Automated: yes

• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
  • CCE-87470-1
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
  • CCE-88198-7
• var_auditd_disk_error_action = cis_rhel10
• var_auditd_disk_full_action = cis_rhel10

03.03.05: Audit Record Review, Analysis, and Reporting

Description: None

• default

Automated: yes

No rules selected

03.03.06: Audit Record Reduction and Report Generation

Description: None

• default

Automated: yes

No rules selected

03.03.07: Time Stamps

Description: None

• default

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
  • CCE-89263-8
• auditd_data_retention_max_log_file_action: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  • CCE-86674-9
• var_auditd_max_log_file = 8
• var_auditd_max_log_file_action = keep_logs

03.03.08: Protection of Audit Information

Description: None

• default

Automated: yes

• aide_check_audit_tools: Configure AIDE to Verify the Audit Tools
  • CCE-86441-3
• audit_rules_immutable: Make the auditd Configuration Immutable
  • CCE-89816-3
• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root
  • CCE-89126-7
• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root
  • CCE-88238-1
• file_ownership_audit_binaries: Verify that audit tools are owned by root
  • CCE-89400-6
• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root
  • CCE-88877-6
• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive
  • CCE-90129-8

03.04.01: Baseline Configuration

Description: None

• default

Automated: yes

No rules selected

03.04.02: Configuration Settings

Description: None

• default

Automated: yes

• accounts_password_pam_pwquality_password_auth: Ensure PAM password complexity module is enabled in password-auth
  • CCE-89505-2
• accounts_password_pam_pwquality_system_auth: Ensure PAM password complexity module is enabled in system-auth
  • CCE-89362-8
• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
  • CCE-88580-6
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
  • CCE-89314-9
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
  • CCE-87651-6
• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
  • CCE-86659-0
• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)
  • CCE-86590-7
• banner_etc_issue_cis: Ensure Local Login Warning Banner Is Configured Properly
  • CCE-86165-8
• banner_etc_issue_net_cis: Ensure Remote Login Warning Banner Is Configured Properly
  • CCE-86169-0
• banner_etc_motd_cis: Ensure Message Of The Day Is Configured Properly
  • CCE-86150-0
• cis_banner_text = cis
• coredump_disable_backtraces: Disable core dump backtraces
  • CCE-88825-5
• coredump_disable_storage: Disable storing core dump
  • CCE-88732-3
• dconf_db_up_to_date: Make sure that the dconf databases are up-to-date with regards to respective keyfiles
  • CCE-86609-5
• dconf_gnome_disable_user_list: Disable the GNOME3 Login User List
  • CCE-87918-9
• dconf_login_banner_contents = cis_default
• dconf_login_banner_text = cis_banners
• disable_host_auth: Disable Host-Based Authentication
  • CCE-88057-5
• disable_users_coredumps: Disable Core Dumps for All Users
  • CCE-88330-6
• file_groupowner_boot_grub2: All GRUB configuration files must be group-owned by root
  • CCE-89940-1
• file_groupownership_sshd_private_key: Verify Group Ownership on SSH Server Private *_key Key Files
  • CCE-90288-2
• file_groupownership_sshd_pub_key: Verify Group Ownership on SSH Server Public *.pub Key Files
  • CCE-90469-8
• file_owner_boot_grub2: All GRUB configuration files must be owned by root
  • CCE-89088-9
• file_ownership_home_directories: All Interactive User Home Directories Must Be Owned By The Primary User
  • CCE-88344-7
• file_ownership_sshd_private_key: Verify Ownership on SSH Server Private *_key Key Files
  • CCE-90624-8
• file_ownership_sshd_pub_key: Verify Ownership on SSH Server Public *.pub Key Files
  • CCE-87297-8
• file_permissions_boot_grub2: All GRUB configuration files must have mode 0600 or more restrictive
  • CCE-90556-2
• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive
  • CCE-86605-3
• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files
  • CCE-88018-7
• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files
  • CCE-87454-5
• no_empty_passwords: Prevent Login to Accounts With Empty Password
  • CCE-86640-0
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-90491-2
• no_files_or_dirs_ungroupowned: Ensure All Files And Directories Are Owned by a Group
  • CCE-86647-5
• no_files_or_dirs_unowned_by_user: Ensure All Files And Directories Are Owned by a User
  • CCE-86643-4
• package_pam_pwquality_installed: Install pam_pwquality Package
  • CCE-90527-3
• package_rsync_removed: Uninstall rsync Package
  • CCE-88025-2
• package_samba_removed: Uninstall Samba Package
  • CCE-89779-3
• package_squid_removed: Uninstall squid Package
  • CCE-87396-8
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-89606-8
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-88355-3
• service_nfs_disabled: Disable Network File System (nfs)
  • CCE-88764-6
• service_rpcbind_disabled: Disable rpcbind Service
  • CCE-88459-3
• sshd_disable_gssapi_auth: Disable GSSAPI Authentication
  • CCE-89145-7
• sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
  • CCE-87290-3
• sysctl_fs_suid_dumpable: Disable Core Dumps for SUID programs
  • CCE-88399-1
• sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access
  • CCE-88686-1
• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space
  • CCE-87876-9
• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
  • CCE-88785-1
• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-90409-4
• sysctl_net_ipv4_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-90165-2
• sysctl_net_ipv4_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_all_forwarding: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces
  • CCE-87420-6
• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  • CCE-89499-8
• sysctl_net_ipv4_conf_all_log_martians_value = enabled
• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
  • CCE-88689-5
• sysctl_net_ipv4_conf_all_rp_filter_value = enabled
• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  • CCE-87848-8
• sysctl_net_ipv4_conf_all_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-88360-3
• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-86820-8
• sysctl_net_ipv4_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-88071-6
• sysctl_net_ipv4_conf_default_accept_source_route_value = disabled
• sysctl_net_ipv4_conf_default_forwarding: Disable Kernel Parameter for IPv4 Forwarding By Default
  • CCE-88797-6
• sysctl_net_ipv4_conf_default_forwarding_value = disabled
• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
  • CCE-87672-2
• sysctl_net_ipv4_conf_default_log_martians_value = enabled
• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  • CCE-87424-8
• sysctl_net_ipv4_conf_default_rp_filter_value = enabled
• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default
  • CCE-87878-5
• sysctl_net_ipv4_conf_default_secure_redirects_value = disabled
• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-89177-0
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  • CCE-86918-0
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value = enabled
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  • CCE-87841-3
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value = enabled
• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  • CCE-87377-8
• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
  • CCE-88665-5
• sysctl_net_ipv6_conf_all_accept_ra_value = disabled
• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-90083-7
• sysctl_net_ipv6_conf_all_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-90450-8
• sysctl_net_ipv6_conf_all_accept_source_route_value = disabled
• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
  • CCE-86882-8
• sysctl_net_ipv6_conf_all_forwarding_value = disabled
• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  • CCE-90557-0
• sysctl_net_ipv6_conf_default_accept_ra_value = disabled
• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-89486-5
• sysctl_net_ipv6_conf_default_accept_redirects_value = disabled
• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-89135-8
• sysctl_net_ipv6_conf_default_accept_source_route_value = disabled
• sysctl_net_ipv6_conf_default_forwarding: Disable Kernel Parameter for IPv6 Forwarding by default
  • CCE-87075-8
• sysctl_net_ipv6_conf_default_forwarding_value = disabled
• var_accounts_user_umask = 027
• var_sshd_set_login_grace_time = 60

03.04.03: Configuration Change Control

Description: None

• default

Automated: yes

No rules selected

03.04.04: Impact Analyses

Description: None

• default

Automated: yes

No rules selected

03.04.05: Access Restrictions for Change

Description: None

• default

Automated: yes

No rules selected

03.04.06: Least Functionality

Description: None

• default

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running
  • CCE-87588-0
• disable_weak_deps: Disable Installation of Weak Dependencies in DNF
  • CCE-86970-1
• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root
  • CCE-89939-3
• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
  • CCE-88412-2
• kernel_module_atm_disabled: Disable ATM Support
  • CCE-89906-2
• kernel_module_can_disabled: Disable CAN Support
  • CCE-89282-8
• kernel_module_cramfs_disabled: Disable Mounting of cramfs
  • CCE-90005-0
• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-89435-2
• kernel_module_firewire-core_disabled: Disable IEEE 1394 (FireWire) Support
  • CCE-90436-7
• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs
  • CCE-87969-2
• kernel_module_hfs_disabled: Disable Mounting of hfs
  • CCE-87336-4
• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus
  • CCE-89918-7
• kernel_module_jffs2_disabled: Disable Mounting of jffs2
  • CCE-88027-8
• kernel_module_overlayfs_disabled: Ensure overlayfs kernel module is not available
  • CCE-87507-0
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-89280-2
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-90489-6
• kernel_module_squashfs_disabled: Disable Mounting of squashfs
  • CCE-88216-7
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-86569-1
• kernel_module_udf_disabled: Disable Mounting of udf
  • CCE-87504-7
• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm
  • CCE-86783-8
• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm
  • CCE-86775-4
• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm
  • CCE-88358-7
• mount_option_tmp_nodev: Add nodev Option to /tmp
  • CCE-90522-4
• mount_option_tmp_noexec: Add noexec Option to /tmp
  • CCE-87095-6
• mount_option_tmp_nosuid: Add nosuid Option to /tmp
  • CCE-87318-2
• package_bind_removed: Uninstall bind Package
  • CCE-87806-6
• package_cyrus-imapd_removed: Uninstall cyrus-imapd Package
  • CCE-90156-1
• package_dovecot_removed: Uninstall dovecot Package
  • CCE-86197-1
• package_ftp_removed: Remove ftp Package
  • CCE-86687-1
• package_gdm_removed: Remove the GDM Package Group
  • CCE-88880-0
• package_httpd_removed: Uninstall httpd Package
  • CCE-89436-0
• package_kea_removed: Uninstall kea Package
  • CCE-86596-4
• package_net-snmp_removed: Uninstall net-snmp Package
  • CCE-89193-7
• package_nginx_removed: Uninstall nginx Package
  • CCE-89648-0
• package_openldap-clients_removed: Ensure LDAP client is not installed
  • CCE-90641-2
• package_postfix_installed: The Postfix package is installed
  • CCE-86466-0
• package_sequoia-sq_installed: Install sequoia-sq Package
  • CCE-86458-7
• package_telnet-server_removed: Uninstall telnet-server Package
  • CCE-88105-2
• package_telnet_removed: Remove telnet Clients
  • CCE-90545-5
• package_tftp-server_removed: Uninstall tftp-server Package
  • CCE-89287-7
• package_tftp_removed: Remove tftp Daemon
  • CCE-88586-3
• package_vsftpd_removed: Uninstall vsftpd Package
  • CCE-88674-7
• package_xorg-x11-server-Xwayland_removed: Remove the X Windows Xwayland Package
  • CCE-90601-6
• partition_for_dev_shm: Ensure /dev/shm is configured
  • CCE-89532-6
• partition_for_home: Ensure /home Located On Separate Partition
  • CCE-88231-6
• partition_for_tmp: Ensure /tmp Located On Separate Partition
  • CCE-89606-8
• partition_for_var: Ensure /var Located On Separate Partition
  • CCE-89166-3
• partition_for_var_log: Ensure /var/log Located On Separate Partition
  • CCE-88355-3
• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition
  • CCE-89211-7
• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition
  • CCE-87694-6
• postfix_network_listening_disabled: Disable Postfix Network Listening
  • CCE-87280-4
• service_bluetooth_disabled: Disable Bluetooth Service
  • CCE-90381-5
• service_cockpit_disabled: Disable Cockpit Management Server
  • CCE-87509-6
• service_cups_disabled: Disable the CUPS Service
  • CCE-86174-0
• service_dnsmasq_disabled: Disable dnsmasq Service
  • CCE-90722-0
• sshd_disable_forwarding: Disable SSH Forwarding
  • CCE-87508-8
• var_postfix_inet_interfaces = loopback-only
• wireless_disable_interfaces: Deactivate Wireless Network Interfaces
  • CCE-88576-4
• xwayland_disabled: Disable XWayland
  • CCE-87228-3

03.04.08: Authorized Software - Allow by Exception

Description: None

• default

Automated: yes

No rules selected

03.04.10: System Component Inventory

Description: None

• default

Automated: yes

No rules selected

03.04.11: Information Location

Description: None

• default

Automated: yes

No rules selected

03.04.12: System and Component Configuration for High-Risk Areas

Description: None

• default

Automated: yes

No rules selected

03.05.01: User Identification and Authentication

Description: None

• default

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-89811-4
• sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
  • CCE-88136-7
• var_sudo_timestamp_timeout = 15_minutes

03.05.02: Device Identification and Authentication

Description: None

• default

Automated: yes

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
  • CCE-89756-1
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening
  • CCE-86628-5
• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-89301-6

03.05.03: Multi-Factor Authentication

Description: None

• default

Automated: yes

No rules selected

03.05.04: Replay-Resistant Authentication

Description: None

• default

Automated: yes

No rules selected

03.05.05: Identifier Management

Description: None

• default

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
  • CCE-88966-7
• accounts_set_post_pw_existing: Set existing passwords a period of inactivity before they been locked
  • CCE-86554-3
• var_account_disable_post_pw_expiration = 45

03.05.07: Password Management

Description: None

• default

Automated: yes

• accounts_password_pam_pwhistory_remember_password_auth: Limit Password Reuse: password-auth
  • CCE-89749-6
• accounts_password_pam_pwhistory_remember_system_auth: Limit Password Reuse: system-auth
  • CCE-89776-9
• accounts_password_pam_unix_enabled: Verify pam_unix module is activated
  • CCE-87536-9
• accounts_password_pam_unix_no_remember: Avoid using remember in pam_unix module
  • CCE-90725-3
• var_password_pam_remember = 24
• var_password_pam_remember_control_flag = requisite_or_required

03.05.11: Authentication Feedback

Description: None

• default

Automated: yes

No rules selected

03.05.12: Authenticator Management

Description: None

• default

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
  • CCE-89307-3
• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed
  • CCE-87644-1
• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past
  • CCE-90359-1
• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  • CCE-88171-4
• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  • CCE-90363-3
• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User
  • CCE-90134-8
• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
  • CCE-88015-3
• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords
  • CCE-87063-4
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  • CCE-87289-5
• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
  • CCE-87852-0
• accounts_password_pam_modules_in_authselect_profile: Ensure Active Authselect Profile Includes PAM Modules
  • CCE-90464-9
• accounts_password_pam_pwhistory_enforce_for_root: Ensure Password History Is Enforced for the Root User
  • CCE-87591-4
• accounts_password_pam_pwhistory_remember_password_auth: Limit Password Reuse: password-auth
  • CCE-89749-6
• accounts_password_pam_pwhistory_remember_system_auth: Limit Password Reuse: system-auth
  • CCE-89776-9
• accounts_password_pam_pwhistory_use_authtok: Enforce Password History with use_authtok
  • CCE-86732-5
• accounts_password_pam_unix_authtok: Require use_authtok for pam_unix.so
  • CCE-86733-3
• accounts_password_pam_unix_enabled: Verify pam_unix module is activated
  • CCE-87536-9
• accounts_password_pam_unix_no_remember: Avoid using remember in pam_unix module
  • CCE-90725-3
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
  • CCE-87953-6
• accounts_password_set_warn_age_existing: Set Existing Passwords Warning Age
  • CCE-87604-5
• accounts_password_warn_age_login_defs: Set Password Warning Age
  • CCE-89628-2
• ensure_root_password_configured: Ensure Authentication Required for Single User Mode
  • CCE-89334-7
• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords
  • CCE-90491-2
• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
  • CCE-89508-6
• set_password_hashing_algorithm_passwordauth: Set PAM Password Hashing Algorithm - password-auth
  • CCE-88661-4
• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
  • CCE-88697-8
• var_accounts_minimum_age_login_defs = 1
• var_accounts_password_warn_age_login_defs = 7
• var_password_hashing_algorithm = cis_rhel10
• var_password_hashing_algorithm_pam = cis_rhel10
• var_password_pam_dictcheck = 1
• var_password_pam_difok = 2
• var_password_pam_maxrepeat = 3
• var_password_pam_maxsequence = 3
• var_password_pam_minclass = 4
• var_password_pam_minlen = 14
• var_password_pam_remember = 24
• var_password_pam_remember_control_flag = requisite_or_required

03.06.01: Incident Handling

Description: None

• default

Automated: yes

No rules selected

03.06.02: Incident Monitoring, Reporting, and Response Assistance

Description: None

• default

Automated: yes

No rules selected

03.06.03: Incident Response Testing

Description: None

• default

Automated: yes

No rules selected

03.06.04: Incident Response Training

Description: None

• default

Automated: yes

No rules selected

03.06.05: Incident Response Plan

Description: None

• default

Automated: yes

No rules selected

03.07.04: Maintenance Tools

Description: None

• default

Automated: yes

No rules selected

03.07.05: Nonlocal Maintenance

Description: None

• default

Automated: yes

No rules selected

03.07.06: Maintenance Personnel

Description: None

• default

Automated: yes

No rules selected

03.08.01: Media Storage

Description: None

• default

Automated: yes

No rules selected

03.08.02: Media Access

Description: None

• default

Automated: yes

No rules selected

03.08.03: Media Sanitization

Description: None

• default

Automated: yes

No rules selected

03.08.04: Media Marking

Description: None

• default

Automated: yes

No rules selected

03.08.05: Media Transport

Description: None

• default

Automated: yes

No rules selected

03.08.07: Media Use

Description: None

• default

Automated: yes

No rules selected

03.08.09: System Backup - Cryptographic Protection

Description: None

• default

Automated: yes

No rules selected

03.09.01: Personnel Screening

Description: None

• default

Automated: yes

No rules selected

03.09.02: Personnel Termination and Transfer

Description: None

• default

Automated: yes

No rules selected

03.10.01: Physical Access Authorizations

Description: None

• default

Automated: yes

No rules selected

03.10.02: Monitoring Physical Access

Description: None

• default

Automated: yes

No rules selected

03.10.06: Alternate Work Site

Description: None

• default

Automated: yes

No rules selected

03.10.07: Physical Access Control

Description: None

• default

Automated: yes

No rules selected

03.10.08: Access Control for Transmission

Description: None

• default

Automated: yes

No rules selected

03.11.01: Risk Assessment

Description: None

• default

Automated: yes

No rules selected

03.11.02: Vulnerability Monitoring and Scanning

Description: None

• default

Automated: yes

No rules selected

03.11.04: Risk Response

Description: None

• default

Automated: yes

No rules selected

03.12.01: Security Assessment

Description: None

• default

Automated: yes

No rules selected

03.12.02: Plan of Action and Milestones

Description: None

• default

Automated: yes

No rules selected

03.12.03: Continuous Monitoring

Description: None

• default

Automated: yes

No rules selected

03.12.05: Information Exchange

Description: None

• default

Automated: yes

No rules selected

03.13.01: Boundary Protection

Description: None

• default

Automated: yes

• package_firewalld_installed: Install firewalld Package
  • CCE-88164-9
• service_firewalld_enabled: Verify firewalld Enabled
  • CCE-88110-2

03.13.04: Information in Shared System Resources

Description: None

• default

Automated: yes

• dir_perms_world_writable_sticky_bits: Verify that All World-Writable Directories Have Sticky Bits Set
  • CCE-88397-5
• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist
  • CCE-87656-5

03.13.06: Network Communications - Deny by Default - Allow by Exception

Description: None

• default

Automated: yes

No rules selected

03.13.08: Transmission and Storage Confidentiality

Description: None

• default

Automated: yes

• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88902-2

03.13.09: Network Disconnect

Description: None

• default

Automated: yes

No rules selected

03.13.10: Cryptographic Key Establishment and Management

Description: None

• default

Automated: yes

No rules selected

03.13.11: Cryptographic Protection

Description: None

• default

Automated: yes

No rules selected

03.13.12: Collaborative Computing Devices and Applications

Description: None

• default

Automated: yes

No rules selected

03.13.13: Mobile Code

Description: None

• default

Automated: yes

No rules selected

03.13.15: Session Authenticity

Description: None

• default

Automated: yes

No rules selected

03.14.01: Flaw Remediation

Description: None

• default

Automated: yes

• ensure_gpgcheck_globally_activated: Ensure gpgcheck Enabled In Main dnf Configuration
  • CCE-88404-9
• ensure_redhat_gpgkey_installed: Ensure Red Hat GPG Key Installed
  • CCE-88256-3

03.14.02: Malicious Code Protection

Description: None

• default

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver
  • CCE-89301-6
• service_autofs_disabled: Disable the Automounter
  • CCE-88947-7

03.14.03: Security Alerts, Advisories, and Directives

Description: None

• default

Automated: yes

No rules selected

03.14.06: System Monitoring

Description: None

• default

Automated: yes

• kernel_module_dccp_disabled: Disable DCCP Support
  • CCE-89435-2
• kernel_module_rds_disabled: Disable RDS Support
  • CCE-89280-2
• kernel_module_sctp_disabled: Disable SCTP Support
  • CCE-90489-6
• kernel_module_tipc_disabled: Disable TIPC Support
  • CCE-86569-1
• service_avahi-daemon_disabled: Disable Avahi Server Software
  • CCE-90062-1

03.14.08: Information Management and Retention

Description: None

• default

Automated: yes

No rules selected

03.15.01: Policy and Procedures

Description: None

• default

Automated: yes

• account_password_pam_faillock_password_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
  • CCE-87657-3
• account_password_pam_faillock_system_auth: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
  • CCE-88810-7
• account_unique_id: Ensure All Accounts on the System Have Unique User IDs
  • CCE-89811-4
• account_unique_name: Ensure All Accounts on the System Have Unique Names
  • CCE-90323-7
• accounts_maximum_age_login_defs: Set Password Maximum Age
  • CCE-87961-9
• accounts_no_uid_except_zero: Verify Only Root Has UID 0
  • CCE-87552-6
• accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
  • CCE-87137-6
• accounts_root_gid_zero: Verify Root Has A Primary GID 0
  • CCE-90244-5
• accounts_root_path_dirs_no_write: Ensure that Root's Path Does Not Include World or Group-Writable Directories
  • CCE-88150-8
• accounts_user_dot_group_ownership: User Initialization Files Must Be Group-Owned By The Primary Group
  • CCE-89225-7
• accounts_user_dot_user_ownership: User Initialization Files Must Be Owned By the Primary User
  • CCE-86981-8
• configure_custom_crypto_policy_cis: Implement Custom Crypto Policy Modules for CIS Benchmark
  • CCE-88902-2
• disable_host_auth: Disable Host-Based Authentication
  • CCE-88057-5
• file_permission_user_bash_history: Ensure User Bash History File Has Correct Permissions
  • CCE-87392-7
• file_permission_user_init_files: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
  • CCE-87771-2
• gid_passwd_group_same: All GIDs referenced in /etc/passwd must be defined in /etc/group
  • CCE-87466-9
• group_unique_id: Ensure All Groups on the System Have Unique Group ID
  • CCE-86908-1
• group_unique_name: Ensure All Groups on the System Have Unique Group Names
  • CCE-88449-4
• groups_no_zero_gid_except_root: Verify Only Group Root Has GID 0
  • CCE-87073-3
• no_forward_files: Verify No .forward Files Exist
  • CCE-90050-6
• no_netrc_files: Verify No netrc Files Exist
  • CCE-89147-3
• no_nologin_in_shells: Ensure nologin Shell is Not Listed in /etc/shells
  • CCE-87072-5
• no_rhost_files: Verify No .rhost Files Exist
  • CCE-87390-1
• package_cron_installed: Install the cron service
  • CCE-86619-4
• root_path_no_dot: Ensure that Root's Path Does Not Include Relative Paths or Null Directories
  • CCE-88793-5
• service_crond_enabled: Enable cron Service
  • CCE-90044-9
• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords
  • CCE-86753-1
• sshd_disable_gssapi_auth: Disable GSSAPI Authentication
  • CCE-89145-7
• sshd_disable_rhosts: Disable SSH Support for .rhosts Files
  • CCE-87777-9
• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options
  • CCE-87395-0
• sshd_enable_pam: Enable PAM
  • CCE-87045-1
• sshd_enable_warning_banner_net: Enable SSH Warning Banner
  • CCE-88799-2
• sshd_idle_timeout_value = 5_minutes
• sshd_set_idle_timeout: Set SSH Client Alive Interval
  • CCE-90362-5
• sshd_set_keepalive: Set SSH Client Alive Count Max
  • CCE-86794-5
• sshd_set_max_sessions: Set SSH MaxSessions limit
  • CCE-89659-7
• sshd_set_maxstartups: Ensure SSH MaxStartups is configured
  • CCE-89624-1
• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  • CCE-90409-4
• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  • CCE-90165-2
• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
  • CCE-88689-5
• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  • CCE-87848-8
• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  • CCE-88360-3
• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  • CCE-86820-8
• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  • CCE-88071-6
• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  • CCE-87424-8
• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default
  • CCE-87878-5
• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  • CCE-89177-0
• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  • CCE-86918-0
• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  • CCE-87841-3
• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  • CCE-87377-8
• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  • CCE-88084-9
• sysctl_net_ipv4_tcp_syncookies_value = enabled
• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces
  • CCE-88665-5
• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  • CCE-90083-7
• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  • CCE-90450-8
• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding
  • CCE-86882-8
• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  • CCE-90557-0
• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  • CCE-89486-5
• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  • CCE-89135-8
• var_accounts_maximum_age_login_defs = 365
• var_sshd_max_sessions = 10
• var_sshd_set_keepalive = 1
• var_sshd_set_maxstartups = 10:30:60
• var_user_initialization_files_regex = all_dotfiles

03.15.02: System Security Plan

Description: None

• default

Automated: yes

No rules selected

03.15.03: Rules of Behavior

Description: None

• default

Automated: yes

No rules selected

03.16.01: Security Engineering Principles

Description: None

• default

Automated: yes

No rules selected

03.16.02: Unsupported System Components

Description: None

• default

Automated: yes

No rules selected

03.16.03: External System Services

Description: None

• default

Automated: yes

No rules selected

03.17.01: Supply Chain Risk Management Plan

Description: None

• default

Automated: yes

No rules selected

03.17.02: Acquisition Strategies, Tools, and Methods

Description: None

• default

Automated: yes

No rules selected

03.17.03: Supply Chain Requirements and Processes

Description: None

• default

Automated: yes

No rules selected