VCF Configuration IDs — VMware Salt for VCF Components API

VCF Configuration IDs

Reference catalog of security and compliance controls for VMware Cloud Foundation (VCF) components. Click on any setting description to view required fields, schema definitions, and parameters.

Component All Components AVI Cloud Proxy ESX HCX NSX Edge NSX Manager Operations Operations for Networks Orchestrator SDDC Manager vCenter VCF Automation VCFMS VM

Benchmarks All Benchmarks General PCI SCG

Release All Releases 9.1.0.0 9.1.1.0

Display All

Showing 304 of 304 controls

Component	Benchmarks	Configuration ID	Setting Description (Click to Expand)	Release
AVI	General	4401	AVI DNS server configuration Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.avi.dns Assessed Condition: Provide list of approved DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.1.0
AVI	General	4402	AVI NTP server configuration Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.avi.ntp Assessed Condition: Provide list of approved NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array Ordered list of NTP servers. Each entry must be an IPv4 address (e.g. '10.0.0.1') or a fully-qualified domain name (e.g. '0.us.pool.ntp.org'). servers[] Optional | Type: string IPv4 address or FQDN of an NTP server	9.1.1.0
AVI	General	4403	AVI syslog LI agent configuration Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.avi.syslog Assessed Condition: Syslog must be forwarded to the Log Insight server using TLS with certificate verification. The controller creates or updates an AlertsyslogConfig AVI object named 'vcf-li-syslog'. When ssl_key, ssl_certificate, and ca_certificate are supplied, it also creates SSLKeyAndCertificate 'vcf-syslog-ssl-cert-{hash}' and PKIProfile 'vcf-syslog-pki-profile-{hash}' (where {hash} is 8 hex chars of SHA-256(host:port)). Combining udp=true with tls_enable=true is blocked. When tls_enable=true and anon_auth=false, all three cert fields are required on every call. strict_cert_verify applies only in cert-required TLS mode (anon_auth=false). Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of syslog server destinations written into AlertsyslogConfig 'vcf-li-syslog'. servers[].host Required | Type: string Syslog server hostname, IPv4, or IPv6 address. Must be reachable from the AVI controller. servers[].port Optional | Type: integer | Default: 514 | Range: [1, 65535] Destination port. Default 514 (plaintext); RFC 5425 recommends 6514 for TLS. servers[].udp Optional | Type: boolean | Default: false Transport selector. true = UDP, false = TCP. Combining udp=true with tls_enable=true is BLOCKED. servers[].tls_enable Optional | Type: boolean | Default: false Enable TLS encrypted transport. Requires udp=false. When anon_auth=false (the default), ssl_key, ssl_certificate, and ca_certificate must all be provided. servers[].anon_auth Optional | Type: boolean | Default: false When true, TLS transport is used but the syslog server certificate is not verified. When false, SSLKeyAndCertificate 'vcf-syslog-ssl-cert-{hash}' and PKIProfile 'vcf-syslog-pki-profile-{hash}' are required (where {hash} is 8 hex chars of SHA-256(host:port)). anon_auth and strict_cert_verify are fully independent. Ignored when tls_enable=false. servers[].strict_cert_verify Optional | Type: boolean When true, AVI enforces strict server certificate verification (TLS strict mode). When false, relaxed verification is applied. Only forwarded to AVI when tls_enable=true and anon_auth=false (cert-required mode); ignored otherwise. Requires ssl_key+ssl_certificate and ca_certificate. servers[].ssl_key Optional | Type: string Base64-encoded PEM private key for mutual TLS. Creates/updates SSLKeyAndCertificate 'vcf-syslog-ssl-cert-{hash}'. Must be paired with ssl_certificate. Write-only: the AVI API never returns private key material — stripped before compliance comparison; cannot detect key drift. servers[].ssl_certificate Optional | Type: string Base64-encoded PEM client certificate paired with ssl_key for mutual TLS. Creates/updates SSLKeyAndCertificate 'vcf-syslog-ssl-cert-{hash}'. servers[].ca_certificate Optional | Type: string Base64-encoded PEM CA certificate for server certificate validation. Creates/updates PKIProfile 'vcf-syslog-pki-profile-{hash}'. Must be paired with ssl_key and ssl_certificate. servers[].format Optional | Type: string | Allowed: ["SYSLOG_LEGACY", "SYSLOG_RFC5424", "SYSLOG_JSON", "SYSLOG_RFC5425_ENHANCED"] | Default: "SYSLOG_RFC5424" Syslog message format. SYSLOG_RFC5425_ENHANCED is recommended when using TLS.	9.1.1.0
AVI	General	4404	AVI SSH cryptography configuration audit Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.ssh_crypto Assessed Condition: AVI SSH daemon (/etc/ssh/sshd_config) must use only approved FIPS-compliant ciphers and MAC algorithms. Only SSH protocol version 2 is permitted. RSA host keys must be at least 2048 bits; ECDSA host keys at least 256 bits. Weak key exchange algorithms (e.g. diffie-hellman-group1-sha1, diffie-hellman-group14-sha1) and weak ciphers (e.g. 3des-cbc, arcfour) must not be present. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol Optional | Type: string | Default: "2" SSH protocol version. Must be '2'. SSHv1 is deprecated and must not be enabled. kex_algorithms Optional | Type: array | Default: ["[email protected]","curve25519-sha256","[email protected]","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256"] Required key exchange algorithms. Compliance uses a two-part policy: (1) every algorithm listed here must be present in the effective list (from sshd_config KexAlgorithms directive, or from 'sshd -T' when no directive is set); (2) the weak algorithms diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, and diffie-hellman-group-exchange-sha1 must not be active regardless. Only ECDH and DH-SHA256/SHA512 variants are acceptable. This list reflects the full effective KexAlgorithms on AVI controllers running OpenSSH 9.6 (Ubuntu) where no explicit KexAlgorithms directive is set. kex_algorithms[] Optional | Type: string - ciphers Optional | Type: array | Default: ["aes128-ctr","aes256-ctr"] Approved symmetric ciphers in the sshd_config Ciphers directive. These are FIPS 140-2 approved counter-mode ciphers. Comparison is order-insensitive (set equality). ciphers[] Optional | Type: string - macs Optional | Type: array | Default: ["[email protected]","[email protected]","hmac-sha2-512"] Approved message authentication codes in the sshd_config MACs directive. HMAC-SHA2 ETM (encrypt-then-MAC) variants are preferred per FIPS 140-2. Comparison is order-insensitive (set equality). macs[] Optional | Type: string - host_keys Optional | Type: array | Default: [{"type":"RSA","size":2048},{"type":"ECDSA","size":256}] Required host key types with minimum acceptable key sizes. Matched by type; size is a minimum (current must be >= desired). RSA minimum 2048 bits; ECDSA minimum 256 bits. The path field is informational and not compared in compliance checks. host_keys[].type Required | Type: string Key algorithm type (RSA, ECDSA, ED25519, etc.) host_keys[].size Required | Type: integer Minimum acceptable key size in bits	9.1.1.0
AVI	General	4405	AVI SSH service and idle timeout configuration audit Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.ssh_config Assessed Condition: SSH service must be active with ClientAliveInterval <= 300 and ClientAliveCountMax = 0. Setting Fields & Requirements: Field Path Requirements / Specifications Description sshd_active Optional | Type: string/null | Default: "active" SSH daemon service state from systemctl is-active ssh client_alive_interval Optional | Type: integer/null | Default: 300 ClientAliveInterval from sshd_config — SSH session idle timeout in seconds client_alive_count_max Optional | Type: integer/null | Default: 0 ClientAliveCountMax from sshd_config — max unanswered keepalive probes before disconnect	9.1.1.0
AVI	General	4406	AVI FIPS mode configuration Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.fips Assessed Condition: FIPS mode must be enabled and operational on all AVI controller nodes. Setting Fields & Requirements: Field Path Requirements / Specifications Description fips_mode Required | Type: boolean | Default: true Whether FIPS mode is configured in AVI system configuration	9.1.1.0
AVI	General	4407	AVI local OS user accounts audit Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.local_accounts Assessed Condition: The set of local OS accounts on each AVI controller node must exactly match the approved list. Any account present on the node but not in the desired list, or any desired account missing from the node, is non-compliant. Service accounts must use /sbin/nologin or /bin/false as their login shell. Setting Fields & Requirements: Field Path Requirements / Specifications Description users Required | Type: array Approved local OS accounts on each AVI controller node. Each entry must include at minimum the 'username' field. The uid, gid, home, and shell fields are optional here but are returned by get() for audit/informational purposes. users[].username Required | Type: string OS login name as it appears in /etc/passwd users[].uid Optional | Type: integer Numeric user ID from /etc/passwd (informational) users[].gid Optional | Type: integer Numeric primary group ID from /etc/passwd (informational) users[].home Optional | Type: string Home directory path from /etc/passwd (informational) users[].shell Optional | Type: string Login shell from /etc/passwd. Service/system accounts must use /sbin/nologin or /bin/false.	9.1.1.0
AVI	General	4408	AVI application accounts and RBAC role bindings audit Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.rbac Assessed Condition: All AVI local application user accounts and their complete per-tenant role assignments must exactly match the approved desired configuration. Any user present in AVI but absent from the desired list, any required user missing, or any user with unexpected role bindings (is_superuser, access list, default_tenant) is non-compliant. Setting Fields & Requirements: Field Path Requirements / Specifications Description local_users Optional | Type: array AVI local application user accounts with per-tenant role bindings. Populate with every authorized local user for this AVI deployment. Full comparison: username is the match key; all other fields (is_superuser, is_active, is_service_user, default_tenant, access list) are also checked. local_users[].username Required | Type: string AVI local user login name (e.g. 'admin', 'avisaltuser') local_users[].is_superuser Optional | Type: boolean True if the user has unrestricted super-admin access across all tenants local_users[].is_active Optional | Type: boolean True if the account is currently enabled local_users[].is_service_user Optional | Type: boolean True if this is a non-interactive service/API account local_users[].default_tenant Optional | Type: string/null Name of the user's default tenant context (typically 'admin') local_users[].access Optional | Type: array Per-tenant role bindings. Each entry associates the user with one role in one tenant. A single user may have multiple entries for different tenants or roles. The 'all_tenants' flag grants the role in every tenant regardless of the 'tenant' field. local_users[].access[].role Required | Type: string/null AVI role name (e.g. 'System-Admin', 'Tenant-Admin', 'VCFOps-Admin', 'Salt-Admin') local_users[].access[].tenant Optional | Type: string/null AVI tenant name this role assignment applies to. Null/ignored when all_tenants is true. local_users[].access[].all_tenants Required | Type: boolean If true, this role applies across all tenants, not just the named tenant	9.1.1.0
AVI	General	4409	AVI TLS 1.2+ version configuration audit Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.avi.tls Assessed Condition: AVI must enforce TLS 1.2 or higher for all connections. The portal SSL profile (assigned via systemconfiguration.portal_configuration.sslprofile_ref) must not accept TLS 1.0 or TLS 1.1 for incoming connections. Additionally, systemconfiguration.legacy_ssl_support must be false to prevent TLS 1.0/1.1 for outgoing controller connections. Setting Fields & Requirements: Field Path Requirements / Specifications Description accepted_versions Required | Type: array | Default: ["SSL_VERSION_TLS1_2"] Compliance check: the current accepted TLS versions (from the SSL profile referenced by systemconfiguration.portal_configuration.sslprofile_ref) must NOT contain SSL_VERSION_TLS1 (TLS 1.0) or SSL_VERSION_TLS1_1 (TLS 1.1). A current value of ['SSL_VERSION_TLS1_2', 'SSL_VERSION_TLS1_3'] is compliant against the desired ['SSL_VERSION_TLS1_2']. accepted_versions[] Optional | Type: string | Allowed: ["SSL_VERSION_TLS1", "SSL_VERSION_TLS1_1", "SSL_VERSION_TLS1_2", "SSL_VERSION_TLS1_3"] - legacy_ssl_support Optional | Type: boolean | Default: false OUTBOUND (Controller → External Servers): systemconfiguration.legacy_ssl_support. Must be false — false means TLS 1.0/1.1 is not allowed for connections the AVI controller makes to external servers. portal_legacy_ssl_support Optional | Type: boolean | Default: false INBOUND (Clients → Controller): systemconfiguration.portal_configuration.legacy_ssl_support. Must be false — false means the AVI portal will not downgrade to TLS 1.0/1.1 when clients request it.	9.1.1.0
AVI	General	4410	AVI local account maximum password age enforcement Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.avi.password_age Assessed Condition: All AVI local application accounts must have a maximum password age of 120 days. Accounts with no expiration or expiration exceeding 120 days are non-compliant. Setting Fields & Requirements: Field Path Requirements / Specifications Description max_days Required | Type: integer | Default: 120 | Range: [1, ∞] Maximum password age in days for AVI local application accounts.	9.1.1.0
Cloud Proxy	General	4800	Cloud Proxy must be configured to use approved DNS servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.dns_config Assessed Condition: Provide list of approved static DNS server IP addresses. Setting Fields & Requirements: Field Path Requirements / Specifications Description mode Optional | Type: string | Allowed: ["dhcp", "is_static"] 'dhcp' — use DNS from the DHCP lease (FAILED if appliance has no DHCP networking). 'is_static' — require static servers (default when omitted). servers Optional | Type: array A valid list of approved, reachable DNS server IP addresses. Used when mode is 'is_static' or mode is omitted. servers[] Optional | Type: string -	9.1.1.0
Cloud Proxy	General	4801	Cloud Proxy must be configured to use approved NTP servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.ntp_config Assessed Condition: Provide list of approved NTP server addresses. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of approved, reachable NTP server hostnames or IP addresses servers[] Optional | Type: string -	9.1.1.0
Cloud Proxy	General	4802	The system must enable FIPS 140-2 compliant cryptographic mode on Cloud Proxy. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.cp.fips_mode Assessed Condition: FIPS 140-2 mode must be enabled on the Cloud Proxy appliance (/proc/sys/crypto/fips_enabled == 1). Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: true FIPS 140-2 mode must be enabled (true) on all Cloud Proxy appliance nodes.	9.1.1.0
Cloud Proxy	General	4803	Cloud Proxy local OS accounts must match the approved desired configuration. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.cp.local_accounts Assessed Condition: All local OS accounts on the Cloud Proxy appliance must match the approved desired-state list. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].username Required | Type: string - value[].uid Required | Type: integer | Range: [0, ∞] - value[].gid Required | Type: integer | Range: [0, ∞] - value[].gecos Optional | Type: string - value[].home Required | Type: string - value[].shell Required | Type: string -	9.1.1.0
Cloud Proxy	General	4804	Cloud Proxy SSH daemon must use protocol version 2 and host keys of at least 2048 bits. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.cp.ssh_crypto Assessed Condition: SSH must use protocol version 2.0 and all RSA host keys must be at least 2048 bits. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Required | Type: string | Default: "2.0" Minimum required SSH protocol version min_key_size Required | Type: integer | Default: 2048 Minimum RSA host key size in bits	9.1.1.0
Cloud Proxy	General	4805	Cloud Proxy SSH service must be in the correct runtime state with appropriate timeouts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.ssh_session Assessed Condition: SSH service must be disabled and idle session timeout must be 600 seconds or less. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: false SSH service should be disabled by default idle_session_timeout Required | Type: integer | Default: 600 Maximum idle session duration in seconds	9.1.1.0
Cloud Proxy	General	4806	Cloud Proxy must disable TLS 1.0 and TLS 1.1 and only accept TLS 1.2 or higher. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.cp.tls_version Assessed Condition: Only TLSv1.2 and TLSv1.3 must be enabled; TLSv1.0 and TLSv1.1 must be disabled. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: array | Default: ["TLSv1.2","TLSv1.3"] TLS versions that must be enabled (set equality enforced) enabled[] Optional | Type: string -	9.1.1.0
Cloud Proxy	General	4807	Cloud Proxy must enforce a maximum password age of 120 days. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.password_age Assessed Condition: Password expiration must be set to 120 days. Setting Fields & Requirements: Field Path Requirements / Specifications Description max_days Required | Type: integer | Default: 120 Maximum password age in days	9.1.1.0
Cloud Proxy	General	4808	Cloud Proxy must enforce password complexity requirements (minimum length, character classes, history). Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.password_policy Assessed Condition: Password complexity requirements must meet organizational minimums on Cloud Proxy. Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Required | Type: object - complexityConstraint.minLength Required | Type: integer | Default: 8 - complexityConstraint.minLowercase Required | Type: integer | Default: 1 - complexityConstraint.minUppercase Required | Type: integer | Default: 1 - complexityConstraint.minNumeric Required | Type: integer | Default: 1 - complexityConstraint.minSpecial Required | Type: integer | Default: 1 - complexityConstraint.passwordHistory Required | Type: integer | Default: 0 -	9.1.1.0
Cloud Proxy	General	4809	Cloud Proxy must enforce the limit of consecutive invalid logon attempts and the lockout duration. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.password_policy Assessed Condition: Account lockout policy must limit consecutive failed login attempts on Cloud Proxy. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Required | Type: object - lockoutConstraint.lockoutMaxAuthFailures Required | Type: integer | Default: 5 | Range: [0, 5] - lockoutConstraint.lockoutEvaluationPeriod Required | Type: integer | Default: 900 - lockoutConstraint.lockoutPeriod Required | Type: integer | Default: 900 -	9.1.1.0
Cloud Proxy	General	4810	Cloud Proxy must enforce a maximum password age. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.cp.password_policy Assessed Condition: Maximum password age must not exceed the organizational limit on Cloud Proxy. Setting Fields & Requirements: Field Path Requirements / Specifications Description expirationConstraint Required | Type: object - expirationConstraint.passwordExpirationDays Required | Type: integer | Default: 90 -	9.1.1.0
ESX	General	3	The ESX host Secure Shell (SSH) daemon must ignore .rhosts files. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_ignore_rhosts Assessed Condition: Set to "yes" to enable SSH IgnoreRhosts option. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "yes" SSH 'IgnoreRhosts' configuration value	9.1.0.0
ESX	General	4	ESX host SSH daemon does not allow host-based authentication. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_host_based_authentication Assessed Condition: Set to "no" to disable SSH HostBasedAuthentication. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'HostBasedAuthentication' configuration value	9.1.0.0
ESX	General	6	ESX host SSH daemon rejects authentication using an empty password Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.ssh_permit_empty_passwords Assessed Condition: Set to "no" to disable PermitEmptyPasswords. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'PermitEmptyPasswords' configuration value	9.1.0.0
ESX	General	7	ESX host SSH daemon does not permit user environment settings. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_permit_user_environment Assessed Condition: Set to "no" to disable SSH PermitUserEnvironment. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'PermitUserEnvironment' configuration value	9.1.0.0
ESX	General	11	ESX host SSH daemon performs strict mode checking of home directory configuration files Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.ssh_strict_mode Assessed Condition: Set to "yes" to enable SSH StrictModes. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "yes" SSH 'StrictModes' configuration value	9.1.0.0
ESX	General	12	Disallow compression for the ESX host SSH daemon Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.ssh_compression Assessed Condition: Set to "no" to disable SSH compression. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'Compression' configuration value	9.1.0.0
ESX	General	13	ESX host SSH daemon does not contain gateway ports. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_gateway_ports Assessed Condition: Set SSH GatewayPorts to "no" to disable the option. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'GatewayPorts' configuration value	9.1.0.0
ESX	General	14	ESX host SSH daemon refuses X11 forwarding Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.ssh_x11_forwarding Assessed Condition: Set to "no" to disable SSH X11Forwarding. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'X11Forwarding' configuration value	9.1.0.0
ESX	General	16	ESX host SSH daemon refuses tunnels. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_permit_tunnel Assessed Condition: Set to "no" to disable SSH PermitTunnel. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'PermitTunnel' configuration value	9.1.0.0
ESX	General;PCI;SCG	22	The ESX host must enforce password complexity. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.password_quality_config Assessed Condition: Set minlen (default 15), retry (default 3), dcredit, ucredit, lcredit, ocredit (default -1 each) for password quality (pwquality format). Setting Fields & Requirements: Field Path Requirements / Specifications Description minlen Optional | Type: integer | Default: 15 | Range: [0, ∞] - retry Optional | Type: integer | Default: 3 | Range: [0, ∞] - dcredit Optional | Type: integer | Default: -1 - ucredit Optional | Type: integer | Default: -1 - lcredit Optional | Type: integer | Default: -1 - ocredit Optional | Type: integer | Default: -1 - difok Optional | Type: integer | Default: 4 | Range: [0, ∞] - enforce_for_root Optional | Type: boolean | Default: true -	9.1.0.0
ESX	General;PCI;SCG	28	Configure the ESX hosts firewall to only allow traffic from the authorized networks. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.firewall_rulesets Assessed Condition: Configure firewall as appropriate to your environment. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].name Required | Type: string - value[].enabled Required | Type: boolean - value[].allowed_ips Optional | Type: object - value[].allowed_ips.address Optional | Type: array List of allowed IP addresses for this ruleset value[].allowed_ips.address[] Optional | Type: string - value[].allowed_ips.network Optional | Type: array List of allowed subnet in the format of network cidr value[].allowed_ips.network[] Optional | Type: string - value[].rules Optional | Type: array - value[].rules[].direction Required | Type: any | Allowed: ["inbound", "outbound"] - value[].rules[].end_port Optional | Type: number - value[].rules[].port Required | Type: number - value[].rules[].protocol Required | Type: any | Allowed: ["tcp", "udp"] - value[].allow_all_ip Required | Type: boolean -	9.1.0.0
ESX	General;PCI;SCG	30	Show warnings in the vSphere Client if local or remote shell sessions are enabled on the ESX hosts Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.suppress_shell_warning Assessed Condition: Set to 0 to disable suppression of warning for enabled local and remote shell access. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 0 | Range: [0, 1] Enable/Disable suppressing of warning for enabled local and remote shell access( 1 to enable, 0 to disable)	9.1.0.0
ESX	General;PCI;SCG	31	Enable Normal lockdown mode on the host Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.lockdown_mode Assessed Condition: Enable lockdown mode to deactivate direct access to require the host be managed remotely from vCenter Server. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["NORMAL", "DISABLED", "STRICT"] | Default: "NORMAL" Lockdown mode for the esxi host	9.1.0.0
ESX	DISA;General;PCI;SCG	34	Set the maximum number of failed login attempts before an account is locked Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.max_failed_login_attempts Assessed Condition: Limit number of failed login attempts. Default is 5. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 5 | Range: [0, 100] Maximum allowed failed login attempts before locking out a user's account. Zero disables account locking	9.1.0.0
ESX	General	38	Configure the inactivity timeout to automatically terminate idle shell sessions Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.interactive_shell_idle_timeout Assessed Condition: Set timeout to a positive integer to terminate idle sessions. Default is 600 seconds. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 600 | Range: [0, 86400] An idle time (in seconds) before interactive shell is automatically logout (0 disables timeout). Takes effect only for new logged in sessions	9.1.0.0
ESX	General;PCI;SCG	43	Enable the Bridge Protocol Data Unit (BPDU) filter Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.bridge_protocol_data_unit_filter Assessed Condition: Set to 1 to enable BPDU Filter. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 | Range: [0, 1] Enable/Disable bridge protocol data unit filter (1 to enable, 0 to disable)	9.1.0.0
ESX	General;PCI;SCG	105	The ESX host must configure the firewall to block incoming network traffic by default Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.firewall_default_action_incoming Assessed Condition: Set to DROP to block all incoming network traffic unless explicitly allowed. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["DROP", "PASS"] | Default: "DROP" Firewall default action. DROP(or PASS) blocks(or allows) incoming traffic by default	9.1.0.0
ESX	General	106	The ESX host must configure the firewall to block outgoing network traffic by default Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.firewall_default_action_outgoing Assessed Condition: Set to DROP to block all outgoing network traffic unless explicitly allowed. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["DROP", "PASS"] | Default: "DROP" Firewall default action. DROP(or PASS) blocks(or allows) outgoing traffic by default	9.1.0.0
ESX	General	109	Configure the password history setting to restrict the reuse of passwords Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.password_reuse_restriction Assessed Condition: Setting to a positive integer protects against reuse of passwords. Default is 5. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 5 | Range: [0, 100] Password reuse count	9.1.0.0
ESX	General	111	The ESX host must be configured to disable non-essential capabilities by disabling SSH Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_service_policy Assessed Condition: Set service_running to "false" and service_policy to "off" to stop and disabled the service. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_running Required | Type: boolean | Default: false service running flag true/false service_policy Required | Type: string | Allowed: ["on", "off"] | Default: "off" service policy: on/off	9.1.0.0
ESX	General;PCI;SCG	112	Stop the ESX shell service and set the startup policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.shell_service_policy Assessed Condition: Set service_running to "false" and service_policy to "off" to disable and stop the ESXi shell service. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_running Required | Type: boolean | Default: false service running flag true/false service_policy Required | Type: string | Allowed: ["on", "off"] | Default: "off" service policy: on/off	9.1.0.0
ESX	General;PCI;SCG	122	Configure the login banner for the DCUI of the ESX host Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.dcui_login_banner Assessed Condition: Configure a login message or banner inform users of their responsibilities and conditions for system use. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Default: "This system is for the use of authorized users only. Individuals using this computer system without authority or in excess of their authority are subject to having all their activities on this system monitored and recorded by system personnel. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity system personal may provide the evidence of such monitoring to law enforcement officials." Login banner for the DCUI of the host	9.1.0.0
ESX	General;PCI;SCG	123	Configure the login banner for the SSH connections Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_login_banner Assessed Condition: Enable a login message to inform users about system use obligations. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Default: "This system is for the use of authorized users only. Individuals using this computer system without authority or in excess of their authority are subject to having all their activities on this system monitored and recorded by system personnel. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity system personal may provide the evidence of such monitoring to law enforcement officials." Login banner for ssh connection	9.1.0.0
ESX	General	124	The ESX host SSH daemon must be configured with an approved login banner. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_daemon_login_banner Assessed Condition: Configure a login message or banner inform users of their responsibilities and conditions for system use. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Default: "The time and date of this login have been sent to the system logs.\n\nWARNING:\n All commands run on the shell are logged and may be included in\n support bundles. Do not provide passwords directly on the command line.\n Most tools can prompt for secrets or accept them from standard input.\n\nVMware offers powerful and supported automation tools. Please\nsee https://developer.vmware.com for details.\n\nThe ESXi Shell can be disabled by an administrative user. See the\nvSphere Security documentation for more information.\n" Login banner for ssh daemon	9.1.0.0
ESX	General;PCI;SCG	125	The ESX host must verify the exception users list for lockdown mode Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.lockdown_mode_exception_users Assessed Condition: Limit users on the Lockdown Mode Exception Users list as they do not lose their privileges when the host enters lockdown mode. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[] Optional | Type: string -	9.1.0.0
ESX	General;PCI;SCG	136	Configure a persistent log location for all locally stored logs Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.log_location_config Assessed Condition: Set is_persistent to "true" to configure persistent datastore. Setting Fields & Requirements: Field Path Requirements / Specifications Description log_location Required | Type: string Datastore path of the directory to output logs to. Example: [datastoreName]/logdir is_persistent Required | Type: boolean | Default: true True for persistent log location or False for non-persistent log location	9.1.0.0
ESX	General;PCI;SCG	137	Active Directory ESX Admin group membership must not be used when adding ESX hosts to Active Directory. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ad_esx_admin_group_config Assessed Condition: The default group must be changed to a site-specific Active Directory group that is not "ESX Admins". Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string ESX Admin group configuration	9.1.0.0
ESX	General;PCI;SCG	138	The ESX host must disable Inter-VM transparent page sharing. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.mem_share_force_salting_config Assessed Condition: Set to 2 to disable Inter-VM transparent page sharing. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 2 | Range: [0, 2] Memory share force salting config, 0-no salting or isolation between VMs, 1-share mem with VMs with same salt, 2-no inter VM share	9.1.0.0
ESX	General;PCI;SCG	147	ESX host must configure NTP time synchronization. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ntp_config Assessed Condition: The recommended practice for NTP is to have at least four sources. It is not advisable to have only two sources; one source is preferable to having two. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol Required | Type: string | Allowed: ["ntp"] time synchronization protocol servers Required | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
ESX	General	148	The ESX host must configure NTP Service startup policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ntp_service_startup_policy Assessed Condition: Set to "on" to enable NTP service. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_policy Required | Type: string | Allowed: ["on", "off"] | Default: "on" service policy: on/off	9.1.0.0
ESX	General	149	Start NTP service on the ESX host. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ntp_service_config Assessed Condition: Set to true to enable NTP service. Set to false to disable NTP service. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_running Required | Type: boolean | Default: true service running flag true/false	9.1.0.0
ESX	General;PCI;SCG	157	The ESX Image Profile and vSphere Installation Bundle (VIB) Acceptance Levels must be verified Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.image_profile_acceptance_level Assessed Condition: Acceptance level should be "partner", "vmware_accepted", or "vmware_certified". Setting Fields & Requirements: Field Path Requirements / Specifications Description acceptance_level Required | Type: string | Allowed: ["vmware_certified", "vmware_accepted", "partner", "community"] | Default: "partner" image profile acceptance level	9.1.0.0
ESX	General;PCI;SCG	160	All port groups on standard switches must be configured to reject forged transmits Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.pg_vss_forged_transmits_accept Assessed Condition: Set to "false" to configure forged transmits option to Reject. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false Flag to accept(True)/reject(False) forged transmits.	9.1.0.0
ESX	General;PCI;SCG	161	All port groups on standard switches must be configured to reject guest MAC address changes. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.pg_vss_mac_change_accept Assessed Condition: Set to "false" to prevent virtual machines from changing their effective MAC address. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false Flag to accept/reject mac change	9.1.0.0
ESX	General;PCI;SCG	162	All port groups on standard switches must be configured to reject guest promiscuous mode requests. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.pg_vss_allow_promiscuous_mode Assessed Condition: Set to "false" to reject guest promiscuous mode. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false Flag to allow/reject guest promiscuous mode	9.1.0.0
ESX	General;PCI;SCG	163	The ESX host must verify the DCUI.Access list Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.lockdown_dcui_access_users Assessed Condition: Use the Lockdown Mode Exception Users list to limit access to authorized users. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[] Optional | Type: string -	9.1.0.0
ESX	General;PCI;SCG	164	Configure a remote log server for the ESX hosts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.remote_log_server_config Assessed Condition: Send logs to a secure and centralized log server to prevent tampering and ensure a unified, long-term audit record. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[] Optional | Type: string | Pattern: ^\s*(tcp|udp|ssl)://[a-zA-Z0-9.-]+:[0-9]+\s*$ -	9.1.0.0
ESX	General;PCI;SCG	165	The ESX host must enforce an unlock timeout of certain defined minutes after a user account is locked out Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.account_unlock_time_interval Assessed Condition: Unlock timeout of 800 seconds or more. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 800 | Range: [1, 999999999] Duration in seconds to lock out a user's account after exceeding max failed login attempts	9.1.0.0
ESX	General;PCI;SCG	166	The ESX host must disable the Managed Object Browser (MOB). Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.managed_object_browser Assessed Condition: Set to "false" to disable Managed Object Browser. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false Flag to enable/disable the debug managed object browser	9.1.0.0
ESX	General;PCI;SCG	168	Set a timeout to automatically terminate idle DCUI sessions Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.dcui_idle_timeout Assessed Condition: Terminate idle connections in 600 seconds or less. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 600 | Range: [0, 86400] An idle time in seconds before DCUI is automatically logout. Setting 0 disables the timeout	9.1.0.0
ESX	General;PCI;SCG	169	Use of the dvFilter network APIs must be restricted. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.dv_filter_bind_ip_config Assessed Condition: No IP or security appliance IP address. Setting Fields & Requirements: Field Path Requirements / Specifications Description security_appliance_ip Required | Type: string | Default: "" blank string or security appliance IP address	9.1.0.0
ESX	General;PCI;SCG	179	The ESX host must produce audit records containing information to establish what type of events occurred Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.hostd_log_level Assessed Condition: Ensure sufficient information is present in audit logs for diagnostics and forensics purposes. Default is "info". Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["none", "quiet", "panic", "error", "warning", "info", "verbose", "trivia"] | Default: "info" Setting to control the global log level	9.1.0.0
ESX	General	180	The ESX host must have kernel-level FIPS 140-2 mode enabled; enabling requires a host reimage and cannot be remediated at runtime. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.fips_mode_config Assessed Condition: Set to "true". Enabling kernel-level FIPS 140-2 requires a full host reimage; the control is audit-only and cannot be auto-remediated at runtime. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: true Flag indicating whether kernel-level FIPS 140-2 mode is enabled on the ESXi host	9.1.1.0
ESX	General	181	The ESX host SSH daemon must be configured with organization-approved protocol version and host-key algorithms; changes require manual operator intervention. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.ssh_crypto_config Assessed Condition: SSH protocol version must be 2; host_key_algorithms must include ecdsa-sha2-nistp256, rsa-sha2-512, and rsa-sha2-256. This control is audit-only. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Required | Type: integer | Default: 2 SSH protocol version (must be 2) host_key_algorithms Required | Type: array | Default: ["ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256"] List of approved host-key algorithms host_key_algorithms[] Optional | Type: string -	9.1.1.0
ESX	General	183	The ESX host DNS client must be configured with organization-approved DNS servers and search domains. Severity: IMMEDIATE  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.host_dns_config Assessed Condition: dns_servers must contain at least one organization-approved DNS server IP address. search_domains must contain approved approved domain suffixes when applicable. Setting Fields & Requirements: Field Path Requirements / Specifications Description dns_servers Required | Type: array | Default: [] List of DNS server IP addresses configured on the host dns_servers[] Optional | Type: string - search_domains Optional | Type: array | Default: [] List of DNS search domain suffixes configured on the host search_domains[] Optional | Type: string -	9.1.1.0
ESX	General	184	The ESX host local OS user account list must contain only organization-approved accounts; unexpected accounts must be investigated and removed by an operator. Severity: IMMEDIATE  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.local_os_user_inventory Assessed Condition: The host local user list must contain only accounts in the expected_users allowlist or matching an exclude_user_patterns regex. Any extra account triggers a NON_COMPLIANT result. This control is audit-only; account removal requires operator action. Setting Fields & Requirements: Field Path Requirements / Specifications Description expected_users Required | Type: array | Default: ["root","vpxuser","dcui"] Allowlist of local user IDs that are permitted on the ESXi host expected_users[] Optional | Type: string - exclude_user_patterns Optional | Type: array Optional list of regex patterns. Local users whose names match any pattern are considered approved and excluded from the compliance check. Intended for host-specific service accounts whose names embed the host identifier (e.g. svc-vcf-esx-.*) so that a single shared desired spec remains valid across all ESXi hosts. exclude_user_patterns[] Optional | Type: string User defined regex pattern to exclude users from compliance check	9.1.1.0
ESX	General	185	The ESX host RBAC posture must comply with organizational requirements: lockdown mode enabled, DCUI access restricted, and AD authentication configured. Severity: IMMEDIATE  |  Auto-Remediate: False  |  Schema Path: compliance_config.esxi.rbac_config Assessed Condition: lockdown_mode must be NORMAL or STRICT; ad_auth_enabled must be true. This control is audit-only. Use dedicated controllers (lockdown_mode, lockdown_dcui_access_users) for individual remediation. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockdown_mode Required | Type: string | Allowed: ["DISABLED", "NORMAL", "STRICT"] | Default: "NORMAL" ESXi lockdown mode setting ad_auth_enabled Optional | Type: boolean | Default: true Whether Active Directory authentication is enabled	9.1.1.0
ESX	General	186	The ESX host SSH service must be disabled or, when required, configured with organization-approved idle session and enablement timeouts. Severity: IMMEDIATE  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_service_config Assessed Condition: SSH service must be disabled (service_running=false, service_policy=off). When SSH is operationally required, idle_session_timeout must be ≤ 300 and enablement_timeout must be ≤ 30. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_running Required | Type: boolean | Default: false Whether the SSH service (TSM-SSH) is currently running service_policy Required | Type: string | Allowed: ["on", "off", "automatic"] | Default: "off" SSH service startup policy idle_session_timeout Required | Type: integer | Default: 300 | Range: [1, ∞] SSH daemon ClientAliveCountMax setting enablement_timeout Optional | Type: integer | Default: 30 | Range: [0, ∞] Shell interactive timeout in seconds	9.1.1.0
ESX	General;PCI;SCG	564	ESX host must configure host client session timeout Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.host_client_session_idle_timeout Assessed Condition: Inactivity timeout of 600 seconds or less. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 600 | Range: [0, 7200] An idle time (in seconds) before host client session is automatically logout (0 disables timeout).	9.1.0.0
ESX	General	1100	The ESX host SSH daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_fips_140_2_crypt_config Assessed Condition: Set to "true" to enable SSH FIPS 140-2 validated cryptographic modules. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: true Flag to enable/disable FIPS 140-2 validated cryptographic modules configuration	9.1.0.0
ESX	General	1107	The ESX host must exclusively enable TLS 1.2 for all endpoints Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.tls_version Assessed Condition: Only TLS 1.2 should be enabled. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[] Optional | Type: string | Allowed: ["sslv3", "tlsv1", "tlsv1.1", "tlsv1.2"] -	9.1.0.0
ESX	General;PCI;SCG	1110	The ESX host must not suppress warning about unmitigated hyperthreading vulnerabilities Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.suppress_hyperthread_warning Assessed Condition: Set to 0 to disable suppression of unmitigated hyperthread vulnerabilities warning. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 0 | Range: [0, 1] Enable/Disable suppressing of hyperthread warning( 1 to enable, 0 to disable)	9.1.0.0
ESX	General	1111	The ESX host Secure Shell (SSH) daemon must disable port forwarding. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.ssh_port_forwarding Assessed Condition: Set to "no" to disable SSH AllowTcpForwarding. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Allowed: ["yes", "no"] | Default: "no" SSH 'AllowTcpForwarding' configuration value	9.1.0.0
ESX	General	1114	SNMP must be configured properly on the ESX host. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.snmp_config Assessed Condition: Configure SNMP alerts as appropriate to your environment. Setting Fields & Requirements: Field Path Requirements / Specifications Description enable Required | Type: boolean SNMP enable flag communities Required | Type: array SNMP communities values communities[] Optional | Type: string - privacy Optional | Type: string | Allowed: ["none", "AES128"] Privacy algorithm to be used by SNMP authentication Optional | Type: string | Allowed: ["none", "SHA1"] Authentication algorithm to be used by SNMP v3_targets Required | Type: object SNMP v3 targets v3_targets.hostname Required | Type: string host name or IP address v3_targets.port Required | Type: number Port number on management system to receive traps or informs v3_targets.userid Required | Type: string user name v3_targets.security_level Required | Type: string | Allowed: ["auth", "priv", "none"] the level of authentication and privacy v3_targets.message_type Required | Type: string | Allowed: ["trap", "inform"] the type of the messages received by the management system.	9.1.0.0
ESX	General;PCI;SCG	1115	The ESX host must verify certificates for SSL syslog endpoints Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.syslog_enforce_ssl_certificates Assessed Condition: Set to "true" to enable SSL certificate checks. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: true Enable/Disable enforcing checking of SSL certificates when transmitting messages to remote hosts	9.1.0.0
ESX	General;PCI;SCG	1116	The ESX host must configure a session timeout for the vSphere API Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.vim_api_session_timeout Assessed Condition: Configure session timeout for vSphere API to 30 minutes or less. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 30 | Range: [0, 2147483647] Number of minutes until a VIM API session times out due to inactivity - set to zero to disable timeout. Applies to new sessions only.	9.1.0.0
ESX	General;PCI;SCG	1121	The ESX host must enable strict x509 verification for SSL syslog endpoints Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.syslog_strict_x509_compliance Assessed Condition: Set to "true" to enable strict x509 verification. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: true Enable/Disable strict x509 verification for SSL syslog endpoints	9.1.0.0
ESX	General;PCI;SCG	1122	The ESX host must enable volatile key destruction Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.userworld_memory_zeroing_config Assessed Condition: Set to 1 to zero out guest memory pages immediately when a userworld process or guest exits. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 | Range: [0, 1] Flag to enable(1)/disable(0) volatile key destruction (Zero out userworld and guest memory pages immediately after free)	9.1.0.0
ESX	General;PCI;SCG	1123	The ESX host must be configured with an appropriate maximum password age. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.password_max_lifetime Assessed Condition: Configure password max age as appropriate to your environment. Default is 90 days. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 90 | Range: [1, 99999] Max password lifetime in days	9.1.0.0
ESX	General	1128	Configure or disable SNMP Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.snmp_service_policy Assessed Condition: Set service_running to true and service_policy to yes to enable SNMP service. Set service_running to false and service_policy to no to disable SNMP service. Setting Fields & Requirements: Field Path Requirements / Specifications Description service_running Required | Type: boolean | Default: false service running flag true/false service_policy Required | Type: string | Allowed: ["on", "off"] | Default: "off" service policy: on/off	9.1.0.0
ESX	PCI;SCG	1129	The ESX host must not enable virtual hardware management network interfaces Policy/Audit control. No JSON schema defined in checks.json for ID 1129.	9.1.0.0
ESX	PCI;SCG	1130	The ESX host must transmit audit records to a remote host Policy/Audit control. No JSON schema defined in checks.json for ID 1130.	9.1.0.0
ESX	PCI;SCG	1131	The ESX host must enable audit record logging Policy/Audit control. No JSON schema defined in checks.json for ID 1131.	9.1.0.0
ESX	PCI;SCG	1132	The ESX host must log sufficient information for events Policy/Audit control. No JSON schema defined in checks.json for ID 1132.	9.1.0.0
ESX	PCI;SCG	1133	Configure tpm based secure boot Policy/Audit control. No JSON schema defined in checks.json for ID 1133.	9.1.0.0
ESX	PCI;SCG	1135	Set a timeout to limit how long the ESX Shell and SSH services are allowed to run Policy/Audit control. No JSON schema defined in checks.json for ID 1135.	9.1.0.0
ESX	PCI;SCG	1139	The ESX host must not automatically grant administrative permissions to Active Directory groups Policy/Audit control. No JSON schema defined in checks.json for ID 1139.	9.1.0.0
ESX	PCI;SCG	1140	ESXi host must have TPM 2.0 installed and enabled for hardware-based security Policy/Audit control. No JSON schema defined in checks.json for ID 1140.	9.1.0.0
ESX	PCI;SCG	1142	The ESX host must not enable log filtering Policy/Audit control. No JSON schema defined in checks.json for ID 1142.	9.1.0.0
ESX	General;PCI;SCG	1143	ESXi TLS Server Profile configuration Severity: Critical  |  Auto-Remediate: True  |  Schema Path: compliance_config.esxi.tls_server_profile Assessed Condition: Set to "NIST_2024". A host restart is required after changing the TLS server profile. Setting Fields & Requirements: Field Path Requirements / Specifications Description tls_server_profile Optional | Type: string | Must equal: "NIST_2024" | Default: "NIST_2024" TLS server profile setting for ESXi	9.1.0.0
ESX	PCI;SCG	1145	VMware vCenter must enable vMotion live workload migration Policy/Audit control. No JSON schema defined in checks.json for ID 1145.	9.1.0.0
ESX	PCI;SCG	1146	The ESX host must not disable validation of users and groups Policy/Audit control. No JSON schema defined in checks.json for ID 1146.	9.1.0.0
ESX	PCI;SCG	1163	Enable UEFI Secure Boot on the host Policy/Audit control. No JSON schema defined in checks.json for ID 1163.	9.1.0.0
ESX	PCI;SCG	1164	The ESX host must store one week of audit records Policy/Audit control. No JSON schema defined in checks.json for ID 1164.	9.1.0.0
HCX	General	3701	HCX local account password policy ‚Äî age, complexity, and lockout. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.password_policy Assessed Condition: HCX must enforce password age, complexity, and lockout policy for all local accounts. Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Optional | Type: object - complexityConstraint.minLength Optional | Type: integer | Default: 15 Minimum password length complexityConstraint.minLowercase Optional | Type: integer | Default: 1 Minimum lowercase characters required complexityConstraint.minUppercase Optional | Type: integer | Default: 1 Minimum uppercase characters required complexityConstraint.minNumeric Optional | Type: integer | Default: 1 Minimum numeric characters required complexityConstraint.minSpecial Optional | Type: integer | Default: 1 Minimum special characters required complexityConstraint.passwordHistory Optional | Type: integer | Default: 5 Number of previous passwords that cannot be reused expirationConstraint Optional | Type: object - expirationConstraint.passwordExpirationDays Required | Type: integer | Default: 120 Maximum number of days a password is valid lockoutConstraint Optional | Type: object - lockoutConstraint.lockoutMaxAuthFailures Optional | Type: integer | Default: 5 Maximum consecutive failed authentication attempts before lockout lockoutConstraint.lockoutEvaluationPeriod Optional | Type: integer | Default: 900 Duration in seconds after which the failed login counter resets lockoutConstraint.lockoutPeriod Optional | Type: integer | Default: 1800 Duration in seconds the account is locked out after max auth failures	9.1.1.0
HCX	General	3702	HCX must lock out accounts for a configured duration after excessive login failures. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.account_lockout_duration Assessed Condition: HCX must lock out accounts for a configured duration after excessive login failures to deter repeated unauthorized access attempts. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Optional | Type: object - lockoutConstraint.lockoutPeriod Optional | Type: integer | Default: 1800 | Range: [1, ∞] Duration in seconds the account is locked out after max auth failures	9.1.1.0
HCX	General	3703	HCX must lock out local accounts after a configured number of consecutive failed login attempts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.account_lockout_attempts Assessed Condition: HCX must lock out local accounts after a configured number of consecutive failed login attempts to prevent brute-force attacks. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Optional | Type: object - lockoutConstraint.lockoutMaxAuthFailures Optional | Type: integer | Default: 5 -	9.1.1.0
HCX	General	3704	HCX must reset the failed login counter after a configured interval. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.account_lockout_reset Assessed Condition: HCX must reset the failed login counter after a configured interval to limit the window for brute-force attempts. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Optional | Type: object - lockoutConstraint.lockoutEvaluationPeriod Optional | Type: integer | Default: 900 | Range: [1, ∞] Duration in seconds after which the failed login counter resets	9.1.1.0
HCX	General	3705	HCX must enforce password complexity requirements for local accounts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.password_complexity Assessed Condition: HCX must enforce password complexity requirements including minimum length and character class requirements for local accounts. Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Optional | Type: object - complexityConstraint.minLength Optional | Type: integer | Default: 15 - complexityConstraint.minLowercase Optional | Type: integer | Default: 1 - complexityConstraint.minUppercase Optional | Type: integer | Default: 1 - complexityConstraint.minNumeric Optional | Type: integer | Default: 1 - complexityConstraint.minSpecial Optional | Type: integer | Default: 1 -	9.1.1.0
HCX	General	3706	HCX must prohibit reuse of previous passwords for local accounts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.password_history Assessed Condition: HCX must prohibit reuse of previous passwords for local accounts to prevent credential cycling. Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Optional | Type: object - complexityConstraint.passwordHistory Optional | Type: integer | Default: 5 -	9.1.1.0
HCX	General	3707	HCX must forward audit logs to an approved syslog server. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.syslog_li_agent Assessed Condition: HCX must forward audit records to a centralized syslog server for monitoring and review. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of syslog servers servers[].hostname Required | Type: string | Default: "syslog.corp.local" - servers[].port Required | Type: integer | Default: 9543 - servers[].protocol Required | Type: string | Allowed: ["UDP", "TCP"] | Default: "UDP" -	9.1.1.0
HCX	General	3708	HCX SSH daemon must use FIPS-approved cryptographic algorithms. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.ssh_crypto Assessed Condition: HCX SSH daemon must be configured to use only FIPS-approved cryptographic algorithms for authentication and encryption. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Optional | Type: string | Allowed: ["1.0", "2.0"] | Default: "2.0" Required SSH protocol version (e.g. "2.0") host_keys Optional | Type: array | Default: [{"key_type":"rsa","key_size":2048}] SSH key size requirements for different key types host_keys[].key_type Required | Type: string | Allowed: ["rsa", "dsa", "ecdsa", "ed25519"] | Default: "rsa" SSH key type host_keys[].key_size Required | Type: integer | Default: 2048 Minimum required key size in bits	9.1.1.0
HCX	General	3709	HCX SSH service must be configured with the correct runtime state and session idle timeout. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.ssh_access Assessed Condition: HCX SSH service must be disabled or configured with an idle session timeout to reduce the attack surface. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: false - idle_session_timeout Required | Type: integer | Default: 10 SSH idle session timeout in minutes enablement_timeout Optional | Type: integer | Default: 10 Duration in minutes before SSH auto-disables (0 = no auto-disable). Required when enabled is true.	9.1.1.0
HCX	General	3710	HCX must operate in FIPS 140-2 compliant mode. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.fips_mode Assessed Condition: HCX must be configured to operate in FIPS 140-2 compliant mode to ensure use of approved cryptographic modules. Setting Fields & Requirements: Field Path Requirements / Specifications Description fips_enabled Required | Type: boolean | Default: true -	9.1.1.0
HCX	General	3711	HCX local OS accounts must match the approved desired configuration. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.local_accounts Assessed Condition: HCX local OS accounts must match the approved configuration to prevent unauthorized access via unexpected accounts. Setting Fields & Requirements: Field Path Requirements / Specifications Description accounts Required | Type: array | Default: [{"username":"root","uid":0,"gid":0,"gecos":"root","home":"/root","shell":"/bin/bash"},{"username":"admin","uid":1000,"gid":1000,"gecos":"","home":"/home/admin","shell":"/bin/bash"}] - accounts[].username Required | Type: string - accounts[].uid Required | Type: integer - accounts[].gid Required | Type: integer - accounts[].gecos Required | Type: string - accounts[].home Required | Type: string - accounts[].shell Required | Type: string -	9.1.1.0
HCX	General	3712	HCX must restrict access to functions based on the role of the user. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.rbac Assessed Condition: HCX must enforce role-based access control to restrict functions to authorized users only. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].name Required | Type: string User or group name value[].type Required | Type: string | Allowed: ["USER", "GROUP"] Type to denote its a user or a group value[].role Required | Type: string | Allowed: ["Migration Admin", "Migration User", "Migration Appliance Admin"] HCX role name value[].identity_source_type Required | Type: string | Allowed: ["LOCAL", "VIDM"] Identity source the principal originates from.	9.1.1.0
HCX	General	3713	HCX must use TLS 1.2 or higher for all network communications. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.tls_version Assessed Condition: HCX must use TLS 1.2 or higher for all network communications to protect data in transit. Setting Fields & Requirements: Field Path Requirements / Specifications Description minimum_tls_version Required | Type: string | Allowed: ["TLSv1.1", "TLSv1.2", "TLSv1.3"] | Default: "TLSv1.2" Minimum TLS version that must be enabled in the HCX Apache HTTPD configuration. All TLS versions equal to and above this version must be enabled.	9.1.1.0
HCX	General	3714	HCX must match the approved compliance profile. Policy/Audit control. No JSON schema defined in checks.json for ID 3714.	9.1.1.0
HCX	General	3715	HCX local account passwords must be rotated within the approved interval. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.password_rotation Assessed Condition: HCX local account passwords must be rotated within the approved interval to reduce the risk of compromised credentials. Setting Fields & Requirements: Field Path Requirements / Specifications Description rotation_interval_days Required | Type: integer | Default: 90 -	9.1.1.0
HCX	General	3716	HCX must display an approved login warning banner to all users upon SSH login. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.login_banner Assessed Condition: HCX must display an approved warning banner at SSH login to notify users of monitoring and unauthorized use policies. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string | Default: "" Login banner text displayed at SSH login (stored in /etc/issue)	9.1.1.0
HCX	General	3717	HCX must encrypt all migration traffic. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.migration_encryption Assessed Condition: HCX must encrypt all migration traffic to protect data in transit during workload migrations. Setting Fields & Requirements: Field Path Requirements / Specifications Description encryption_enabled Required | Type: boolean | Default: true -	9.1.1.0
HCX	General	3718	HCX appliance must be configured with the correct DNS servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.dns Assessed Condition: HCX appliance must be configured with correct and reachable DNS servers for proper name resolution. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array | Default: [] A valid list of reachable DNS server IP addresses. servers[] Optional | Type: string | Format: ipv4 IPv4 address of DNS server search_domains Optional | Type: array | Default: [] Optional list of DNS search domain suffixes. search_domains[] Optional | Type: string -	9.1.1.0
HCX	General	3719	HCX appliance must be configured with authoritative NTP time sources. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.ntp Assessed Condition: HCX appliance must be configured with authoritative NTP time sources to ensure accurate system time for audit log integrity. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array | Default: [] A valid list of NTP server hostnames or IP addresses. servers[] Optional | Type: string -	9.1.1.0
HCX	General	3720	HCX local accounts must have a configured maximum password age. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.hcx.password_age Assessed Condition: HCX local accounts must have a configured maximum password age to ensure passwords are regularly changed. Setting Fields & Requirements: Field Path Requirements / Specifications Description expirationConstraint Optional | Type: object - expirationConstraint.passwordExpirationDays Required | Type: integer | Default: 120 -	9.1.1.0
HCX	General	3721	HCX must be configured with approved TLS cipher suites. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.hcx.cipher_suites Assessed Condition: HCX must be configured to use only approved TLS cipher suites for all encrypted communications. Setting Fields & Requirements: Field Path Requirements / Specifications Description TLSv1.2 Optional | Type: object - TLSv1.2.enabled Required | Type: boolean | Default: true - TLSv1.2.cipher_suites Optional | Type: array | Default: ["ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES256-GCM-SHA384","!aNULL","!eNULL","!EXPORT","!DES","!RC4","!3DES","!MD5","!PSK","!DHE"] - TLSv1.2.cipher_suites[] Optional | Type: string - TLSv1.3 Optional | Type: object - TLSv1.3.enabled Required | Type: boolean | Default: true - TLSv1.3.cipher_suites Optional | Type: array | Default: [] - TLSv1.3.cipher_suites[] Optional | Type: string -	9.1.1.0
NSX Edge	General	2600	Validate DNS servers for NSX-T Edge nodes (Compliance only, remediation for NSX cluster is through Manager controller) Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_edge.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of DNS servers servers[] Optional | Type: string | Format: ipv4 IPv4 address of DNS server	9.1.0.0
NSX Edge	General	2601	Only approved local accounts should be present Severity: Warning  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_edge.local_accounts Assessed Condition: Set allowed_accounts to a list of account names. Setting Fields & Requirements: Field Path Requirements / Specifications Description allowed_accounts Required | Type: array List of accounts allowed on NSX Edge nodes. If Edge nodes have unallowed accounts they will be deleted. Creation of new accounts is not supported. Edge node is compliant if it doesn't contain any unallowed accounts. allowed_accounts[] Optional | Type: string | Length: [1, 32] user name delete_audit_account Optional | Type: boolean | Default: false Flag to control whether audit account should be deleted if not in allowed_accounts list. If false, audit account will be retained even if not in allowed_accounts. Default is false.	9.1.0.0
NSX Edge	General	2602	NSX Components must meet minimum SSH protocol and ssh key_size Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_edge.secure_ssh Assessed Condition: Set protocol_version and host_keys configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Optional | Type: string | Default: "2.0" Required SSH protocol version (e.g., "1.0", "2.0", "1.99") host_keys Optional | Type: array | Default: [{"key_type":"rsa","key_size":2048}] SSH key size requiremetents for different key types host_keys[].key_type Required | Type: string | Allowed: ["rsa", "dsa", "ecdsa", "ed25519"] SSH key type host_keys[].key_size Required | Type: integer | Range: [1, ∞] Minimum required key size in bits	9.1.0.0
NSX Edge	General	2603	Validate Syslog servers for NSX-T Edge nodes (Compliance only, remediation for NSX cluster is through Manager controller) Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_edge.syslog Assessed Condition: Provide list of syslog servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of syslog servers servers[].host Required | Type: string Hostname or IP address of the destination log server servers[].port Optional | Type: integer | Default: 514 | Range: [1, 65535] Port number for sending log traffic to the specified host. Default is 514 for both TCP and UDP protocols. servers[].protocol Required | Type: string | Allowed: ["TCP", "UDP"] Protocol used for forwarding logs. 'TCP' and 'UDP' forward logs via rsyslog. servers[].facilities Optional | Type: array | Default: ["ALL"] Syslog facility codes. If not specified, all facilities are forwarded. servers[].facilities[] Optional | Type: string | Allowed: ["ALL", "KERN", "USER", "MAIL", "DAEMON", "AUTH", "SYSLOG", "LPR", "NEWS", "UUCP", "AUTHPRIV", "FTP", "LOGALERT", "CRON", "LOCAL0", "LOCAL1", "LOCAL2", "LOCAL3", "LOCAL4", "LOCAL5", "LOCAL6", "LOCAL7"] - servers[].loglevel Optional | Type: string | Allowed: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFO", "DEBUG"] | Default: "INFO" Log level for log forwarding	9.1.0.0
NSX Edge	PCI;SCG	2604	NSX Edge must display a SSH Login Banner Message during user login Policy/Audit control. No JSON schema defined in checks.json for ID 2604.	9.1.0.0
NSX Edge	General;PCI;SCG	2605	NSX Edge nodes should have SSH service deactivated Severity: Critical  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_edge.ssh_access_config Assessed Condition: Set ssh_enabled to "false" to disable SSH service (stops service and disables start-on-boot) and root_login to "false" to disable root SSH access on NSX Edge nodes. Setting Fields & Requirements: Field Path Requirements / Specifications Description ssh_enabled Required | Type: boolean SSH service availability control. When set to true, the SSH service will be started (if not already running) and configured to start automatically on system boot. When set to false, the SSH service will be stopped (if currently running) and configured to not start on system boot. This single field controls both the runtime state and the start-on-boot behavior of the SSH service. This field is required. root_login Required | Type: boolean SSH root login permission. When set to true, root login via SSH will be permitted. When set to false, root login via SSH will be disabled. This field is required.	9.1.0.0
NSX Edge	PCI;SCG	2606	The component must disable SNMP version 1 & 2 Policy/Audit control. No JSON schema defined in checks.json for ID 2606.	9.1.0.0
NSX Edge	General	2607	Configure LogInsight Servers. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_edge.loginsight_server Assessed Condition: Provide list of LogInsight servers for the NSX-T Edge. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of LogInsight servers servers[].enabled Required | Type: boolean Whether this LogInsight server is enabled servers[].host Required | Type: string | Length: [1, ∞] Hostname or IP address of the destination log server servers[].port Required | Type: integer | Range: [1, 65535] Port number for sending log traffic to the specified host servers[].protocol Required | Type: string | Allowed: ["cfapi", "flatjson", "syslog"] Protocol used for forwarding logs servers[].loglevel Required | Type: string | Allowed: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFO", "DEBUG"] | Default: "INFO" Maximum logging level for log forwarding	9.1.0.0
NSX Edge	General	2608	Validate NTP servers for NSX-T Edge nodes (Compliance only, remediation for NSX cluster is through Manager controller) Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_edge.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
NSX Manager	General	1401	Configure NTP servers for NSX-T Manager nodes Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
NSX Manager	General	2400	Check if NSX Manager FIPS mode is enabled. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.fips_mode Assessed Condition: FIPS mode is disabled on NSX Manager. Setting Fields & Requirements: Field Path Requirements / Specifications Description fips_enabled Required | Type: boolean | Default: true Check if FIPS-validated cryptography is enabled on NSX Manager. NSX Manager has FIPS mode enabled by default. When fips_enabled is set to false, no FIPS mode check is performed and NSX Manager reports as COMPLIANT.	9.1.1.0
NSX Manager	General	2401	Only necessary ports should be listening on NSX manager. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.listening_ports Assessed Condition: Configure allowed_ports with allowed tcp ports. Setting Fields & Requirements: Field Path Requirements / Specifications Description allowed_ports Required | Type: object Allowed listening ports configuration allowed_ports.tcp Optional | Type: array | Default: [22,443,1234,1235,1236,6566,8082,9000,9040] List of allowed TCP ports allowed_ports.tcp[] Optional | Type: integer | Range: [1, 65535] -	9.1.0.0
NSX Manager	General	2402	Allow only default route on BGP peers with ToRs. Severity: Critical  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.allow_only_default_route Assessed Condition: Set to "true" to check that BGP neighbors with in_route_filters only allow default routes (0.0.0.0/0 for IPv4 or ::/0 for IPv6). Setting Fields & Requirements: Field Path Requirements / Specifications Description allow_only_default_route Required | Type: boolean | Default: true Enable checking that BGP neighbors with in_route_filters only allow default routes (0.0.0.0/0 for IPv4 or ::/0 for IPv6) include_filters Optional | Type: array | Default: [] Optional list of filters to include BGP neighbors in the search. Each filter specifies a field name and a list of values. Multiple values for the same field create OR conditions. include_filters[].field_names Required | Type: string Field name to filter on (e.g., 'parent_path', 'neighbor_address') include_filters[].values Required | Type: array List of values to match against the field. Multiple values create OR conditions. include_filters[].values[] Optional | Type: string - exclude_filters Optional | Type: array | Default: [] Optional list of filters to exclude BGP neighbors from the search. Each filter specifies a field name and a list of values. Multiple values for the same field create OR conditions in the exclusion. exclude_filters[].field_names Required | Type: string Field name to filter on (e.g., 'parent_path', 'neighbor_address') exclude_filters[].values Required | Type: array List of values to exclude. Multiple values create OR conditions in the exclusion. exclude_filters[].values[] Optional | Type: string -	9.1.0.0
NSX Manager	General	2403	Configure DNS servers for NSX-T Manager nodes Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of DNS servers servers[] Optional | Type: string | Format: ipv4 IPv4 address of DNS server	9.1.0.0
NSX Manager	General	2404	DNS Forwarder must be disabled on NSX Gateways Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.dns_no_forwarder Assessed Condition: Set to "false" to disable DNS Forwarder. Setting Fields & Requirements: Field Path Requirements / Specifications Description dns_forwarders_disabled Required | Type: boolean | Default: true Whether DNS forwarder functionality is not allowed on NSX Gateways. This is a global NSX level enforcement knob.	9.1.0.0
NSX Manager	General	2405	Manage inactive webui timeout Severity: Critical  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.webui_inactive_timeout Assessed Condition: Set timeout as appropriate for your environment. Default is 1800 seconds. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1800 | Range: [0, 86400] An idle time in seconds before DCUI is automatically logout. Setting 0 disables the timeout	9.1.0.0
NSX Manager	General;PCI;SCG	2406	uRPF mode set to 'STRICT' on Tier-0s, Tier-1s, Segments and VPC Transit Gateway Attachments Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.legitimate_source_address Assessed Condition: Set urpf_mode to "STRICT". Setting Fields & Requirements: Field Path Requirements / Specifications Description urpf_mode Required | Type: string | Allowed: ["STRICT", "NONE"] | Default: "STRICT" uRPF mode setting. Must be 'STRICT' for compliance. scope Optional | Type: array | Default: ["Tier-0s"] Scope for uRPF mode configuration. Can be one or more of: Tier-0s, Tier-1s, Segments, VPC Transit Gateway Attachments. scope[] Optional | Type: string | Allowed: ["Tier-0s", "Tier-1s", "Segments", "VPC Transit Gateway Attachments"] -	9.1.0.0
NSX Manager	General	2407	Only approved local accounts should be present Severity: Warning  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.local_accounts Assessed Condition: Set allowed_accounts to a list of account names. Setting Fields & Requirements: Field Path Requirements / Specifications Description allowed_accounts Required | Type: array List of accounts allowed on NSX Manager nodes. If Manager nodes have unallowed accounts they will be deleted. Creation of new accounts is not supported. Manager node is compliant if it doesn't contain any unallowed accounts. allowed_accounts[] Optional | Type: string | Length: [1, 32] user name	9.1.0.0
NSX Manager	General	2408	Manage NSXT SFTP server desired Config Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.protocol_for_backup_and_restoration Assessed Condition: Set backup_enabled flag. Configure backup_schedule, remote_file_server and inventory_summary_interval options. Setting Fields & Requirements: Field Path Requirements / Specifications Description backup_enabled Required | Type: boolean | Default: true Whether backup is enabled backup_schedule Required | Type: object Backup schedule configuration backup_schedule.resource_type Required | Type: string | Allowed: ["IntervalBackupSchedule"] | Default: "IntervalBackupSchedule" Type of backup schedule backup_schedule.seconds_between_backups Required | Type: integer | Default: 3600 | Range: [300, 86400] Interval between backups in seconds backup_schedule.days_of_week Required | Type: array | Default: [1,3,5] Days of the week for backup (0=Sunday, 1=Monday, ..., 6=Saturday) backup_schedule.days_of_week[] Optional | Type: integer | Range: [0, 6] - backup_schedule.hour_of_day Required | Type: integer | Default: 0 | Range: [0, 23] Hour of day for backup (0-23) backup_schedule.minute_of_day Required | Type: integer | Default: 0 | Range: [0, 59] Minute of day for backup (0-59) remote_file_server Required | Type: object Remote file server configuration for backup remote_file_server.server Required | Type: string | Default: "10.1.2.3" | Format: ipv4 IP address of the SFTP server remote_file_server.port Required | Type: integer | Default: 22 | Range: [1, 65535] Port number for SFTP connection remote_file_server.protocol Required | Type: object Protocol configuration for SFTP remote_file_server.protocol.protocol_name Required | Type: string | Allowed: ["sftp"] | Default: "sftp" Protocol name remote_file_server.protocol.authentication_scheme Required | Type: object Authentication scheme configuration remote_file_server.protocol.authentication_scheme.scheme_name Required | Type: string | Allowed: ["KEY", "PASSWORD"] | Default: "KEY" Authentication scheme type remote_file_server.protocol.authentication_scheme.username Required | Type: string | Default: "admin" | Length: [1, ∞] Username for authentication remote_file_server.directory_path Required | Type: string | Default: "/nsx-backups" | Pattern: ^/.* Directory path on the remote server for backups inventory_summary_interval Required | Type: integer | Default: 300 | Range: [60, 3600] Interval for inventory summary in seconds	9.1.0.0
NSX Manager	General	2409	NSX Manager must securely integrate with vIDM Severity: Critical  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.secure_vidm Assessed Condition: Set enabled flag. Specify tls_protocol_versions. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: false vIDM enabled tls_protocol_versions Optional | Type: array | Default: ["TLSv1.3"] TLS protocol versions tls_protocol_versions[] Optional | Type: string | Allowed: ["TLSv1.0", "TLSv1.1", "TLSv1.2", "TLSv1.3"] -	9.1.0.0
NSX Manager	General	2410	NSX Manager must use valid, non-expired certificates. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.valid_certificates Assessed Condition: All NSX Manager API and VIP certificates must be currently valid (not expired). Setting Fields & Requirements: Field Path Requirements / Specifications Description expired Optional | Type: any | Must equal: false This value must always be false. API and VIP certificates must not be expired.	9.1.1.0
NSX Manager	General	2411	BGP secret set to protect peering between DCF fabric and NSX-T layer Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.secure_bgp Assessed Condition: Set to "true" to check if BGP neighbor passwords are enforced. Setting Fields & Requirements: Field Path Requirements / Specifications Description password_enforced Required | Type: boolean | Default: true Flag to indicate if BGP neighbor passwords are enforced (all neighbors have passwords configured)	9.1.0.0
NSX Manager	General	2412	NSX Components must meet minimum SSH protocol and ssh key_size Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.secure_ssh Assessed Condition: Set protocol_version and host_keys configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Optional | Type: string | Default: "2.0" Required SSH protocol version (e.g., "1.0", "2.0", "1.99") host_keys Optional | Type: array | Default: [{"key_type":"rsa","key_size":2048}] SSH key size requiremetents for different key types host_keys[].key_type Required | Type: string | Allowed: ["rsa", "dsa", "ecdsa", "ed25519"] SSH key type host_keys[].key_size Required | Type: integer | Range: [1, ∞] Minimum required key size in bits	9.1.0.0
NSX Manager	General	2414	Manage webui access security policy Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.webui_secure_access Assessed Condition: Set to minimum TLS version allowed for your environment. Default is "TLSv1.2". Setting Fields & Requirements: Field Path Requirements / Specifications Description minimum_tls_version Required | Type: string | Allowed: ["TLSv1.1", "TLSv1.2", "TLSv1.3"] | Default: "TLSv1.2" Minimum TLS version which should be enabled for WebUI access. All TLS versions equal to and above this version will be enabled. All TLS versions below this version will be disabled.	9.1.0.0
NSX Manager	General	2415	Configure Syslog servers for the NSX-T nodes Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.syslog Assessed Condition: Provide list of syslog servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of syslog servers servers[].host Required | Type: string Hostname or IP address of the destination log server servers[].port Optional | Type: integer | Default: 514 | Range: [1, 65535] Port number for sending log traffic to the specified host. Default is 514 for both TCP and UDP protocols. servers[].protocol Required | Type: string | Allowed: ["TCP", "UDP"] Protocol used for forwarding logs. 'TCP' and 'UDP' forward logs via rsyslog. servers[].facilities Optional | Type: array | Default: ["ALL"] Syslog facility codes. If not specified, all facilities are forwarded. servers[].facilities[] Optional | Type: string | Allowed: ["ALL", "KERN", "USER", "MAIL", "DAEMON", "AUTH", "SYSLOG", "LPR", "NEWS", "UUCP", "AUTHPRIV", "FTP", "LOGALERT", "CRON", "LOCAL0", "LOCAL1", "LOCAL2", "LOCAL3", "LOCAL4", "LOCAL5", "LOCAL6", "LOCAL7"] - servers[].loglevel Optional | Type: string | Allowed: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFO", "DEBUG"] | Default: "INFO" Log level for log forwarding	9.1.0.0
NSX Manager	General	2416	NSX Manager must enforce role-based access control with approved principal-to-role mappings. Severity: Warning  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.rbac_role_mappings Assessed Condition: Set bindings to an array of approved principal-to-role mappings. Set to an empty array to opt out. Setting Fields & Requirements: Field Path Requirements / Specifications Description ignore_system_and_local_accounts Optional | Type: boolean | Default: true When true, system-owned accounts and local-user type bindings are excluded from compliance checking. principal_identity entries are always excluded. bindings Required | Type: array | Default: [] List of approved principal-to-role bindings. An empty array opts out of enforcement and always returns COMPLIANT. bindings[].name Required | Type: string | Length: [1, ∞] Principal name (user login or group name). Compared case-insensitively. bindings[].type Required | Type: string | Allowed: ["USER", "GROUP", "REMOTE"] Principal type. bindings[].roles Required | Type: array NSX Manager roles assigned to the principal. Order is not significant. bindings[].roles[] Optional | Type: string | Length: [1, ∞] - bindings[].identity_source_type Required | Type: string | Allowed: ["LDAP", "LOCAL", "VIDM"] Identity source the principal originates from.	9.1.1.0
NSX Manager	PCI;SCG	2417	WebUI Secure Cipher Suite Policy/Audit control. No JSON schema defined in checks.json for ID 2417.	9.1.0.0
NSX Manager	General;PCI;SCG	2418	The VMware Cloud Foundation NSX Manager must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.password_policy Assessed Condition: lockoutMaxAuthFailures is configured to 3 or fewer and lockoutPeriod is 1800 seconds Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Required | Type: object Represents the lockout constraints of the password policy lockoutConstraint.lockoutMaxAuthFailures Required | Type: number | Default: 3 | Range: [0, 5] Max failed login attempts before lockout lockoutConstraint.lockoutPeriod Required | Type: number | Default: 1800 | Range: [600, 1800] Lockout duration in seconds	9.1.0.0
NSX Manager	PCI;SCG	2419	NSX must not enable DHCP unless it is required DHCP Server Policy/Audit control. No JSON schema defined in checks.json for ID 2419.	9.1.0.0
NSX Manager	PCI;SCG	2420	The VMware Cloud Foundation NSX Manager must configure logging levels to ensure audit records are generated Policy/Audit control. No JSON schema defined in checks.json for ID 2420.	9.1.0.0
NSX Manager	PCI;SCG	2421	NSX must disable Protocol Independent Multicast where multicast is not required Policy/Audit control. No JSON schema defined in checks.json for ID 2421.	9.1.0.0
NSX Manager	General;PCI;SCG	2422	NSX must enable OSPF encryption Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.nsxt_manager.secure_ospf Assessed Condition: All OSPF areas must have MD5 authentication mode configured. Non-compliant if any OSPF area exists without MD5 authentication. Setting Fields & Requirements: Field Path Requirements / Specifications Description md5_auth_enforced Required | Type: boolean | Default: true Flag to indicate if OSPF MD5 encryption is enforced (all areas have MD5 authentication mode configured). If md5_auth_enforced is false, then OSPF MD5 encryption is not mandated.	9.1.0.0
NSX Manager	General;PCI;SCG	2423	The VMware Cloud Foundation NSX Manager must enforce minimum password standards Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.password_policy Assessed Condition: minLength is 12 or greater and minLowercase, minUppercase, minNumeric, minSpecial are each 1 or greater Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Required | Type: object Represents the complexity constraints of the password policy complexityConstraint.minLength Required | Type: number | Default: 12 | Range: [12, 64] Password minimum length complexityConstraint.minLowercase Required | Type: number | Default: 1 | Range: [1, 10] Password minimum lowercase character count complexityConstraint.minUppercase Required | Type: number | Default: 1 | Range: [1, 10] Password minimum uppercase character count complexityConstraint.minNumeric Required | Type: number | Default: 1 | Range: [1, 10] Password minimum numeric character count complexityConstraint.minSpecial Required | Type: number | Default: 1 | Range: [0, 10] The minimum special characters to be included complexityConstraint.passwordHistory Required | Type: number | Default: 5 | Range: [0, 10] Password reuse count	9.1.0.0
NSX Manager	General	2424	NSX Manager local accounts must have a configurable maximum password age Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.password_policy Assessed Condition: passwordExpirationDays is configured to 120 days or fewer Setting Fields & Requirements: Field Path Requirements / Specifications Description expirationConstraint Required | Type: object - expirationConstraint.passwordExpirationDays Required | Type: number | Default: 120 | Range: [30, 730] Max password lifetime in days	9.1.1.0
NSX Manager	PCI;SCG	2425	The component must disable SNMP version 1 & 2 Policy/Audit control. No JSON schema defined in checks.json for ID 2425.	9.1.0.0
NSX Manager	General;PCI;SCG	2426	NSX Manager nodes should have SSH service deactivated Severity: Critical  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.ssh_access_config Assessed Condition: Set ssh_enabled to "false" to disable SSH service (stops service and disables start-on-boot) and root_login to "false" to disable root SSH access on NSX Manager. Setting Fields & Requirements: Field Path Requirements / Specifications Description ssh_enabled Required | Type: boolean SSH service availability control. When set to true, the SSH service will be started (if not already running) and configured to start automatically on system boot. When set to false, the SSH service will be stopped (if currently running) and configured to not start on system boot. This single field controls both the runtime state and the start-on-boot behavior of the SSH service. This field is required. root_login Required | Type: boolean SSH root login permission. When set to true, root login via SSH will be permitted. When set to false, root login via SSH will be disabled. This field is required.	9.1.0.0
NSX Manager	PCI;SCG	2427	UI Login Banner Message Policy/Audit control. No JSON schema defined in checks.json for ID 2427.	9.1.0.0
NSX Manager	PCI;SCG	2428	NSX Manager must display a SSH Login Banner Message during user login Policy/Audit control. No JSON schema defined in checks.json for ID 2428.	9.1.0.0
NSX Manager	PCI;SCG	2429	NSX must not enable DHCP unless it is required - DHCP Relay Policy/Audit control. No JSON schema defined in checks.json for ID 2429.	9.1.0.0
NSX Manager	General	2430	Configure LogInsight Servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.nsxt_manager.loginsight_server Assessed Condition: Provide list of LogInsight servers for the NSX-T Manager. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array List of LogInsight servers servers[].enabled Required | Type: boolean Whether this LogInsight server is enabled servers[].host Required | Type: string | Length: [1, ∞] Hostname or IP address of the destination log server servers[].port Required | Type: integer | Range: [1, 65535] Port number for sending log traffic to the specified host servers[].protocol Required | Type: string | Allowed: ["cfapi", "flatjson", "syslog"] Protocol used for forwarding logs servers[].loglevel Required | Type: string | Allowed: ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING", "NOTICE", "INFO", "DEBUG"] | Default: "INFO" Maximum logging level for log forwarding	9.1.0.0
SDDC Manager	General	1600	Verify SDDC Manager backup. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.sddc_manager.backup Assessed Condition: Provide backup location and schedule configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description backup_locations Required | Type: array Backup Server for SDDC Manager and NSX Manager backup_locations[].server Required | Type: string - backup_locations[].username Required | Type: string - backup_locations[].directory_path Required | Type: string - backup_schedules Required | Type: array Valid backup schedule for SDDC Manager backup_schedules[].resource_type Required | Type: string - backup_schedules[].take_scheduled_backups Required | Type: boolean - backup_schedules[].frequency Required | Type: any | Allowed: ["WEEKLY", "HOURLY"] - backup_schedules[].days_of_week Required | Type: array - backup_schedules[].days_of_week[] Optional | Type: string | Allowed: ["SUNDAY", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY"] - backup_schedules[].hour_of_day Required | Type: number | Range: [0, 23] - backup_schedules[].minute_of_hour Required | Type: number | Range: [0, 59] - backup_schedules[].take_backup_on_state_change Required | Type: boolean - backup_schedules[].retention_policy Required | Type: object Retention policy backup_schedules[].retention_policy.number_of_most_recent_backups Required | Type: number - backup_schedules[].retention_policy.number_of_days_of_hourly_backups Required | Type: number - backup_schedules[].retention_policy.number_of_days_of_daily_backups Required | Type: number -	9.1.0.0
SDDC Manager	General	1601	SDDC Manager components must use an authoritative time source [NTP] Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.sddc_manager.ntp Assessed Condition: Provide a list of NTP servers. Set is_local to "false" to propagate NTP configuration to all VCF components. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string - is_local Required | Type: boolean | Default: true Configure ntp only on SDDC-manager if flag is true. Else, propagate ntp configuration to all VCF components	9.1.0.0
SDDC Manager	General	1603	Use an SSL certificate issued by a trusted certificate authority on the SDDC Manager. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.sddc_manager.cert_config Assessed Condition: Provide certificate issuer details. Setting Fields & Requirements: Field Path Requirements / Specifications Description certificate_issuer Required | Type: array - certificate_issuer[] Optional | Type: string Certificate issuer details. Example input: OU=VMware Engineering,O=vcenter.vsphere.local,ST=California,C=US,DC=local,DC=vsphere,CN=CB	9.1.0.0
SDDC Manager	General	1604	Enable/Disable lcm proxy configuration Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.sddc_manager.proxy_config Assessed Condition: Set to "false" to disable lcm proxy. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Must equal: false | Default: false proxy enable flag	9.1.0.0
SDDC Manager	General	1605	Assign least privileges to users and service accounts in SDDC Manager. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.sddc_manager.users_groups_roles Assessed Condition: Provide name, type, and role for each user or group. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].name Required | Type: string - value[].type Required | Type: string | Allowed: ["USER", "GROUP"] - value[].role Required | Type: string | Allowed: ["ADMIN", "OPERATOR", "VIEWER"] -	9.1.0.0
SDDC Manager		1607	Dedicate an account for downloading updates and patches in SDDC Manager. Policy/Audit control. No JSON schema defined in checks.json for ID 1607.	9.1.0.0
SDDC Manager	General	1608	SDDC Manager must be deployed with FIPS mode enabled Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.sddc_manager.fips_mode_enabled Assessed Condition: If set to "true", a non-compliant status will be returned if FIPS is not enabled. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false FIPS mode enablement status	9.1.0.0
SDDC Manager	General	1609	SDDC Manager must schedule automatic password rotation. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.sddc_manager.credential_auto_rotate_policy Assessed Condition: Set number of days for rotate schedule. Default is 60. Setting Fields & Requirements: Field Path Requirements / Specifications Description frequency Required | Type: number | Default: 60 Number of days to be configured as auto rotate schedule	9.1.0.0
SDDC Manager	General	1612	DNS should be configured to a global value that is enforced by SDDC Manager Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.sddc_manager.dns Assessed Condition: Provide list of DNS servers. Set is_local to "false" to propagate DNS configuration to all VCF components. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string - is_local Optional | Type: boolean | Default: true Configure dns only on SDDC-manager if flag is true. Else, propagate dns configuration to all VCF components	9.1.0.0
SDDC Manager	General	1613	sddc manager SYSLOG control. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.sddc_manager.syslog Assessed Condition: Set hostname, port and protocol and related ssh options. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of syslog servers servers[].hostname Required | Type: string - servers[].port Required | Type: number | Default: 9543 - servers[].protocol Required | Type: any | Allowed: ["HTTP", "HTTPS", "CFAPI", "SYSLOG", "SYSLOG_UDP"] | Default: "CFAPI" - servers[].ssl Optional | Type: boolean | Default: true - servers[].ssl_cert Optional | Type: string - servers[].ssl_accept_any Optional | Type: boolean | Default: false - servers[].central_config Optional | Type: boolean | Default: true -	9.1.0.0
SDDC Manager	PCI;SCG	1614	SDDC Manager local administrator account configuration status Policy/Audit control. No JSON schema defined in checks.json for ID 1614.	9.1.0.0
vCenter	General	402	The vCenter Server must configure Network I/O Control (NIOC) per cluster type using vCenter tag-based detection in VCF environments. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.dvs_nioc_cluster_tag Assessed Condition: NIOC enabled for management/tenant/micro clusters; disabled for edge clusters. Setting Fields & Requirements: Field Path Requirements / Specifications Description network_io_control_status Required | Type: array | Default: [{"cluster_tag":"cluster_type","tag_value":"edge","network_io_control_status":false},{"cluster_tag":"cluster_type","tag_value":"management","network_io_control_status":true},{"cluster_tag":"cluster_type","tag_value":"tenant","network_io_control_status":true},{"cluster_tag":"cluster_type","tag_value":"micro","network_io_control_status":true}] List of desired NIOC states per cluster tag value. network_io_control_status[].cluster_tag Required | Type: string vCenter tag category name used to identify cluster type. network_io_control_status[].tag_value Required | Type: string Tag value identifying the cluster type (e.g. edge, management, tenant, micro). network_io_control_status[].network_io_control_status Required | Type: boolean Enable/Disable Network I/O control for clusters with this tag.	9.1.1.0
vCenter	General;PCI;SCG	403	The vCenter Server must prohibit password reuse. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_reuse_restriction Assessed Condition: Set password history. Default is 5. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 5 Password reuse count	9.1.0.0
vCenter	General;PCI;SCG	404	The vCenter Server must produce audit records containing information to establish what type of events occurred. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vpx_log_level_config Assessed Condition: Setting log level to "info" or "verbose" is recommended. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: any | Allowed: ["none", "error", "warning", "info", "verbose", "trivia"] | Default: "verbose" VPX logging level	9.1.0.0
vCenter	General;PCI;SCG	405	The vCenter Server must set the distributed port group Promiscuous Mode policy to reject. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvpg_promiscuous_mode_policy Assessed Condition: Set to "false" to reject guest promiscuous mode requests. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration to enable/disable Promiscuous mode policy for dv port groups. __GLOBAL__.promiscuous_mode Required | Type: boolean | Default: false Promiscuous mode policy for dv port groups. __OVERRIDES__ Optional | Type: array Overrides for enabling/disabling Promiscuous mode policy for one or more port groups. __OVERRIDES__[].switch_name Required | Type: string - __OVERRIDES__[].port_group_name Required | Type: string - __OVERRIDES__[].promiscuous_mode Required | Type: boolean - ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	General	406	vCenter Server plugins must be verified. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.plugin_config Assessed Condition: Set id, vendor, type, and versions for each plugin configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description plugins Optional | Type: array vCenter server client plugin configuration plugins[].id Required | Type: string client plugin id plugins[].vendor Required | Type: string plugin vendor name plugins[].type Required | Type: string | Allowed: ["LOCAL", "REMOTE", "HYBRID"] client plugin type, local or remote plugins[].versions Optional | Type: array client plugin versions, at least one version should be provided plugins[].versions[] Optional | Type: string client plugin version exclude_plugins Optional | Type: array - exclude_plugins[] Optional | Type: string A list of plugin ids to exclude plugins from compliance check and remediation	9.1.0.0
vCenter	General;PCI;SCG	407	The vCenter Server must set the distributed port group MAC Address Change policy to reject. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvpg_mac_address_change_policy Assessed Condition: Set to "false" to reject MAC address changes. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration to enable/disable MAC address change policy for dv port groups. __GLOBAL__.allow_mac_address_change Required | Type: boolean | Default: false MAC address change policy for dv port groups. __OVERRIDES__ Optional | Type: array Overrides for enabling/disabling MAC address change policy for one or more port groups. __OVERRIDES__[].switch_name Required | Type: string - __OVERRIDES__[].port_group_name Required | Type: string - __OVERRIDES__[].allow_mac_address_change Required | Type: boolean - ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	General;PCI;SCG	408	The vCenter Server passwords must meet minimum uppercase character policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_min_uppercase_characters Assessed Condition: Set minimum uppercase character count to at least 1. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 Password minimum uppercase character count	9.1.0.0
vCenter	General;PCI;SCG	409	The vCenter Server must manage excessive bandwidth and Denial of Service (DoS) attacks by enabling Network I/O Control (NIOC). Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvs_network_io_control Assessed Condition: Set to "true" to enable NIOC. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration for enabling/disabling Network I/O control for DV switches. __GLOBAL__.network_io_control_status Required | Type: boolean | Default: false Enable/Disable Network I/O control. __OVERRIDES__ Optional | Type: array Overrides for enabling/disabling Network I/O control on one or more switches. __OVERRIDES__[].switch_name Required | Type: string Switch name to update health check config. __OVERRIDES__[].network_io_control_status Required | Type: boolean Enable/Disable Network I/O control. ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	General	410	The vCenter Server passwords must meet minimum password length policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_minimum_length Assessed Condition: Configure minimum password length. Default is 10 characters. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 10 Password minimum length	9.1.0.0
vCenter	General;PCI;SCG	413	The vCenter Server passwords must must meet minimum lowercase character policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_min_lowercase_characters Assessed Condition: Set minimum lowercase character count to at least 1. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 Password minimum lowercase character count	9.1.0.0
vCenter	General	415	The vCenter Server users must have the correct roles assigned. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.users_groups_roles Assessed Condition: Specify name, type, role, and propagate flag for each entry. Setting Fields & Requirements: Field Path Requirements / Specifications Description global Optional | Type: array A list of global permissions with four keys - name, type, role and propagate flag global[].name Required | Type: string User or group name global[].type Required | Type: any | Allowed: ["USER", "GROUP"] Type to denote its a user or a group global[].role Required | Type: string Role name global[].propagate Required | Type: boolean propagate flag, if set to true, permission will be propagated to all vcenters and its sub entities vcenter Optional | Type: array A list of vcenter local permissions with four keys - name, type, role and propagate flag vcenter[].name Required | Type: string User or group name vcenter[].type Required | Type: any | Allowed: ["USER", "GROUP"] Type to denote its a user or a group vcenter[].role Required | Type: string Role name vcenter[].propagate Required | Type: boolean propagate flag, if set to true, the permission will be propagated to all entities under this vcenter exclude_user_patterns Optional | Type: array - exclude_user_patterns[] Optional | Type: string User defined patterns to exclude users from compliance check and remediation	9.1.0.0
vCenter	General;PCI;SCG	417	The vCenter Server must only send NetFlow traffic to authorized collectors. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvs_pg_netflow_config Assessed Condition: Configure NetFlow as appropriate to your environment. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration settings applicable for all dvs and port groups __GLOBAL__.ipfix_collector_ip Required | Type: string netflow collector ip address on distributed virtual switch __GLOBAL__.ipfix_enabled Required | Type: boolean | Default: false netflow enabled flag on portgroup __OVERRIDES__ Optional | Type: object - __OVERRIDES__.switch_override_config Optional | Type: array Object to hold overrides for distributed switch __OVERRIDES__.switch_override_config[].switch_name Required | Type: string - __OVERRIDES__.switch_override_config[].ipfix_collector_ip Required | Type: string - __OVERRIDES__.portgroup_override_config Optional | Type: array Object to hold overrides for the port groups __OVERRIDES__.portgroup_override_config[].switch_name Required | Type: string - __OVERRIDES__.portgroup_override_config[].port_group_name Required | Type: string - __OVERRIDES__.portgroup_override_config[].ipfix_enabled Required | Type: boolean - ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	General	418	Configure a proxy for the download of the public Hardware Compatibility List. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.vsan_proxy Assessed Condition: Provide internet_access_enabled, host, port, and user. Setting Fields & Requirements: Field Path Requirements / Specifications Description internet_access_enabled Required | Type: boolean Flag to set proxy internet access host Required | Type: string Proxy server host name port Required | Type: number Port number for proxy user Required | Type: string Proxy user	9.1.0.0
vCenter	General	420	The vCenter Server must configure the vSAN Datastore name to a unique name. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.vsan_datastore_naming_policy Assessed Condition: Set to "true" to ensure vSAND Datastore name is unique. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Must equal: true | Default: true Specify name uniqueness enforcement for vSAN datastores. When set to true (the only allowed value), the audit process flags a datastore as non-compliant only if its name is 'vsanDatastore.' No other names are checked for compliance.	9.1.0.0
vCenter	General;PCI;SCG	421	The vCenter server passwords should meet max password lifetime policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_max_lifetime Assessed Condition: Configure maximum password age as appropriate to your environment. Default is 90 days. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 90 Max password lifetime in days	9.1.0.0
vCenter	General;PCI;SCG	422	The vCenter Server must terminate management sessions after certain period of inactivity. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.h5_client_session_timeout Assessed Condition: Set session timeout. Default is 10 minutes. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 10 Session timeout in minutes for vCenter H5 Client	9.1.0.0
vCenter	General;PCI;SCG	427	The vCenter Server must configure the vpxuser host password meets length policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vpx_host_password_length_policy Assessed Condition: Set to 32 characters or more. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 33 | Range: [32, ∞] VPX User host password length policy	9.1.0.0
vCenter	General;PCI;SCG	428	The vCenter Server must configure the vpxuser auto-password to be changed periodically. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vpx_password_expiration_policy Assessed Condition: Set password expiration. Default is 31 days. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 31 VPX User password expiration policy in days.	9.1.0.0
vCenter	General;PCI;SCG	432	The vCenter Server passwords must meet minimum special character policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_min_special_characters Assessed Condition: Set minimum special character count. Default is 1. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 | Range: [1, ∞] Password minimum special character count	9.1.0.0
vCenter	General;PCI;SCG	433	The vCenter Server passwords must meet minimum numeric character policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_password_min_numeric_characters Assessed Condition: Set minimum numeric character count to at least 1. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 1 Password minimum numeric character count	9.1.0.0
vCenter	General	434	The vCenter server should meet failed login attempts interval. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_failed_login_attempts_interval Assessed Condition: Set SSO failed login attempt interval. Default is 280 seconds. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 280 SSO failed login attempt interval in seconds	9.1.0.0
vCenter	General;PCI;SCG	435	The vCenter server passwords should meet max auto unlock interval policy. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_auto_unlock_interval Assessed Condition: Set SSO auto unlock value. Default is 300 seconds. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 300 SSO auto unlock interval in seconds	9.1.0.0
vCenter	General;PCI;SCG	436	The vCenter server should meet max failed login attempts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_max_failed_login_attempts Assessed Condition: Set max failed login attempts. Default is 6. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: number | Default: 6 Max failed login attempts	9.1.0.0
vCenter	General;PCI;SCG	450	The vCenter Server must set the distributed port group Forged Transmits policy to reject. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvpg_forged_transmits_policy Assessed Condition: Set allow_forged_transmits to "false" to reject forged transmits. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration to enable/disable Forged Transmits policy for dv port groups. __GLOBAL__.allow_forged_transmits Required | Type: boolean | Default: false Forged Transmits policy for dv port groups. __OVERRIDES__ Optional | Type: array Overrides for enabling/disabling Forged Transmits policy for one or more port groups. __OVERRIDES__[].switch_name Required | Type: string - __OVERRIDES__[].port_group_name Required | Type: string - __OVERRIDES__[].allow_forged_transmits Required | Type: boolean - ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	PCI;SCG	1165	The vCenter Server must reset port configuration when virtual machines are disconnected. Policy/Audit control. No JSON schema defined in checks.json for ID 1165.	9.1.0.0
vCenter	PCI;SCG	1166	The vCenter server must disable SNMPv1/2 receivers. Policy/Audit control. No JSON schema defined in checks.json for ID 1166.	9.1.0.0
vCenter	PCI;SCG	1167	VMware vCenter must enable Distributed Resource Scheduler with fully automated behavior for clusters Policy/Audit control. No JSON schema defined in checks.json for ID 1167.	9.1.0.0
vCenter	PCI;SCG	1168	Content libraries must have authentication method configured. Policy/Audit control. No JSON schema defined in checks.json for ID 1168.	9.1.0.0
vCenter	PCI;SCG	1169	Content libraries must have security policy configured. Policy/Audit control. No JSON schema defined in checks.json for ID 1169.	9.1.0.0
vCenter	General	1200	The vCenter Server must disable the distributed virtual switch health check. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dvs_health_check Assessed Condition: Set to "true" to enable DV switches health check. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration to enable/disable Health check for DV switches. __GLOBAL__.health_check_enabled Required | Type: boolean | Default: true Switch health check enablement status __OVERRIDES__ Optional | Type: array Overrides for enabling/disabling health checks on one or more switches. __OVERRIDES__[].switch_name Required | Type: string Switch name to update health check config. __OVERRIDES__[].health_check_enabled Required | Type: boolean - ignore_disconnected_hosts Optional | Type: boolean | Default: false ignore disconnected hosts caused exceptions. ignore_host_exception Optional | Type: boolean | Default: false ignore all host caused exceptions.	9.1.0.0
vCenter	General	1201	Configure all port groups to a value different from the value of the native VLAN. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.dvpg_excluded_native_vlan_policy Assessed Condition: Set to native VLAN ID to be excluded from port group configurations. Setting Fields & Requirements: Field Path Requirements / Specifications Description native_vlan_id_to_exclude Required | Type: number | Range: [0, 4096] Native VLAN ID to be excluded from port group configurations.	9.1.0.0
vCenter	General	1202	Configure all port groups to VLAN values not reserved by upstream physical switches. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.dvpg_excluded_reserved_vlan_policy Assessed Condition: Specify VLAN IDs to be excluded from port group configurations. Setting Fields & Requirements: Field Path Requirements / Specifications Description reserved_vlan_ids_to_exclude Optional | Type: array Reserved VLAN IDs to be excluded from port group configurations. Example inputs: {'start':30,'end':35}, 100 reserved_vlan_ids_to_exclude[] Optional | Type: integer | Range: [0, 4094] - reserved_vlan_ids_to_exclude[].start Required | Type: number | Range: [0, 4094] Start VLAN id in allowed vlans. reserved_vlan_ids_to_exclude[].end Required | Type: number | Range: [0, 4094] End VLAN id in allowed vlans.	9.1.0.0
vCenter	General	1204	The vCenter Server must enable TLS 1.2 exclusively. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.tls_version Assessed Condition: Set to TLSv1.2. Setting Fields & Requirements: Field Path Requirements / Specifications Description global Required | Type: array | Default: ["TLSv1.2"] Global TLS versions applicable for all services. Individual services can override these versions. global[] Optional | Type: string | Allowed: ["TLSv1.0", "TLSv1.1", "TLSv1.2", "TLSv1.3"] -	9.1.0.0
vCenter	General	1205	The vCenter Server Machine SSL certificate must be issued by an appropriate certificate authority Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.cert_config Assessed Condition: Set certificate_issuer to certificate issuer details. Setting Fields & Requirements: Field Path Requirements / Specifications Description certificate_issuer Required | Type: array - certificate_issuer[] Optional | Type: string Certificate issuer details. Example input: OU=VMware Engineering,O=vcenter.vsphere.local,ST=California,C=US,DC=local,DC=vsphere,CN=CB	9.1.0.0
vCenter	General;PCI;SCG	1209	Configure a logon message Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.logon_banner_config Assessed Condition: Enable a login message to inform users about system use obligations. Setting Fields & Requirements: Field Path Requirements / Specifications Description logon_banner_title Required | Type: string | Default: "vCenter Server Managed by SDDC Manager" Logon Banner Title. Example input: vCenter Server Managed by SDDC Manager logon_banner_content Required | Type: string | Default: "This vCenter Server is managed by SDDC Manager.\nMaking modifications directly in vCenter Server may break SDDC Manager workflows.\nPlease consult the product documentation before making changes through the vSphere Client." Logon Banner Content. Example input: This vCenter Server is managed by SDDC Manager (sddc-manager.vrack.vsphere.local)... checkbox_enabled Required | Type: boolean | Default: true Checkbox enabled. Example input: true	9.1.0.0
vCenter	General	1212	Configure Mutual CHAP for vSAN iSCSI targets Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.vsan_iscsi_targets_mutual_chap_config Assessed Condition: Set to "CHAP_Mutual" to configure mutual CHAP. Setting Fields & Requirements: Field Path Requirements / Specifications Description global Optional | Type: any | Allowed: ["CHAP_Mutual", "CHAP", "NoAuth"] | Default: "CHAP_Mutual" vSan iSCSI targets global level authentication type	9.1.0.0
vCenter	General;PCI;SCG	1216	vCenter must limit membership to the SystemConfiguration.BashShellAdministrators SSO group. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.sso_bash_shell_authorized_members Assessed Condition: Configure members of the "SystemConfiguration.BashShellAdministrators" SSO group. Setting Fields & Requirements: Field Path Requirements / Specifications Description members Required | Type: array List of users and groups in SystemConfiguration.BashShellAdministrators SSO group. members[].name Required | Type: string User or group name. members[].domain Required | Type: string Domain name. members[].member_type Required | Type: any | Allowed: ["USER", "GROUP"] Type to denote a user or a group exclude_user_patterns Optional | Type: array - exclude_user_patterns[] Optional | Type: string User defined patterns to exclude users (by user or group name) from compliance check	9.1.0.0
vCenter	General	1217	vCenter must limit membership to the TrustedAdmins SSO group. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.sso_trusted_admin_authorized_members Assessed Condition: Provide list of users and groups in TrustedAdmins SSO group. Setting Fields & Requirements: Field Path Requirements / Specifications Description members Required | Type: array List of users and groups in TrustedAdmins SSO group. members[].name Required | Type: string User or group name. members[].domain Required | Type: string Domain name. members[].member_type Required | Type: any | Allowed: ["USER", "GROUP"] Type to denote a user or a group exclude_user_patterns Optional | Type: array - exclude_user_patterns[] Optional | Type: string User defined patterns to exclude users from compliance check	9.1.0.0
vCenter	General;PCI;SCG	1218	The vCenter Server must be configured to send logs to a central log server. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.syslog Assessed Condition: Configure remote log server as appropriate to your environment. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of syslog servers servers[].hostname Required | Type: string - servers[].port Required | Type: number - servers[].protocol Required | Type: any | Allowed: ["TLS", "UDP", "RELP", "TCP"] -	9.1.0.0
vCenter	General;PCI;SCG	1219	Configure an alert to the appropriate personnel about SSO account actions. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.alarm_sso_account_actions Assessed Condition: To ensure the appropriate personnel are alerted about SSO account actions, create a new vCenter alarm for the "com.vmware.sso.PrincipalManagement" event ID and configure the alert mechanisms appropriately. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].alarm_name Required | Type: string | Length: [1, ∞] Name of the alarm which is unique within a vCenter. value[].alarm_description Required | Type: string Description of the alarm. value[].enabled Required | Type: boolean Flag to enable or disable alarm. value[].target_type Required | Type: string | Allowed: ["VCENTER", "HOSTS", "CLUSTERS", "DATACENTERS", "DATASTORES", "DISTRIBUTED_SWITCHES", "DISTRIBUTED_PORT_GROUPS", "VIRTUAL_MACHINES", "CLUSTER_DATASTORES"] The target for the alarm action. value[].rule_expressions Required | Type: array Defines the event, condition, or state that triggers the alarm and defines the notification severity. value[].rule_expressions[].event_type_id Required | Type: string Event Type value[].rule_expressions[].state Required | Type: any | Allowed: ["NO_CHANGE", "NORMAL", "WARNING", "CRITICAL"] Green to reset, yellow for warning, red for critical and no_change for keeping the current state value[].rule_expressions[].comparisons Optional | Type: array List of additional arguments to be satisfied to trigger alarm, an argument is made from an attribute, operator and value. value[].rule_expressions[].comparisons[].attribute Required | Type: string - value[].rule_expressions[].comparisons[].operator Required | Type: any | Allowed: ["equals", "notEqualTo", "startsWith", "doesNotStartWith", "endsWith", "doesNotEndWith"] - value[].rule_expressions[].comparisons[].value Required | Type: string - value[].alarm_actions Optional | Type: array List of actions - sending email, sending snmp traps or running scripts and state causing these actions value[].alarm_actions[].state Required | Type: string | Allowed: ["WARNING", "CRITICAL", "NORMAL", "NO_CHANGE"] The state for which the alarm action is to be taken. value[].alarm_actions[].action_type Required | Type: string | Allowed: ["EMAIL", "SNMP", "SCRIPT"] The type of the action to be taken. value[].alarm_actions[].repeats Required | Type: boolean Action to be repeated based on configured action frequency time value[].alarm_actions[].email Optional | Type: object Send email when alarm is triggered with warning. value[].alarm_actions[].email.subject Required | Type: string Subject of the email value[].alarm_actions[].email.to_list Required | Type: string Emails separated by comma. value[].alarm_actions[].email.cc_list Required | Type: string Emails separated by comma. value[].alarm_actions[].email.body Required | Type: string Body of the email value[].alarm_actions[].script Optional | Type: object - value[].alarm_actions[].script.script_name Required | Type: string Script to run alarm is triggered with warning. value[].action_frequency Optional | Type: number Frequency (in minutes) to repeat actions until acknowledged or reset to green	9.1.0.0
vCenter	General	1220	The vCenter Server configuration must be backed up on a regular basis. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.backup_schedule_config Assessed Condition: Define backup configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description backup_schedule_name Required | Type: string | Length: [1, ∞] Name for the backup schedule. enable_backup_schedule Required | Type: boolean Enable or disable the backup schedule. backup_location_url Required | Type: string URL of the backup location. Supported protocols: nfs, sftp, ftps, https, ftp, smb, http. Example: sftp://10.0.0.250:/root/backups or nfs://10.0.0.250/root/backups backup_server_username Optional | Type: string Username for accessing the backup server. If unset authentication will not be used for the specified location. backup_parts Optional | Type: array | Default: ["seat","common"] - backup_parts[] Optional | Type: string | Allowed: ["seat", "common", "supervisors"] Specifies the parts of the backup to be included. Choose from 'seat' to include stats, events, and tasks, or 'common' to include only inventory and configuration data. recurrence_info Required | Type: object - recurrence_info.recurrence_type Required | Type: any | Default: "DAILY" - recurrence_info.days Required | Type: any - retention_info Optional | Type: object Retention information for the backup schedule. retention_info.max_count Required | Type: number | Range: [1, ∞] Number of backups to be retained. If retention is not set, all backups will be retained forever.	9.1.0.0
vCenter	General;PCI;SCG	1221	The vCenter Server must be configured to send events to a central log server. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vpx_syslog_enablement_policy Assessed Condition: Set to "true" to enable remote logging. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: false VPX Syslog enablement policy	9.1.0.0
vCenter	General;PCI;SCG	1222	The vCenter server must enforce SNMPv3 security features where SNMP is required. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.snmp_v3 Assessed Condition: Set enable to "true" if SNMP is required. Provide SNMP security features. If SNMP is not required, set enable to "false". Setting Fields & Requirements: Field Path Requirements / Specifications Description enable Required | Type: boolean Flag that denotes if SNMP is enabled or disabled privacy Required | Type: any | Allowed: ["none", "AES128", "AES192", "AES256"] Privacy algorithm to be used by SNMP authentication Required | Type: any | Allowed: ["none", "SHA1", "SHA256", "SHA384", "SHA512"] Authentication algorithm to be used by SNMP	9.1.0.0
vCenter	General	1225	Isolate all IP-based storage traffic on distributed switches from other traffic types Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.ip_based_storage_port_group_config Assessed Condition: Provide VLAN configuration settings. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration settings applicable for all ip storage dv port groups __GLOBAL__.is_dedicated_vlan Required | Type: boolean | Default: false Flag to check if vlan is isolated for ip based storage portgroups __GLOBAL__.allow_mix_traffic_type Optional | Type: boolean | Default: true Flag to check if allow ip based storage traffic such as iSCSI traffic to go through non-vsan portgroups such as management traffic portgroups __OVERRIDES__ Optional | Type: array Object to hold overrides for the port groups __OVERRIDES__[].switch_name Required | Type: string - __OVERRIDES__[].port_group_name Required | Type: string - __OVERRIDES__[].is_dedicated_vlan Required | Type: boolean - __OVERRIDES__[].allow_mix_traffic_type Optional | Type: boolean Flag to check if allow ip based storage traffic such as iSCSI traffic to go through non-vsan portgroups such as management traffic portgroups	9.1.0.0
vCenter	General;PCI;SCG	1226	vCenter task and event retention must be set to a defined number of days. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.task_and_event_retention Assessed Condition: Set max and event ages. Default is 33 days. Setting Fields & Requirements: Field Path Requirements / Specifications Description task_cleanup_enabled Required | Type: boolean | Default: true Enable/Disable task cleanup. task_max_age Required | Type: number | Default: 33 Max age for tasks in days. event_cleanup_enabled Required | Type: boolean | Default: true Enable/Disable event cleanup. event_max_age Required | Type: number | Default: 33 Max age for events in days.	9.1.0.0
vCenter	General;PCI;SCG	1227	The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.dvpg_vlan_trunking_authorized_check Assessed Condition: No VLANS should be tagged with 4095. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].switch_name Required | Type: string - value[].port_group_name Required | Type: string - value[].vlan_info Required | Type: object - value[].vlan_info.vlan_ranges Required | Type: array - value[].vlan_info.vlan_ranges[].start Required | Type: number | Range: [0, 4094] Start VLAN id in allowed vlans. value[].vlan_info.vlan_ranges[].end Required | Type: number | Range: [0, 4094] End VLAN id in allowed vlans. value[].vlan_info.vlan_type Required | Type: string | Must equal: "VLAN trunking" -	9.1.0.0
vCenter	General	1228	The vCenter Server must implement Active Directory authentication. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.active_directory_authentication Assessed Condition: Set to "true" to use AD authentication. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Must equal: true | Default: true Ensure that Active Directory authentication is strictly enforced for vCenter logins. The default and only allowed value is True.	9.1.0.0
vCenter	General	1229	The vCenter Server must use LDAPS when adding an SSO identity source. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.active_directory_ldaps_enabled Assessed Condition: Set to "true" to use LDAPS. Setting Fields & Requirements: Field Path Requirements / Specifications Description use_ldaps Optional | Type: boolean | Must equal: true | Default: true Require the usage of the LDAPS protocol for all Active Directory Servers added as identity sources. The default and only allowed value is True.	9.1.0.0
vCenter	General	1230	The vCenter Server must use a limited privilege account when adding an LDAP identity source. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.ldap_identity_source_config Assessed Condition: Provide username and domain for LDAP. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].username Required | Type: string - value[].domain Required | Type: string -	9.1.0.0
vCenter	General;PCI;SCG	1246	The system must configure NTP time synchronization. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.ntp Assessed Condition: The recommended practice for NTP is to have at least four sources. It is not advisable to have only two sources; one source is preferable to having two. Setting Fields & Requirements: Field Path Requirements / Specifications Description mode Optional | Type: any | Allowed: ["DISABLED", "NTP", "HOST"] NTP mode servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
vCenter	General	1271	DNS should be configured to a global value that is enforced by vCenter. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.dns Assessed Condition: Set DNS mode. Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description mode Optional | Type: any | Allowed: ["dhcp", "is_static"] DNS mode servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.0.0
vCenter	General;PCI;SCG	2025	Vcenter must disable ssh Policy/Audit control. No JSON schema defined in checks.json for ID 2025.	9.1.0.0
vCenter	General	2100	The vCenter Server must disable the managed object browser (MOB) at all times when not required for troubleshooting or maintenance of managed objects Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.managed_object_browser Assessed Condition: Set to "true" to disable the managed object browser. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: boolean | Default: true Flag to enable/disable the managed object browser (MOB)	9.1.0.0
vCenter	General	2101	All vMotion traffic on distributed switches must be isolated from other traffic types. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcenter.dvpg_vmotion_traffic_isolation Assessed Condition: Set to "true" check if VLAN is isolated. Setting Fields & Requirements: Field Path Requirements / Specifications Description __GLOBAL__ Required | Type: object Global configuration settings applicable for all dv port vmotion groups __GLOBAL__.is_dedicated_vlan Required | Type: boolean | Default: true Flag to check if vlan is isolated for all vmotion portgroups __OVERRIDES__ Optional | Type: array Object to hold overrides for the port groups __OVERRIDES__[].switch_name Required | Type: string - __OVERRIDES__[].port_group_name Required | Type: string - __OVERRIDES__[].vlan_info Required | Type: object - __OVERRIDES__[].vlan_info.vlan_id Required | Type: number | Range: [0, 4094] VLAN id for the port group __OVERRIDES__[].is_dedicated_vlan Optional | Type: boolean -	9.1.0.0
vCenter	General	2102	Configure an alert if an error occurs with the ESXi remote syslog connection. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.alarm_esx_remote_syslog_failure Assessed Condition: Provide alarm configuration settings. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].alarm_name Required | Type: string | Length: [1, ∞] Name of the alarm which is unique within a vCenter. value[].alarm_description Required | Type: string Description of the alarm. value[].enabled Required | Type: boolean Flag to enable or disable alarm. value[].target_type Required | Type: string | Allowed: ["VCENTER", "HOSTS", "CLUSTERS", "DATACENTERS", "DATASTORES", "DISTRIBUTED_SWITCHES", "DISTRIBUTED_PORT_GROUPS", "VIRTUAL_MACHINES", "CLUSTER_DATASTORES"] The target for the alarm action. value[].rule_expressions Required | Type: array Defines the event, condition, or state that triggers the alarm and defines the notification severity. value[].rule_expressions[].event_type_id Required | Type: string Event Type value[].rule_expressions[].state Required | Type: any | Allowed: ["NO_CHANGE", "NORMAL", "WARNING", "CRITICAL"] Green to reset, yellow for warning, red for critical and no_change for keeping the current state value[].rule_expressions[].comparisons Optional | Type: array List of additional arguments to be satisfied to trigger alarm, an argument is made from an attribute, operator and value. value[].rule_expressions[].comparisons[].attribute Required | Type: string - value[].rule_expressions[].comparisons[].operator Required | Type: any | Allowed: ["equals", "notEqualTo", "startsWith", "doesNotStartWith", "endsWith", "doesNotEndWith"] - value[].rule_expressions[].comparisons[].value Required | Type: string - value[].alarm_actions Optional | Type: array List of actions - sending email, sending snmp traps or running scripts and state causing these actions value[].alarm_actions[].state Required | Type: string | Allowed: ["WARNING", "CRITICAL", "NORMAL", "NO_CHANGE"] The state for which the alarm action is to be taken. value[].alarm_actions[].action_type Required | Type: string | Allowed: ["EMAIL", "SNMP", "SCRIPT"] The type of the action to be taken. value[].alarm_actions[].repeats Required | Type: boolean Action to be repeated based on configured action frequency time value[].alarm_actions[].email Optional | Type: object Send email when alarm is triggered with warning. value[].alarm_actions[].email.subject Required | Type: string Subject of the email value[].alarm_actions[].email.to_list Required | Type: string Emails separated by comma. value[].alarm_actions[].email.cc_list Required | Type: string Emails separated by comma. value[].alarm_actions[].email.body Required | Type: string Body of the email value[].alarm_actions[].script Optional | Type: object - value[].alarm_actions[].script.script_name Required | Type: string Script to run alarm is triggered with warning. value[].action_frequency Optional | Type: number Frequency (in minutes) to repeat actions until acknowledged or reset to green	9.1.0.0
vCenter	General	2103	Manage Compliance kit configuration value for a recognized security control framework or standard Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vpx_sddc_deployed_compliance_kit_config Assessed Condition: Provide compliance key configuration for a recognized security control framework or standard. Setting Fields & Requirements: Field Path Requirements / Specifications Description value Required | Type: string Compliance kit configuration for a recognized security control framework or standard (e.g., NIST-800-53).	9.1.0.0
vCenter	PCI;SCG	2104	vcenter-9.vami-firewall-restrict-access - The vCenter Server must configure the firewall to only allow traffic from authorized networks. Policy/Audit control. No JSON schema defined in checks.json for ID 2104.	9.1.0.0
vCenter	General;PCI;SCG	2105	The vCenter Server must enable FIPS-validated cryptography Policy/Audit control. No JSON schema defined in checks.json for ID 2105.	9.1.0.0
vCenter	PCI;SCG	2106	VMware vCenter should enable Enhanced vMotion Compatibility for resilience and compatibility with CPU vulnerability mitigations which may cause changes in CPU microcode. Policy/Audit control. No JSON schema defined in checks.json for ID 2106.	9.1.0.0
vCenter	PCI;SCG	2107	The vCenter Server must not override port group settings at the port level on distributed switches, except for block ports. Policy/Audit control. No JSON schema defined in checks.json for ID 2107.	9.1.0.0
vCenter	PCI;SCG	2108	vCenter must enable High Availability for resilience to host faults Policy/Audit control. No JSON schema defined in checks.json for ID 2108.	9.1.0.0
vCenter	PCI;SCG	2109	Configure the vCenter Server login banner text for access via SSH Policy/Audit control. No JSON schema defined in checks.json for ID 2109.	9.1.0.0
vCenter	General;PCI;SCG	2110	The vCenter Server must maintain confidentiality and integrity of transmissions by enabling modern TLS ciphers Policy/Audit control. No JSON schema defined in checks.json for ID 2110.	9.1.0.0
vCenter	PCI;SCG	2111	VM Must configure vm diagnostic logging Policy/Audit control. No JSON schema defined in checks.json for ID 2111.	9.1.0.0
vCenter	PCI;SCG	2116	The vsan must set checksumDisabled to false Policy/Audit control. No JSON schema defined in checks.json for ID 2116.	9.1.0.0
vCenter	PCI;SCG	2117	The vsan operations must reserve capacity Policy/Audit control. No JSON schema defined in checks.json for ID 2117.	9.1.0.0
vCenter	PCI;SCG	2118	vCenter must send email securely Policy/Audit control. No JSON schema defined in checks.json for ID 2118.	9.1.0.0
vCenter	General	2300	Configure Data in Transit Encryption Keys to be re-issued at regular intervals for the vSAN Data in Transit encryption enabled clusters. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcenter.vsan_datastore_transit_encryption_config Assessed Condition: Specify rekey_interval. Default is 36 minutes. Set transit_encryption_enabled to "true" to ensure transit encryption is strictly enforced. Setting Fields & Requirements: Field Path Requirements / Specifications Description rekey_interval Required | Type: number | Default: 36 | Range: [30, 10080] vSAN data in transit encryption rekey interval in minutes. Minimum 30 minutes maximum 10080 (7 days) transit_encryption_enabled Required | Type: boolean | Must equal: true | Default: true Ensure that transit encryption is strictly enforced for data in transit encryption enabled vSAN clusters. The default and only allowed value is True.	9.1.0.0
vCenter	PCI;SCG	2304	Configure Automatic Rebalance for the vSAN enabled clusters. Policy/Audit control. No JSON schema defined in checks.json for ID 2304.	9.1.0.0
vCenter	PCI;SCG	2305	Configure Auto Policy Management for the vSAN enabled clusters. Policy/Audit control. No JSON schema defined in checks.json for ID 2305.	9.1.0.0
vCenter	PCI;SCG	2306	Configure Data at Rest Encryption Keys to be re-issued at regular intervals for the vSAN Data at Rest encryption enabled clusters. Policy/Audit control. No JSON schema defined in checks.json for ID 2306.	9.1.0.0
vCenter	PCI;SCG	2307	Ensure Managed Disk Claims is disabled for the vSAN enabled clusters. Policy/Audit control. No JSON schema defined in checks.json for ID 2307.	9.1.0.0
VCF Automation		4001	VCFA components must use an authoritative time source [NTP] Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vmsp.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
VCF Automation		4003	Manage Enterprise HTTP proxy configuration for VCFA Policy/Audit control. No JSON schema defined in checks.json for ID 4003.	9.1.0.0
VCF Automation	General	4100	DNS should be configured to a global value that is enforced by VCFA Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vcfa.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.0.0
VCF Automation	General	4101	Manage Syslog server configuration for VCFA Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcfa.syslog Assessed Condition: Set host, port, transport, and insecure for syslog server. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: object - servers.cacert Optional | Type: string - servers.host Required | Type: string - servers.port Required | Type: number - servers.transport Required | Type: any | Allowed: ["tls", "udp", "tcp"] - servers.insecure Required | Type: boolean | Default: true Skip TLS validation	9.1.0.0
VCF Automation	General	4102	VCFA components must use an authoritative time source [NTP] Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vcfa.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.1.0
VCF Automation		4103	Manage Enterprise HTTP proxy configuration for VCFA Policy/Audit control. No JSON schema defined in checks.json for ID 4103.	9.1.1.0
VM	PCI;SCG	1137	VM console connection limits configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1137.	9.1.0.0
VM	PCI;SCG	1138	VM desktop auto lock configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1138.	9.1.0.0
VM	PCI;SCG	1144	VM disk shrink functionality configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1144.	9.1.0.0
VM	PCI;SCG	1147	VM copy functionality configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1147.	9.1.0.0
VM	PCI;SCG	1148	VM paste functionality configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1148.	9.1.0.0
VM	PCI;SCG	1149	VM disk wiper functionality configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1149.	9.1.0.0
VM	PCI;SCG	1150	VM 3D graphics support configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1150.	9.1.0.0
VM	PCI;SCG	1152	VM device isolation configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1152.	9.1.0.0
VM	PCI;SCG	1153	VM drag-and-drop functionality configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1153.	9.1.0.0
VM	PCI;SCG	1154	VMware Tools informational data size limit configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1154.	9.1.0.0
VM	PCI;SCG	1155	VM log file retention configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1155.	9.1.0.0
VM	PCI;SCG	1156	VM log file rotation size configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1156.	9.1.0.0
VM	PCI;SCG	1157	VM host information access configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1157.	9.1.0.0
VM	PCI;SCG	1161	VM advanced settings configuration for memory page sharing. Policy/Audit control. No JSON schema defined in checks.json for ID 1161.	9.1.0.0
VM	PCI;SCG	1162	VM boot device restriction configuration Policy/Audit control. No JSON schema defined in checks.json for ID 1162.	9.1.0.0
VM	General;PCI;SCG	1234	Encryption must be enabled for vMotion on the virtual machine. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vm.vm_migrate_encryption Assessed Condition: Set migrate_encryption_policy to "required". Setting Fields & Requirements: Field Path Requirements / Specifications Description migrate_encryption_policy Required | Type: string | Allowed: ["disabled", "opportunistic", "required"] | Default: "required" Virtual machine migrate encryption policy ignore_disconnected Optional | Type: boolean | Default: false exclude VMs not in connected state ignore_fully_encrypted Optional | Type: boolean | Default: false exclude VMs that are fully encrypted	9.1.0.0
VM		2112	Virtual machines must limit access through the "dvfilter" network Application Programming Interface (API) Policy/Audit control. No JSON schema defined in checks.json for ID 2112.	9.1.0.0
VM	PCI;SCG	2113	Virtual machines must require encryption for Fault Tolerance Policy/Audit control. No JSON schema defined in checks.json for ID 2113.	9.1.0.0
VM	PCI;SCG	2114	The guest OS must ensure that virtual machine hardware is version 19 or newer where supported Policy/Audit control. No JSON schema defined in checks.json for ID 2114.	9.1.0.0
VM	PCI;SCG	2115	VM must limit PCI Device passthrough Policy/Audit control. No JSON schema defined in checks.json for ID 2115.	9.1.0.0
VCFMS	General	4000	DNS should be configured to a global value that is enforced by VCFMS Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vmsp.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.0.0
VCFMS	General	4001	VCFMS components must use an authoritative time source [NTP] Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vmsp.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
VCFMS	General	4002	Manage Syslog server configuration for VCFMS Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vmsp.syslog Assessed Condition: Set host, port, transport, and insecure for syslog server. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: object - servers.cacert Optional | Type: string - servers.host Required | Type: string - servers.port Required | Type: number - servers.transport Required | Type: any | Allowed: ["tls", "udp", "tcp"] - servers.insecure Required | Type: boolean | Default: true Skip TLS validation	9.1.0.0
VCFMS		4003	Manage Enterprise HTTP proxy configuration for VCFMS Policy/Audit control. No JSON schema defined in checks.json for ID 4003.	9.1.0.0
Operations for Networks	General	4200	The system must be configured to use approved DNS servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrni.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.1.0
Operations for Networks	General	4201	The system must configure NTP time synchronization. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrni.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.1.0
Operations for Networks	General	4202	Role-based access control bindings must match the approved desired configuration. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.rbac_config Assessed Condition: All user and group role bindings must match the approved desired configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description role_bindings Optional | Type: array List of authorized role bindings. Leave empty for no rule (SKIPPED). role_bindings[].name Required | Type: string | Length: [1, ∞] Principal identifier — user in name@domain format or group in domain\name format. role_bindings[].type Required | Type: string | Allowed: ["USER", "GROUP"] Principal type: USER or GROUP. role_bindings[].role Required | Type: string | Allowed: ["ADMIN", "MEMBER", "AUDITOR"] Role assigned to the principal.	9.1.1.0
Operations for Networks	General	4203	Only approved local accounts should be present. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.local_accounts Assessed Condition: Local OS accounts on each platform node must exactly match the approved list. Setting Fields & Requirements: Field Path Requirements / Specifications Description users Required | Type: array Approved local OS accounts on each Network Operations platform node. users[].username Required | Type: string OS login name users[].uid Required | Type: integer Numeric user ID (informational) users[].gid Required | Type: integer Numeric primary group ID (informational) users[].home Required | Type: string Home directory path (informational) users[].shell Required | Type: string Login shell. Service/system accounts must use /sbin/nologin or /bin/false.	9.1.1.0
Operations for Networks	General	4204	Network Operations must forward system logs to an approved syslog server. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrni.syslog_config Assessed Condition: Network Operations must have syslog forwarding enabled with at least one syslog server configured. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array Syslog forwarding target (one entry max). Leave empty for no rule (SKIPPED). servers[].name Optional | Type: string Optional friendly name (nick_name) for the syslog target server servers[].ip_or_fqdn Required | Type: string IP address or FQDN of the syslog target server servers[].port Optional | Type: integer | Default: 514 | Range: [1, 65535] Syslog port (default: 514) servers[].protocol Optional | Type: string | Allowed: ["UDP"] | Default: "UDP" Transport protocol — UDP only	9.1.1.0
Operations for Networks	General	4209	TLS Version 1.2 or Higher on Network Operations Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.tls_version_config Assessed Condition: Provide list of disabled and enabled protocols. Setting Fields & Requirements: Field Path Requirements / Specifications Description disabled_protocols Required | Type: array | Default: ["TLSv1","TLSv1.1"] List of protocols that must be disabled (e.g., TLSv1, TLSv1.1) disabled_protocols[] Optional | Type: string - enabled_protocols Required | Type: array | Default: ["TLSv1.2","TLSv1.3"] List of protocols that must be enabled (e.g., TLSv1.2, TLSv1.3) enabled_protocols[] Optional | Type: string -	9.1.1.0
Operations for Networks	General	4210	TLS Supported Profile on Network Operations Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.tls_supported_profile_config Assessed Condition: Verify TLS Supported Profile. Setting Fields & Requirements: Field Path Requirements / Specifications Description profile Required | Type: string | Allowed: ["COMPATIBLE", "NIST_2024", "NIST_2024_TLS_13_ONLY", "CNSA_10", "MANUAL"] | Default: "COMPATIBLE" The expected TLS profile (e.g., COMPATIBLE)	9.1.1.0
Operations for Networks	General	4211	The system must use only approved SSH cryptographic algorithms. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.secure_ssh Assessed Condition: The system SSH daemon must use only approved FIPS-compliant ciphers, MAC algorithms, and key exchange algorithms. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol Optional | Type: string | Default: "2" SSH protocol version. Must be '2'. SSHv1 is deprecated and must not be enabled. kex_algorithms Optional | Type: array | Default: ["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521"] Required key exchange algorithms. Compliance uses a two-part policy: (1) every algorithm listed here must be present in the effective list (from sshd_config KexAlgorithms directive, or from 'sshd -T' when no directive is set); (2) the weak algorithms diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, and diffie-hellman-group-exchange-sha1 must not be active regardless. Only ECDH and DH-SHA256/SHA512 variants are acceptable. This list reflects the full effective KexAlgorithms on Network Operations nodes running OpenSSH where no explicit KexAlgorithms directive is set. kex_algorithms[] Optional | Type: string - ciphers Optional | Type: array | Default: ["aes256-ctr","[email protected]","aes192-ctr","aes128-ctr","[email protected]"] Approved symmetric ciphers in the sshd_config Ciphers directive. These are FIPS 140-2 approved counter-mode ciphers. Comparison is order-insensitive (set equality). ciphers[] Optional | Type: string - macs Optional | Type: array | Default: ["hmac-sha2-512","[email protected]","hmac-sha2-256","[email protected]"] Approved message authentication codes in the sshd_config MACs directive. HMAC-SHA2 ETM (encrypt-then-MAC) variants are preferred per FIPS 140-2. Comparison is order-insensitive (set equality). macs[] Optional | Type: string - host_keys Optional | Type: array | Default: [{"type":"RSA","size":2048},{"type":"ECDSA","size":256}] Required host key types with minimum acceptable key sizes. Matched by type; size is a minimum (current must be >= desired). RSA minimum 2048 bits; ECDSA minimum 256 bits. The path field is informational and not compared in compliance checks. host_keys[].type Required | Type: string Key algorithm type (RSA, ECDSA, ED25519, etc.) host_keys[].size Required | Type: integer Minimum acceptable key size in bits	9.1.1.0
Operations for Networks	General	4212	The system must operate in FIPS 140-2 compliant mode. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.fips_config Assessed Condition: The system must operate in FIPS 140-2 compliant mode with approved cryptographic modules enabled. Setting Fields & Requirements: Field Path Requirements / Specifications Description fips_enabled Optional | Type: boolean | Default: true Whether FIPS mode must be enabled on the Network Operations node	9.1.1.0
Operations for Networks	General	4213	SSH access must be configured with required timeouts on vRNI nodes Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrni.ssh_access_config Assessed Condition: SSH LoginGraceTime, ClientAliveInterval, and ClientAliveCountMax must be set to secure values on vRNI nodes. Setting Fields & Requirements: Field Path Requirements / Specifications Description login_grace_time Optional | Type: integer | Default: 60 | Range: [0, ∞] SSH LoginGraceTime in seconds. Maximum time allowed for authentication before disconnecting. client_alive_interval Optional | Type: integer | Default: 300 | Range: [0, ∞] SSH ClientAliveInterval in seconds. Idle timeout probe interval sent to the client. client_alive_count_max Optional | Type: integer | Default: 0 | Range: [0, ∞] SSH ClientAliveCountMax. Number of unanswered probes before disconnecting. Set to 0 to disconnect immediately.	9.1.1.0
Operations for Networks	General	4214	Configure password policy for the system. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrni.password_policy Assessed Condition: Password policy must enforce complexity, expiration, and lockout constraints. Setting Fields & Requirements: Field Path Requirements / Specifications Description complexityConstraint Optional | Type: object Password complexity requirements. complexityConstraint.minLength Optional | Type: integer | Default: 8 | Range: [1, ∞] Minimum password length. complexityConstraint.minLowercase Optional | Type: integer | Default: 1 | Range: [0, ∞] Minimum number of lowercase characters. complexityConstraint.minUppercase Optional | Type: integer | Default: 1 | Range: [0, ∞] Minimum number of uppercase characters. complexityConstraint.minNumeric Optional | Type: integer | Default: 1 | Range: [0, ∞] Minimum number of numeric characters. complexityConstraint.minSpecial Optional | Type: integer | Default: 1 | Range: [0, ∞] Minimum number of special characters. complexityConstraint.passwordHistory Optional | Type: integer | Default: 5 | Range: [0, ∞] Number of previous passwords that cannot be reused. expirationConstraint Optional | Type: object Password expiration requirements. expirationConstraint.passwordExpirationDays Optional | Type: integer | Default: 90 | Range: [0, ∞] Number of days before password expires. lockoutConstraint Optional | Type: object Account lockout requirements. lockoutConstraint.lockoutMaxAuthFailures Optional | Type: integer | Default: 5 | Range: [1, ∞] Maximum number of failed authentication attempts before lockout. lockoutConstraint.lockoutEvaluationPeriod Optional | Type: integer | Default: 120 | Range: [0, ∞] Time window in seconds for counting failed attempts. lockoutConstraint.lockoutPeriod Optional | Type: integer | Default: 300 | Range: [0, ∞] Duration in seconds for which the account remains locked.	9.1.1.0
Operations for Networks	General	4215	SSH service must be enabled on vRNI nodes Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrni.ssh_service_config Assessed Condition: SSH service must be enabled on all vRNI nodes. Setting Fields & Requirements: Field Path Requirements / Specifications Description ssh_enabled Required | Type: boolean | Default: true Whether SSH service is enabled (iptables port 22 open) on vRNI nodes.	9.1.1.0
Orchestrator	General	2900	VCF Operations Orchestrator DNS control Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vro.dns Assessed Condition: Provide list of DNS servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of reachable DNS servers servers[] Optional | Type: string -	9.1.0.0
Orchestrator	General	2901	VCF Operations Orchestrator NTP control Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vro.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.0.0
Orchestrator	General	2902	VCF Operations Orchestrator SYSLOG control Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vro.syslog Assessed Condition: Provide hostname, port, protocol, facility, and level for each syslog server. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Required | Type: array A valid list of syslog servers servers[].hostname Required | Type: string - servers[].port Required | Type: number - servers[].protocol Required | Type: any | Allowed: ["TLS", "UDP", "TCP", "CFAPI", "LI"] - servers[].facility Optional | Type: array - servers[].facility[] Optional | Type: string | Allowed: ["KERN", "USER", "MAIL", "DAEMON", "AUTH", "SYSLOG", "LPR", "NEWS", "UUCP", "AUTHPRIV", "FTP", "LOGALERT", "CRON", "LOCAL0", "LOCAL1", "LOCAL2", "LOCAL3", "LOCAL4", "LOCAL5", "LOCAL6", "LOCAL7"] - servers[].level Optional | Type: string | Allowed: ["DEBUG", "INFO", "WARNING"] -	9.1.0.0
Orchestrator	General	2903	VCF Operations Orchestrator SSH daemon must use only SSH protocol version 2 and reject host keys below the approved minimum size. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vro.ssh_crypto Assessed Condition: SSH daemon uses protocol 2.0 and all host keys meet the minimum size requirements. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Optional | Type: string | Default: "2.0" - host_keys Optional | Type: array | Default: [{"key_type":"rsa","key_size":2048},{"key_type":"ecdsa","key_size":256},{"key_type":"ed25519","key_size":256}] - host_keys[].key_type Required | Type: string - host_keys[].key_size Required | Type: integer -	9.1.1.0
Orchestrator	General	2904	VCF Operations Orchestrator SSH session idle timeout must be configured to disconnect inactive sessions within the approved time limit. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vro.ssh_session Assessed Condition: SSH session idle timeout is set to 5 minutes (idle_session_timeout=5), within the approved 1-60 minute range. Setting Fields & Requirements: Field Path Requirements / Specifications Description idle_session_timeout Required | Type: integer | Default: 5 Maximum minutes of inactivity before session is terminated. Range: 1-60.	9.1.1.0
Orchestrator	General	2905	VCF Operations Orchestrator must operate in FIPS 140-2 compliant mode with approved cryptographic modules enabled. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vro.fips_mode Assessed Condition: FIPS 140-2 mode is enabled on the appliance (vracli security fips reports fips_mode: strict). Setting Fields & Requirements: Field Path Requirements / Specifications Description fips_enabled Required | Type: boolean | Default: true -	9.1.1.0
Orchestrator	General	2906	VCF Operations Orchestrator local OS accounts must match the approved desired-state list; service accounts must use a non-interactive shell. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vro.local_accounts Assessed Condition: All local OS accounts match the operator-supplied approved list; service accounts use /sbin/nologin or /bin/false. Setting Fields & Requirements: Field Path Requirements / Specifications Description accounts Required | Type: array | Default: [] Complete approved list of local OS accounts. Must be populated by the operator before scanning. accounts[].username Required | Type: string Account login name (matching key) accounts[].uid Required | Type: integer | Range: [0, ∞] Numeric user ID accounts[].gid Required | Type: integer | Range: [0, ∞] Numeric primary group ID accounts[].gecos Optional | Type: string GECOS / display name field. Not included in compliance comparison. accounts[].home Required | Type: string Home directory path accounts[].shell Required | Type: string Login shell. Service accounts must use /sbin/nologin, /bin/false, or /usr/sbin/nologin.	9.1.1.0
Operations	General;PCI;SCG	3400	VCF Operations must enforce the limit of five consecutive invalid logon attempts by a user during a 15 minute time period Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrops.password_policy Assessed Condition: Set max failed login attempts to 5 or less. Set auto unlock interval to 900 seconds or greater. Setting Fields & Requirements: Field Path Requirements / Specifications Description lockoutConstraint Required | Type: object Represents the lockout constraints of the password policy lockoutConstraint.lockoutMaxAuthFailures Required | Type: number | Default: 5 | Range: [1, 5] Max failed login attempts lockoutConstraint.lockoutPeriod Required | Type: number | Default: 900 | Range: [900, ∞] Auto unlock interval in seconds (15 minutes = 900 seconds)	9.1.0.0
Operations	General	3401	VCF Operations (vROPS) must be configured to use approved DNS servers. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrops.dns_config Assessed Condition: Provide list of approved static DNS server IP addresses. Setting Fields & Requirements: Field Path Requirements / Specifications Description mode Optional | Type: string | Allowed: ["dhcp", "is_static"] 'dhcp' — use DNS from the DHCP lease (FAILED if appliance has no DHCP networking). 'is_static' — require static servers (default when omitted). servers Optional | Type: array A valid list of approved, reachable DNS server IP addresses. Used when mode is 'is_static' or mode is omitted. servers[] Optional | Type: string -	9.1.1.0
Operations	PCI;SCG	3402	VCF Operations must limit the number of concurrent sessions Policy/Audit control. No JSON schema defined in checks.json for ID 3402.	9.1.0.0
Operations	PCI;SCG	3403	VCF Operations must enable credential ownership enforcement Policy/Audit control. No JSON schema defined in checks.json for ID 3403.	9.1.0.0
Operations	PCI;SCG	3404	VCF Operations must enforce password complexity requirements Policy/Audit control. No JSON schema defined in checks.json for ID 3404.	9.1.0.0
Operations	PCI;SCG	3405	VMware Cloud Foundation components must enforce a session timeout after a specified period of inactivity Policy/Audit control. No JSON schema defined in checks.json for ID 3405.	9.1.0.0
Operations	PCI;SCG	3406	VCF Operations must disable unsigned management pack installation Policy/Audit control. No JSON schema defined in checks.json for ID 3406.	9.1.0.0
Operations	General	3407	The system must enable FIPS 140-2 compliant cryptographic mode on VCF Operations (vROPS). Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.fips_mode Assessed Condition: FIPS 140-2 mode must be enabled on the vROPS appliance (/proc/sys/crypto/fips_enabled == 1). Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: true FIPS 140-2 mode must be enabled (true) on all vROPS appliance nodes.	9.1.1.0
Operations	General	3409	VCF Operations (vROPS) must disable TLS 1.0 and TLS 1.1 and only accept TLS 1.2 or higher. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.tls_version Assessed Condition: Only TLS 1.2 and TLS 1.3 must be enabled on all vROPS management and API endpoints. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: array | Default: ["TLSv1.2","TLSv1.3"] List of TLS versions that must be enabled on vROPS. Versions not in this list must be disabled. enabled[] Optional | Type: string | Allowed: ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"] -	9.1.1.0
Operations	General	3410	VCF Operations (vROPS) local OS accounts must match the approved desired configuration. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.local_accounts Assessed Condition: All local OS accounts on the vROPS appliance must match the approved desired-state list. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].username Required | Type: string - value[].uid Required | Type: integer | Range: [0, ∞] - value[].gid Required | Type: integer | Range: [0, ∞] - value[].gecos Optional | Type: string - value[].home Required | Type: string - value[].shell Required | Type: string -	9.1.1.0
Operations	General	3411	VCF Operations (vROPS) SSH daemon must use protocol version 2 and host keys of at least 2048 bits. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.ssh_crypto Assessed Condition: SSH protocol must be version 2.0 and all RSA host keys must be at least 2048 bits. Setting Fields & Requirements: Field Path Requirements / Specifications Description protocol_version Required | Type: string | Default: "2.0" - min_key_size Required | Type: integer | Default: 2048 | Range: [1024, ∞] -	9.1.1.0
Operations	General	3412	VCF Operations (vROPS) SSH service must be in the correct runtime state with appropriate timeouts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrops.ssh_session Assessed Condition: SSH service state and idle session timeout must match the approved configuration. Setting Fields & Requirements: Field Path Requirements / Specifications Description enabled Required | Type: boolean | Default: false - idle_session_timeout Required | Type: integer | Default: 600 | Range: [0, ∞] -	9.1.1.0
Operations	General	3413	VCF Operations must enforce a maximum password age of 120 days for local accounts. Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrops.password_policy Assessed Condition: Maximum password age must not exceed 120 days for all local application accounts. Setting Fields & Requirements: Field Path Requirements / Specifications Description expirationConstraint Required | Type: object - expirationConstraint.passwordExpirationDays Required | Type: number | Default: 120 -	9.1.1.0
Operations	General	3414	Assign least privileges to users and groups in VCF Operations. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.rbac_config Assessed Condition: Each vROPS user and group listed in the desired configuration must exist on the system and hold only the approved roles. Setting Fields & Requirements: Field Path Requirements / Specifications Description value[].name Required | Type: string Principal name (user@domain or domain\\group). value[].type Required | Type: string | Allowed: ["USER", "GROUP"] Principal type: USER or GROUP. value[].role Required | Type: string Approved role name (e.g. ReadOnly, PowerUser, Administrator).	9.1.1.0
Operations	General	3415	VCF Operations LI Agent (syslog) must forward logs to the approved Log Insight instance. Severity: Immediate  |  Auto-Remediate: False  |  Schema Path: compliance_config.vrops.syslog_config Assessed Condition: The vROPS LI Agent must be configured to forward logs to the approved Log Insight instance with the correct hostname, port, and protocol. Setting Fields & Requirements: Field Path Requirements / Specifications Description hostname Required | Type: string | Default: "" FQDN or IP of the approved Log Insight instance. port Required | Type: integer | Default: 9543 Destination port. protocol Required | Type: string | Default: "CFAPI" Forwarding protocol (e.g. CFAPI).	9.1.1.0
Operations	General	4300	VCF Operations NTP configuration Severity: Immediate  |  Auto-Remediate: True  |  Schema Path: compliance_config.vrops.ntp Assessed Condition: Provide list of NTP servers. Setting Fields & Requirements: Field Path Requirements / Specifications Description servers Optional | Type: array A valid list of reachable NTP servers servers[] Optional | Type: string -	9.1.1.0