| DISA_VMware_vSphere_8.0_vCenter_Appliance_Management_Interface_(VAMI)_STIG_v2r1.audit from DISA VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) STIG v2r1 | |
| VCLD-80-000001 The vCenter VAMI service must limit the number of allowed simultaneous session requests. | ACCESS CONTROL |
| VCLD-80-000004 The vCenter VAMI service must use cryptography to protect the integrity of remote sessions. | ACCESS CONTROL |
| VCLD-80-000005 The vCenter VAMI service must generate information to monitor remote access. | ACCESS CONTROL |
| VCLD-80-000010 The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred. | AUDIT AND ACCOUNTABILITY |
| VCLD-80-000019 The vCenter VAMI service log files must only be accessible by privileged users. | AUDIT AND ACCOUNTABILITY |
| VCLD-80-000022 The vCenter VAMI service must off-load log records onto a different system or media from the system being logged. | AUDIT AND ACCOUNTABILITY |
| VCLD-80-000031 The vCenter VAMI service must explicitly disable Multipurpose Internet Mail Extensions (MIME) mime mappings based on "Content-Type". | CONFIGURATION MANAGEMENT |
| VCLD-80-000033 The vCenter VAMI service must have resource mappings set to disable the serving of certain file types. | CONFIGURATION MANAGEMENT |
| VCLD-80-000034 The vCenter VAMI service must have Web Distributed Authoring (WebDAV) disabled. | CONFIGURATION MANAGEMENT |
| VCLD-80-000035 The vCenter VAMI service must protect system resources and privileged operations from hosted applications. | CONFIGURATION MANAGEMENT |
| VCLD-80-000040 The vCenter VAMI service must restrict access to the web server's private key. | IDENTIFICATION AND AUTHENTICATION |
| VCLD-80-000060 The vCenter VAMI service must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks. | SYSTEM AND COMMUNICATIONS PROTECTION |
| VCLD-80-000061 The vCenter VAMI service must set the encoding for all text mime types to UTF-8. | SYSTEM AND INFORMATION INTEGRITY |
| VCLD-80-000062 The vCenter VAMI service must disable directory listing. | SYSTEM AND INFORMATION INTEGRITY |
| VCLD-80-000063 The vCenter VAMI service must not be configured to use the "mod_status" module. | SYSTEM AND INFORMATION INTEGRITY |
| VCLD-80-000064 The vCenter VAMI service must have debug logging disabled. | SYSTEM AND INFORMATION INTEGRITY |
| VCLD-80-000097 The vCenter VAMI service must disable client initiated TLS renegotiation. | CONFIGURATION MANAGEMENT |
| VCLD-80-000098 The vCenter VAMI service must be configured to hide the server type and version in client responses. | CONFIGURATION MANAGEMENT |
| VCLD-80-000099 The vCenter VAMI service must implement HTTP Strict Transport Security (HSTS). | CONFIGURATION MANAGEMENT |
| VCLD-80-000100 The vCenter VAMI service must implement prevent rendering inside a frame or iframe on another site. | CONFIGURATION MANAGEMENT |
| VCLD-80-000101 The vCenter VAMI service must protect against MIME sniffing. | CONFIGURATION MANAGEMENT |
| VCLD-80-000102 The vCenter VAMI service must enable Content Security Policy. | CONFIGURATION MANAGEMENT |
