Policy Audit Library Updates, September 2026
Qualys’ library of built-in policies makes it easy to comply with the widely adopted security standards and regulations. The platform offers a broad range of policies, including many that have been certified by the Center for Internet Security (CIS), as well as security guidelines and industry best practices from operating system and application vendors.
Qualys’ Certification Page on the CIS website has also been updated.
CIS Benchmark Policies
Center for Internet Security (CIS) Benchmark policies are technical guidelines for organizations to improve their cybersecurity posture by aligning with recommended secure configurations. By leveraging industry best practices, these guidelines help reduce the risk of cyberattacks, such as data breaches.
DISA STIG Policies
STIG stands for Security Technical Implementation Guide, which is a set of cybersecurity guidelines published by the Defense Information Systems Agency (DISA). These guidelines equip organizations with the necessary tools to adhere to rules, regulations, best practices, and federal laws, facilitating compliance and bolstering cybersecurity measures.
CIS STIG Policies
CIS STIG Benchmarks are secure configuration guidelines released by the Center for Internet Security (CIS) and derived directly from DISA Security Technical Implementation Guides (STIGs). They are functionally equivalent to DISA STIGs and differ only in formatting and presentation, not in security controls or remediation guidance.
Qualys Policies
Qualys oversees the discovery and resolution of technical issues and the implementation of robust policy frameworks. Researchers within Qualys actively identify cybersecurity misconfigurations and enact technical policies to fortify systems and safeguard against potential threats.
Safeguard Computer Security Evaluation Matrix (SCSEM)
It typically comprises a structured set of criteria, guidelines, and metrics designed to measure various aspects of security, such as confidentiality, integrity, availability, and compliance.
Compliance Standards
Compliance standards are regulatory frameworks that safeguard sensitive data and help ensure privacy and security. They offer guidelines and best practices to help organizations achieve compliance and mitigate risks when handling sensitive information.
New Policies/Mandates
Listed below are the number of policies and mandates deployed in September 2026:
| CIS Benchmark Policies | 8 |
| DISA STIG Policy | 2 |
| CIS STIG Benchmark | 0 |
| Industry Best Practices Policy | 11 |
| New Supported Mandates | 0 |
| Deprecated Mandates | 0 |
Listed below are the newly published policies and mandates:
| CIS Benchmark Policies | CIS Benchmark for Google Chrome Group Policy, v1.1.0 CIS Benchmark for PostgreSQL 17, v1.1.0 CIS Apple macOS 26 Tahoe Benchmark, v1.1.0 CIS IBM AIX 7 Benchmark, v1.2.0 CIS Benchmark for Microsoft Windows Server 2025, v2.1.0 CIS Apple macOS 15.0 Sequoia Benchmark, v2.1.0 CIS Apple macOS 14.0 Sonoma Benchmark, v3.1.0 CIS MongoDB 7 Benchmark, v2.0.0 |
| DISA STIG Policies | DISA Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux 7 – Ver 3, Rel 15 DISA Security Technical Implementation Guide (STIG) for Solaris 11 SPARC – Ver 3, Rel 5 |
| CIS STIG Benchmark | NA |
| Industry and Best Practices Policies | Safeguard Computer Security Evaluation Matrix for Checkpoint Firewall, v1.0 Safeguard Computer Security Evaluation Matrix for Docker, v2.0 CISA Cybersecurity Advisory AA26-194A for Cisco Router Security Hygiene Safeguard Computer Security Evaluation Matrix for MySQL 8.x, v2.4 Safeguard Computer Security Evaluation Matrix for MySQL 5.7, v2.4 Safeguard Computer Security Evaluation Matrix for Red Hat OpenShift Container Platform, v2.0 Safeguard Computer Security Evaluation Matrix for Kubernetes, v2.0 Security Configuration and Compliance Policy for macOS 27.x ASD-ACSC for Microsoft Windows 11 Workstations Security Configuration and Compliance Policy for Opengear 25.x Security Configuration and Compliance Policy for Gigamon GigaVUE-OS 6.x |
| New Supported Mandates | NA |
| Deprecated mandates | NA |
Policy Updates
We have updated your Policy Library. The following policies and mandates have been re-released as part of our customer CRM.
| Policy | Update |
| CIS Benchmark for Oracle Linux 7, v4.0.0 | Re-release for CIS Benchmark for Oracle Linux 7, v4.0.0, to update the cover page of the policy. |
| CIS Benchmark for SUSE Linux Enterprise 15.x, v2.0.1 | Re-release for CIS Benchmark for SUSE Linux Enterprise 15.x, v2.0.1, to update the cover page of the policy. |
| CIS Benchmark for Ubuntu Linux 20.04 LTS, v3.0.0 | Re-release for CIS Benchmark for Ubuntu Linux 20.04 LTS, v3.0.0, to update the cover page of the policy. |
| Security Configuration and Compliance Policy for Citrix NetScaler | Re-release for Security Configuration and Compliance Policy for Citrix NetScaler, for scratch review. |
| CIS Benchmark for Cisco IOS XE 17.x, v2.2.1 | Re-release for CIS Benchmark for Cisco IOS XE 17.x, v2.2.1, to update the regular expression for CID 4364. |
| CIS Benchmark for Red Hat Enterprise Linux 6, v3.0.0 | Re-release for CIS Benchmark for Red Hat Enterprise Linux 6, v3.0.0, to change the control status of CID 9675 to active. |
| CIS Benchmark for Ubuntu Linux 16.04 LTS, v2.0.0 | Re-release for CIS Benchmark for Ubuntu Linux 16.04 LTS, v2.0.0, to update CIS Reference 5.4.1.4 in the policy. |
| CIS Benchmark for Microsoft Windows Server 2025, v2.0.0 | Re-release for CIS Benchmark for Microsoft Windows Server 2025, v2.0.0, to update the control chaining document. |
| CIS Benchmark for Microsoft Windows Server 2012 (non-R2), v3.0.0 | Re-release for CIS Benchmark for Microsoft Windows Server 2012 (non-R2), v3.0.0, to change reference 19.7.47.2.1 to 19.7.42.2.1 |
| CIS Benchmark for Microsoft Windows 11 Enterprise, v5.1.0 | Re-release for CIS Benchmark for Microsoft Windows 11 Enterprise, v5.1.0 to update the Update reference from 5.1 to 5.10, 5.2 to 5.20, 5.3 to 5.30, 5.4 to 5.40 |
| CIS Benchmark for Cisco Firewall ASA 9.x, v1.1.0 | Re-release for CIS Benchmark for Cisco Firewall ASA 9.x, v1.1.0, to update the regular expression for CID 8503. |
| CIS Benchmark for Cisco NX-OS, v1.2.0 | Re-release for CIS Benchmark for Cisco NX-OS, v1.2.0, for scratch review. |
| CIS Benchmark for Red Hat Enterprise Linux 9, v2.0.0 | Re-release for CIS Benchmark for Red Hat Enterprise Linux 9, v2.0.0, to add CID 31026 for CIS Reference 6.2.2.4. |
| CIS Benchmark for AlmaLinux OS 9, v2.0.0 | Re-release for CIS Benchmark for AlmaLinux OS 9, v2.0.0, to update the policy title from ‘Alma Linux’ to ‘AlmaLinux’. |
| CIS Benchmark for AlmaLinux OS 8, v4.0.0 | Re-release for CIS Benchmark for AlmaLinux OS 8, v4.0.0, to update the policy title from ‘Alma Linux’ to ‘AlmaLinux’. |
| DISA Security Technical Implementation Guide (STIG) for Amazon Linux 2023, V1R4 | Re-release for DISA Security Technical Implementation Guide (STIG) for Amazon Linux 2023, V1R4, to update the NL values for CID 26183, 26184, 26185, 26186, and CID 11516, 11518, 11514, 11512. |
| NIST 800-53 Rev 5 for Linux | Re-release for NIST 800-53 Rev 5 for Linux, to add the ‘Amazon Linux 2 AMI’ and ‘Amazon Linux AMI’ technologies and remove the AC-1 section. |
| CIS Benchmark for Microsoft SQL Server 2025, v1.0.0 | Re-release for CIS Benchmark for Microsoft SQL Server 2025, v1.0.0, to replace control 18053 with 32539 and replace 7389 with 32610. |
| CIS OEL 9 v2.0.0 | Re-release for CIS OEL 9 v2.0.0, to update the regular expressions for CID 27274 and CID 27275. |
| Security Configuration and Compliance Policy for Checkpoint Firewall Gaia R82 | Re-release for Security Configuration and Compliance Policy for Checkpoint Firewall Gaia R82 for scratch review |
| DISA STIG Amazon Linux 2023 V1R4 | Re-release for DISA STIG Amazon Linux 2023 V1R4,to replace CID 10961 with CID 27225 |
| CIS Benchmark for Debian Linux 13, v1.0.0 | Re-release for CIS Benchmark for Debian Linux 13, v1.0.0, to: Update the reference for 2.1.16 in the policy Update the VO Mappings in the VO Delete one entry from the VO |
Deprecated Policies
- CIS IBM AIX 7 Benchmark, v1.2.0
- CIS Apple macOS 26 Tahoe Benchmark, v1.0.0
- DISA Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux 7, V3R14
- CIS Benchmark for PostgreSQL 17, v1.0.0
- CIS Benchmark for Apple macOS 14 Sonoma, v3.0.0
- CIS Benchmark for Apple macOS 15 Sequoia, v2.0.0
- DISA Security Technical Implementation Guide (STIG) for Solaris 11 SPARC, V3R4
- CIS Benchmark for Microsoft Windows Server 2025, v2.0.0
- CIS Benchmark for MongoDB 7, v1.2.0
Proposed Upcoming Policies
We plan to release the following policies and updates next month:
- DISA Security Technical Implementation Guide (STIG) for MongoDB Enterprise Advanced 7.x, V1R2
- Safeguard Computer Security Evaluation Matrix for VMWare ESXi 8.0, v7.0
- Safeguard Computer Security Evaluation Matrix for VMWare ESX 7.0, v7.0
- Safeguard Computer Security Evaluation Matrix for Cisco NX-OS, v7.0
- Safeguard Computer Security Evaluation Matrix for Cisco IOS 17, v7.0
- Safeguard Computer Security Evaluation Matrix for Cisco IOS 16, v7.0
- Safeguard Computer Security Evaluation Matrix for Cisco IOS 15, v7.0
- Safeguard Computer Security Evaluation Matrix for SUSE Linux Enterprise 12, v5.0
- Safeguard Computer Security Evaluation Matrix for SUSE Linux Enterprise 15, v5.0
- Safeguard Computer Security Evaluation Matrix for Windows Server 2025, v1.0
- DISA Security Technical Implementation Guide (STIG) for IBM WebSphere Traditional V9.x, V1R2
- CIS MongoDB 8 Benchmark, v2.0.0
- CIS Apache HTTP Server 2.4 Benchmark, v2.4.0
- CIS Red Hat OpenShift Container Platform Benchmark, v2.0.0
- CIS Oracle Cloud Infrastructure Container Engine for Kubernetes(OKE) Benchmark, v2.0.0
- CIS Google Kubernetes Engine (GKE) Benchmark, v2.0.0
- CIS Amazon Elastic Kubernetes Service (EKS) Benchmark, v2.0.0
- CIS Ubuntu Linux 24.04 LTS Benchmark, v2.0.0
- CIS Debian Linux 12 Benchmark, v2.0.0
- CIS Azure Kubernetes Service (AKS) Benchmark, v2.0.0
- DISA Security Technical Implementation Guide (STIG) for Oracle Linux 9 STIG – Ver 1, Rel 6
- Security Configuration and Compliance Policy for Ping Federate
Learn More
Discover how Qualys Enterprise TruRiskTM Platform can help you reduce cyber risk and improve business outcomes through precise remediation activities. Learn more about it here.
Additional Information
Feel free to contact your Technical Account Manager (TAM) or Qualys Technical Support if you have any questions.