Policy Compliance Library Updates, August 2024

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations most used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS security guidelines from OS and application vendors, and other industry best practices.

Qualys’ Certification Page at CIS has been updated.

CIS Benchmark Policies

Center for Internet Security (CIS) Benchmarks policies are technical guidelines for organizations to improve their cybersecurity posture by aligning with recommended secure configurations. This reduces the risk of cyberattacks like data breaches by leveraging industry best practices.

DISA STIG Policies

STIG stands for Security Technical Implementation Guide, which is a set of cybersecurity guidelines published by the Defense Information Systems Agency (DISA). This equips them with the necessary tools to adhere to rules, regulations, best practices, and federal laws, facilitating compliance and bolstering cybersecurity measures.

Qualys Policies

Qualys oversees the discovery and resolution of technical issues while implementing robust policy frameworks. Researchers within Qualys actively identify cybersecurity misconfiguration and enact technical policies to fortify systems and safeguard against potential threats.

Safeguard Computer Security Evaluation Matrix (SCSEM)

It typically comprises a structured set of criteria, guidelines, and metrics designed to measure various aspects of security, such as confidentiality, integrity, availability, and compliance.

Compliance Standards

Compliance standards are regulatory frameworks safeguarding sensitive data and ensuring privacy and security. They offer guidelines and best practices for organizations to achieve compliance and mitigate risks in handling sensitive information.

New Policies/Mandates

Listed below are the number of policies and mandates deployed in August 2024:

CIS Benchmark Policies	5
DISA STIG Policy	9
Industry Best Practices Policy	5
New Supported Mandates	1

Listed below are the newly published policies and mandates:

CIS Benchmark Policies	• CIS Benchmark for MongoDB 7, v1.0.0 • CIS Benchmark for PostgreSQL 16, v1.0.0 • CIS Benchmark for Microsoft Windows 10 EMS Gateway, v3.0.0 • CIS Benchmark for Microsoft Windows 11 Stand-alone, v3.0.0 • CIS Benchmark for MS Windows 11 Enterprise , v3.0.0 policy for Brazilian Portuguese language.
DISA STIG Policies	• DISA Security Technical Implementation Guide (STIG) for Cisco NX-OS Switch RTR, V2R3 • DISA Security Technical Implementation Guide (STIG) for Splunk Enterprise 8.x for Linux ,V1R5 • DISA Security Technical Implementation Guide (STIG) for Windows 10, V2R9 • DISA Security Technical Implementation Guide (STIG) for Microsoft Windows 11, V1R6 • DISA Security Technical Implementation Guide (STIG) for Microsoft Windows Server 2019 DC, V2R9 • DISA Security Technical Implementation Guide (STIG) for Microsoft Windows Server 2019 MS, V2R9 • DISA Security Technical Implementation Guide (STIG) for IIS 10 Server, V2R8 • DISA Security Technical Implementation Guide (STIG) for IIS 8.5 server, v2r5 • DISA Security Technical Implementation Guide (STIG) for Oracle Database 12c, V3R1
Industry and Best Practices Policies	• Security configuration and compliance policy for Virtuzzo Linux 9 • PCI-DSS (Payment Card Industry Data Security Standard) Ver4.0 Policy for Database • PCI-DSS (Payment Card Industry Data Security Standard) Ver 4.0 Policy for Network • NIST 800-171 Rev 2 for Linux • NIST 800-171 Rev 2 for Microsoft Windows
New Supported Mandates	• Australian Signals Directorate Information Security Manual (ISM)

Policy Updates

We have updated your Policy Library. The following policies and mandates have been re-released as part of our customer CRM.

Proposed Upcoming Policies

We plan to release the following policies and updates next month:

DISA Fortinet Fortigate Firewall STIG – Ver 1, Rel 3
Security Configuration and Compliance Policy for DataStax Enterprise(Cassandra) version 6.8.14
DISA Security Technical Implementation Guide (STIG) for Cisco NX-OS Switch L2S, V3R1
DISA Security Technical Implementation Guide (STIG) for Microsoft Windows Server 2016 DC, V2R7
DISA Security Technical Implementation Guide (STIG) for Microsoft Windows Server 2016 MS,V2R7
NIST 800-171 Rev 2 Policy for macOS
CIS Microsoft Windows Server 2019 Stand-alone v2.0.0
Security Configuration and Compliance Policy for Windows Server Certification Authority 2019
Criminal Justice Information Services (CJIS) Security Policy for Network
Criminal Justice Information Services (CJIS) Security Policy for Windows
CIS Microsoft Office Enterprise Benchmark, 1.2.0
DISA Security Technical Implementation Guide (STIG) for Ivanti Connect Secure NDM, V2R1
NERC CIPv5 for Linux
NERC CIPv5 for DataBase
NERC CIPv5 for Network
NIST 800-171 Rev 2 for Database
NIST 800-171 Rev 2 for Network
NIST 800-171 Rev 2 for VMware
California Consumer Privacy Act of 2018 (SB-1121) for Network
Criminal Justice Information Services (CJIS) Security Policy for Linux
Criminal Justice Information Services (CJIS) Security Policy for Database
CIS Benchmark for SUSE Linux Enterprise 12.x, v3.1.0

Learn More

Discover how Qualys Enterprise TruRisk Platform can help you reduce cyber risk and improve business outcomes through precise remediation activities. Learn more here.

Additional Information

Feel free to contact your TAM or Qualys Technical Support if you have questions.

Find all policy library updates here.

Check out Qualys’ updated Certification Page at CIS here.