[BESAdmin-Announcements] BigFix Compliance: Updated CIS Checklist for AIX 7.x, published 2026-09-22

[Announcements for BES Administrators]

*Product:*
BigFix Compliance

*Title:*
Updated CIS Checklist for AIX 7.x to support a more recent version of the
benchmark

*Security Benchmark:*
CIS IBM AIX 7 Benchmark, v1.2.0

*Published Sites:*
CIS Checklist for AIX 7.x, site version 11
(The site version is provided for air-gap customers.)

*Details:*

●      Total New Fixlets: 13

●      Total Updated Fixlets: 18

●      Total Deleted Fixlets: 2

●      Total Fixlets in Site: 218



*New Fixlets**:*

cis-4.1.1.17   Ensure access is configured for commands referenced by
crontab entries

cis-4.1.1.20   Ensure access on /var/tmp/snmpdv3.log is configured

cis-4.1.2.9     Ensure access on /var/spool/cron/atjobs is configured

cis-4.1.2.10   Ensure all directories in root PATH access are configured

cis-4.3.2.3     Ensure dhcp relay services are not in use

cis-4.3.2.4     Ensure dhcp server services are not in use

cis-4.3.2.7     Ensure multicast routing is not in use

cis-4.3.2.8     Ensure dns server services are not in use

cis-4.3.4.22   Ensure rsync daemon is not in use

cis-4.5.19      Ensure icmptimestamp is disabled

cis-4.6.3.18   Ensure sshd ClientAliveInterval and ClientAliveCountMax are
configured

cis-4.9.1       Ensure Address space layout randomization is enabled

cis-6.2.2       Ensure access to crontab is configured



*Updated Fixlets**:*

cis-4.1.2.8     Ensure access on /var/spool/cron/crontabs is configured

cis-4.2.6       Ensure legacy remote daemon support is not available

cis-4.3.1.1     Ensure writesrv service is not in use

cis-4.3.1.2     Ensure dt service is not in use

cis-4.3.1.7     Ensure NIM master is not installed

cis-4.3.2.2     Ensure dhcp client services are not in use

cis-4.3.2.5     Ensure gated is not in use

cis-4.3.2.6     Ensure hostmibd is not in use

cis-4.3.2.10   Ensure routed service is not in use

cis-4.3.2.11   Ensure rwhod is not in use

cis-4.3.2.13   Ensure timed service is not in use

cis-4.3.4.19   Ensure rlogin daemon is not in use

cis-4.6.3.3     Ensure sftp-server arguments are configured

cis-4.8.5       Ensure root user PATH does not include current working
directory

cis-6.1.2       Ensure sudo logging is active

cis-6.1.3       Ensure sudo commands use pty

cis-6.2.1       Ensure at is restricted to authorized users

cis-8.2.3       Ensure syslog is not configured to receive logs from a
remote client



*Deleted Fixlets*
*: *cis-2.2            Ensure system Microcode Discovery Service (MDS) is
performed regularly

cis-6.2.2       Ensure at.allow is configured



·       The Environment Setup task has been updated to use atomic result
refreshes, ensuring existing results remain available until new results are
generated. Results now also include a collection of timestamps.

·       The Applicability Fixlet has been updated to include additional
validation. It now verifies that the Environment Setup Task log file
exists, is not older than 90 days, and that the required result files are
present. This ensures that Fixlets are reported as *Not Applicable* when
the Environment Setup Task has not been executed, and that the Measured
Value (MV) correctly reflects this condition.

·       In addition, we have updated the relevance of the individual
Fixlets to align with these enhanced validation checks.

·       Both analysis and remediation checks are included.

·       Some of the checks allow you to use the parameterized setting to
enable customization for compliance evaluation. Note that parameterization
and remediation actions require the creation of a custom site.

*Actions to take:*

●       To subscribe to the above site, you can use the License Overview
Dashboard to enable and gather the site. Note that you must be entitled to
the BigFix Compliance product, and you must be using BigFix version 10 and
later.

●       If you use custom sites, update your custom sites accordingly to
use the latest content. You can synchronize your content by using the
Synchronize Custom Checks wizard. For more information, see
https://help.hcl-software.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html

*More information:*
To know more about the BigFix Compliance SCM checklists, please see the
following resources:

●       BigFix Forum:
https://forum.bigfix.com/c/release-announcements/compliance

●       BigFix Compliance SCM Checklists:
 https://forum.bigfix.com/c/release-announcements/scm-checklists/86

We hope you find this latest release of SCM content useful and effective.
Thank you!
*– The BigFix Compliance team*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260922/d30af18b/attachment.html>