Repository: pkeech/stig_parser (language: python)

Issue:
Add Additional Fields
Add additional STIG fields to JSON output.

Fields to Include:

**STIG**
- Release Info
- Source
- Notice
- Classification (If able)

**Rule**
- CCI Number
- STIG ID
- Rule ID


Discussion / hints:
Mappings for New Fields

| Field Name (JSON) | Field Location (XML) | Notes | 
| :---: | --- | --- |
| release-info | plain-text | ID Field |
| source | reference --> dc:source | Inner Text |
| notice |notice | ID Field |
| classification | xml header | href tag is only reference to classification |
| cci | group --> rule --> ident | Inner Text |
| stig_id | group --> rule --> version | Inner Text |
| rule_id | group --> rule | ID Field |

Fix patch:
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
new file mode 100644
index 0000000..400548b
--- /dev/null
+++ b/.github/workflows/pypi-publish.yml
@@ -0,0 +1,36 @@
+# This workflow will upload a Python Package using Twine when a release is created
+# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Upload Python Package
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  deploy:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.x'
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install build
+    - name: Build package
+      run: python -m build
+    - name: Publish package
+      uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
+      with:
+        user: __token__
+        password: ${{ secrets.PYPI_API_TOKEN }}
\ No newline at end of file
diff --git a/MANIFEST.in b/MANIFEST.in
index cc4f1cc..e69de29 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,1 +0,0 @@
-exclude example.yml
\ No newline at end of file
diff --git a/README.md b/README.md
index 21d0bc2..c554013 100644
--- a/README.md
+++ b/README.md
@@ -1,26 +1,33 @@
-## About
+<p align="center">
+  <img src="docs/images/STIG_Parser.png" />
+</p>
 
+[![PyTest Scan](https://github.com/pkeech/stig_parser/actions/workflows/pytest-package.yml/badge.svg)](https://github.com/pkeech/stig_parser/actions) [![PyPI](https://img.shields.io/pypi/v/stig-parser)](https://pypi.org/project/stig-parser/)
+### About
 A basic Python package to parse DISA STIG (XCCDF) Files into a readable JSON format.
 
-## Installation
-
+### Installation
 To install stig-parser, simple run the following command:
 
 `pip install stig-parser`
 
-## Version Updates
+### Version Updates
+The table below briefly describes each update. For more information, view the releases page.
 
 | Version | Description |
 | :---: | --- | 
 | 1.0.0 | Initial Creation of `stig-parser` |
 | 1.0.1 | Updated to handle change to STIG schema ([Issue #3](/../../issues/3)) |
-| 1.0.2 | Added Additional Fields to Output JSON. View Release Notes for Full Details |
+| 1.0.2 | Added Additional Fields to Output JSON. View Release Notes for Full Details ([Issue #9](/../../issues/9))|
 
-## Documentation
+### Documentation
 
 Documentation hasn't been created at this time. For the current development documentation, please visit the [repository](https://github.com/pkeech/stig_parser).
 
-## Usage
+### Testing 
+_Placeholder_
+
+### Usage
 
 To use this package simply, import the module and run the `convert-xccdf()` function. This will result in the a JSON String object. 
 
@@ -39,7 +46,7 @@ json_results = convert_xccdf(raw_file)
 
 ```
 
-## Output
+### Output
 
 Outlined below is the expected JSON output:
 
@@ -74,7 +81,7 @@ Outlined below is the expected JSON output:
 ```
 
 
-## Dependencies
+### Dependencies
 
 The following packages are required for this package:
 
@@ -82,6 +89,6 @@ The following packages are required for this package:
 | :---: | --- |
 | xmltodict | This converts the raw XML file to a python dictionary for ease of processing |
 
-## Comments, Concerns and Gripes
+### Comments, Concerns and Gripes
 
-If you have any comments, concerns and/or gripes, please feel free to submit an issue on the [repository](https://github.com/pkeech/stig_parser).
\ No newline at end of file
+If you have any comments, concerns and/or gripes, please feel free to submit an issue on the [repository](https://github.com/pkeech/stig_parser).
diff --git a/dev/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml b/dev/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml
index 041b504..f9a7f19 100644
--- a/dev/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml
+++ b/dev/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml
@@ -1,4 +1,972 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Docker_Enterprise_2-x_Linux-UNIX_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-09-13">accepted</status><title>Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="https://public.cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 1 Benchmark Date: 19 Jul 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-94863" selected="true" /><select idref="V-94865" selected="true" /><select idref="V-94867" selected="true" /><select idref="V-94869" selected="true" /><select idref="V-95111" selected="true" /><select idref="V-95113" selected="true" /><select idref="V-95355" selected="true" /><select idref="V-95357" selected="true" /><select idref="V-95599" selected="true" /><select idref="V-95601" selected="true" /><select idref="V-95603" selected="true" /><select idref="V-95605" selected="true" /><select idref="V-95607" selected="true" /><select idref="V-95609" selected="true" /><select idref="V-95611" selected="true" /><select idref="V-95613" selected="true" /><select idref="V-95615" selected="true" /><select idref="V-95617" selected="true" /><select idref="V-95619" selected="true" /><select idref="V-95621" selected="true" /><select idref="V-95623" selected="true" /><select idref="V-95625" selected="true" /><select idref="V-95627" selected="true" /><select idref="V-95629" selected="true" /><select idref="V-95631" selected="true" /><select idref="V-95635" selected="true" /><select idref="V-95637" selected="true" /><select idref="V-95639" selected="true" /><select idref="V-95641" selected="true" /><select idref="V-95643" selected="true" /><select idref="V-95645" selected="true" /><select idref="V-95647" selected="true" /><select idref="V-95649" selected="true" /><select idref="V-95651" selected="true" /><select idref="V-95653" selected="true" /><select idref="V-95655" selected="true" /><select idref="V-95657" selected="true" /><select idref="V-95659" selected="true" /><select idref="V-95661" selected="true" /><select idref="V-95663" selected="true" /><select idref="V-95665" selected="true" /><select idref="V-95667" selected="true" /><select idref="V-95669" selected="true" /><select idref="V-95671" selected="true" /><select idref="V-95673" selected="true" /><select idref="V-95675" selected="true" /><select idref="V-95677" selected="true" /><select idref="V-95679" selected="true" /><select idref="V-95681" selected="true" /><select idref="V-95683" selected="true" /><select idref="V-95685" selected="true" /><select idref="V-95687" selected="true" /><select idref="V-95689" selected="true" /><select idref="V-95691" selected="true" /><select idref="V-95693" selected="true" /><select idref="V-95695" selected="true" /><select idref="V-95697" selected="true" /><select idref="V-95699" selected="true" /><select idref="V-95701" selected="true" /><select idref="V-95703" selected="true" /><select idref="V-95705" selected="true" /><select idref="V-95707" selected="true" /><select idref="V-95709" selected="true" /><select idref="V-95711" selected="true" /><select idref="V-95713" selected="true" /><select idref="V-95715" selected="true" /><select idref="V-95719" selected="true" /><select idref="V-95721" selected="true" /><select idref="V-95723" selected="true" /><select idref="V-95725" selected="true" /><select idref="V-95727" selected="true" /><select idref="V-95729" selected="true" /><select idref="V-95731" selected="true" /><select idref="V-95733" selected="true" /><select idref="V-95735" selected="true" /><select idref="V-95739" selected="true" /><select idref="V-95741" selected="true" /><select idref="V-95743" selected="true" /><select idref="V-95745" selected="true" /><select idref="V-95747" selected="true" /><select idref="V-95749" selected="true" /><select idref="V-95751" selected="true" /><select idref="V-95753" selected="true" /><select idref="V-95755" selected="true" /><select idref="V-95757" selected="true" /><select idref="V-95759" selected="true" /><select idref="V-95761" selected="true" /><select idref="V-95763" selected="true" /><select idref="V-95765" selected="true" /><select idref="V-95767" selected="true" /><select idref="V-95769" selected="true" /><select idref="V-95771" selected="true" /><select idref="V-95773" selected="true" /><select idref="V-95775" selected="true" /><select idref="V-95777" selected="true" /><select idref="V-95779" selected="true" /><select idref="V-95781" selected="true" /><select idref="V-95783" selected="true" /><select idref="V-95785" selected="true" /><select idref="V-96003" selected="true" /></Profile><Group id="V-94863"><title>SRG-APP-000001</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104693r1_rule" severity="low" weight="10.0"><version>DKER-EE-001000</version><title>The Docker Enterprise Per User Limit Login Session Control in the Universal Control Plane (UCP) Admin Settings must be set to an organization-defined value for all accounts and/or account types.</title><description>&lt;VulnDiscussion&gt;The UCP component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and subsequently configured to limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types. Per-user session control limits are configured with a default of 10. For reference, the per user limit in UCP specifies the maximum number of sessions that any user can have active at any given time. If creating a new session would put a user over this limit then the least recently used session will be deleted. A value of zero disables limiting the number of sessions that users may have. This configuration applies to both the UCP and DTR management consoles.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-101009r1_fix">Set the "Per User Limit" Login Session Control in the UCP Admin Settings per the requirements set forth by the System Security Plan (SSP).
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?>
+<Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:cpe="http://cpe.mitre.org/language/2.0"
+    xmlns:xhtml="http://www.w3.org/1999/xhtml"
+    xmlns:dc="http://purl.org/dc/elements/1.1/" id="Docker_Enterprise_2-x_Linux-UNIX_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd"
+    xmlns="http://checklists.nist.gov/xccdf/1.1">
+    <status date="2019-09-13">accepted</status>
+    <title>Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide</title>
+    <description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description>
+    <notice id="terms-of-use" xml:lang="en"></notice>
+    <reference href="https://public.cyber.mil">
+        <dc:publisher>DISA</dc:publisher>
+        <dc:source>STIG.DOD.MIL</dc:source>
+    </reference>
+    <plain-text id="release-info">Release: 1 Benchmark Date: 19 Jul 2019</plain-text>
+    <version>1</version>
+    <Profile id="MAC-1_Classified">
+        <title>I - Mission Critical Classified</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-1_Public">
+        <title>I - Mission Critical Public</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-1_Sensitive">
+        <title>I - Mission Critical Sensitive</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-2_Classified">
+        <title>II - Mission Support Classified</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-2_Public">
+        <title>II - Mission Support Public</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-2_Sensitive">
+        <title>II - Mission Support Sensitive</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-3_Classified">
+        <title>III - Administrative Classified</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-3_Public">
+        <title>III - Administrative Public</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Profile id="MAC-3_Sensitive">
+        <title>III - Administrative Sensitive</title>
+        <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
+        <select idref="V-94863" selected="true" />
+        <select idref="V-94865" selected="true" />
+        <select idref="V-94867" selected="true" />
+        <select idref="V-94869" selected="true" />
+        <select idref="V-95111" selected="true" />
+        <select idref="V-95113" selected="true" />
+        <select idref="V-95355" selected="true" />
+        <select idref="V-95357" selected="true" />
+        <select idref="V-95599" selected="true" />
+        <select idref="V-95601" selected="true" />
+        <select idref="V-95603" selected="true" />
+        <select idref="V-95605" selected="true" />
+        <select idref="V-95607" selected="true" />
+        <select idref="V-95609" selected="true" />
+        <select idref="V-95611" selected="true" />
+        <select idref="V-95613" selected="true" />
+        <select idref="V-95615" selected="true" />
+        <select idref="V-95617" selected="true" />
+        <select idref="V-95619" selected="true" />
+        <select idref="V-95621" selected="true" />
+        <select idref="V-95623" selected="true" />
+        <select idref="V-95625" selected="true" />
+        <select idref="V-95627" selected="true" />
+        <select idref="V-95629" selected="true" />
+        <select idref="V-95631" selected="true" />
+        <select idref="V-95635" selected="true" />
+        <select idref="V-95637" selected="true" />
+        <select idref="V-95639" selected="true" />
+        <select idref="V-95641" selected="true" />
+        <select idref="V-95643" selected="true" />
+        <select idref="V-95645" selected="true" />
+        <select idref="V-95647" selected="true" />
+        <select idref="V-95649" selected="true" />
+        <select idref="V-95651" selected="true" />
+        <select idref="V-95653" selected="true" />
+        <select idref="V-95655" selected="true" />
+        <select idref="V-95657" selected="true" />
+        <select idref="V-95659" selected="true" />
+        <select idref="V-95661" selected="true" />
+        <select idref="V-95663" selected="true" />
+        <select idref="V-95665" selected="true" />
+        <select idref="V-95667" selected="true" />
+        <select idref="V-95669" selected="true" />
+        <select idref="V-95671" selected="true" />
+        <select idref="V-95673" selected="true" />
+        <select idref="V-95675" selected="true" />
+        <select idref="V-95677" selected="true" />
+        <select idref="V-95679" selected="true" />
+        <select idref="V-95681" selected="true" />
+        <select idref="V-95683" selected="true" />
+        <select idref="V-95685" selected="true" />
+        <select idref="V-95687" selected="true" />
+        <select idref="V-95689" selected="true" />
+        <select idref="V-95691" selected="true" />
+        <select idref="V-95693" selected="true" />
+        <select idref="V-95695" selected="true" />
+        <select idref="V-95697" selected="true" />
+        <select idref="V-95699" selected="true" />
+        <select idref="V-95701" selected="true" />
+        <select idref="V-95703" selected="true" />
+        <select idref="V-95705" selected="true" />
+        <select idref="V-95707" selected="true" />
+        <select idref="V-95709" selected="true" />
+        <select idref="V-95711" selected="true" />
+        <select idref="V-95713" selected="true" />
+        <select idref="V-95715" selected="true" />
+        <select idref="V-95719" selected="true" />
+        <select idref="V-95721" selected="true" />
+        <select idref="V-95723" selected="true" />
+        <select idref="V-95725" selected="true" />
+        <select idref="V-95727" selected="true" />
+        <select idref="V-95729" selected="true" />
+        <select idref="V-95731" selected="true" />
+        <select idref="V-95733" selected="true" />
+        <select idref="V-95735" selected="true" />
+        <select idref="V-95739" selected="true" />
+        <select idref="V-95741" selected="true" />
+        <select idref="V-95743" selected="true" />
+        <select idref="V-95745" selected="true" />
+        <select idref="V-95747" selected="true" />
+        <select idref="V-95749" selected="true" />
+        <select idref="V-95751" selected="true" />
+        <select idref="V-95753" selected="true" />
+        <select idref="V-95755" selected="true" />
+        <select idref="V-95757" selected="true" />
+        <select idref="V-95759" selected="true" />
+        <select idref="V-95761" selected="true" />
+        <select idref="V-95763" selected="true" />
+        <select idref="V-95765" selected="true" />
+        <select idref="V-95767" selected="true" />
+        <select idref="V-95769" selected="true" />
+        <select idref="V-95771" selected="true" />
+        <select idref="V-95773" selected="true" />
+        <select idref="V-95775" selected="true" />
+        <select idref="V-95777" selected="true" />
+        <select idref="V-95779" selected="true" />
+        <select idref="V-95781" selected="true" />
+        <select idref="V-95783" selected="true" />
+        <select idref="V-95785" selected="true" />
+        <select idref="V-96003" selected="true" />
+    </Profile>
+    <Group id="V-94863">
+        <title>SRG-APP-000001</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104693r1_rule" severity="low" weight="10.0">
+            <version>DKER-EE-001000</version>
+            <title>The Docker Enterprise Per User Limit Login Session Control in the Universal Control Plane (UCP) Admin Settings must be set to an organization-defined value for all accounts and/or account types.</title>
+            <description>&lt;VulnDiscussion&gt;The UCP component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and subsequently configured to limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types. Per-user session control limits are configured with a default of 10. For reference, the per user limit in UCP specifies the maximum number of sessions that any user can have active at any given time. If creating a new session would put a user over this limit then the least recently used session will be deleted. A value of zero disables limiting the number of sessions that users may have. This configuration applies to both the UCP and DTR management consoles.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000054</ident>
+            <fixtext fixref="F-101009r1_fix">Set the "Per User Limit" Login Session Control in the UCP Admin Settings per the requirements set forth by the System Security Plan (SSP).
 
 via UI:
 
@@ -6,16 +974,18 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on either a UCP Manager node or using a UCP client bundle. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on either a UCP Manager node or using a UCP client bundle. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "per_user_limit" entry under the "[auth.sessions]" section according to the requirements of this control. Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101009r1_fix" /><check system="C-94171r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Check that the "Per User Limit" Login Session Control in the UCP Admin Settings is set according to the values defined in the System Security Plan.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101009r1_fix" />
+            <check system="C-94171r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Check that the "Per User Limit" Login Session Control in the UCP Admin Settings is set according to the values defined in the System Security Plan.
 
 via UI:
 
@@ -23,16 +993,41 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml|grep per_user_limit
 
-If the "per_user_limit" entry under the "[auth.sessions]" section in the output is not set according to the value defined in the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-94865"><title>SRG-APP-000014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104695r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001050</version><title>TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.</title><description>&lt;VulnDiscussion&gt;The UCP component of Docker Enterprise configures and leverages Swarm Mode for node-to-node cluster communication. Swarm Mode is built in to Docker Engine - Enterprise and uses TLS 1.2 at a minimum for encrypting communications. Under the hood, Swarm Mode includes an embedded public key infrastructure (PKI) system. When a UCP cluster is initialized, the first node in the cluster designates itself as a manager node. That node subsequently generates a new root Certificate Authority (CA) along with a key pair, which are used to secure communications with other UCP nodes that join the swarm. One can also specify his/her own externally-generated root CA upon initialization of a UCP cluster. The manager node also generates two tokens to use when joining additional nodes to the cluster: one worker token and one manager token. Each token includes the digest of the root CA’s certificate and a randomly generated secret. When a node joins the cluster, the joining node uses the digest to validate the root CA certificate from the remote manager. The remote manager uses the secret to ensure the joining node is an approved node. Each time a new node joins the cluster, the manager issues a certificate to the node. The certificate contains a randomly generated node ID to identify the node under the certificate common name (CN) and the role under the organizational unit (OU). The node ID serves as the cryptographically secure node identity for the lifetime of the node in the current swarm. In this mutual TLS architecture, all nodes encrypt communications using a minimum of TLS 1.2, thereby satisfying the requirements of this control. This information can also be referenced at https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/ and https://docs.docker.com/ee/ucp/ucp-architecture/.
+If the "per_user_limit" entry under the "[auth.sessions]" section in the output is not set according to the value defined in the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-94865">
+        <title>SRG-APP-000014</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104695r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001050</version>
+            <title>TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.</title>
+            <description>&lt;VulnDiscussion&gt;The UCP component of Docker Enterprise configures and leverages Swarm Mode for node-to-node cluster communication. Swarm Mode is built in to Docker Engine - Enterprise and uses TLS 1.2 at a minimum for encrypting communications. Under the hood, Swarm Mode includes an embedded public key infrastructure (PKI) system. When a UCP cluster is initialized, the first node in the cluster designates itself as a manager node. That node subsequently generates a new root Certificate Authority (CA) along with a key pair, which are used to secure communications with other UCP nodes that join the swarm. One can also specify his/her own externally-generated root CA upon initialization of a UCP cluster. The manager node also generates two tokens to use when joining additional nodes to the cluster: one worker token and one manager token. Each token includes the digest of the root CA’s certificate and a randomly generated secret. When a node joins the cluster, the joining node uses the digest to validate the root CA certificate from the remote manager. The remote manager uses the secret to ensure the joining node is an approved node. Each time a new node joins the cluster, the manager issues a certificate to the node. The certificate contains a randomly generated node ID to identify the node under the certificate common name (CN) and the role under the organizational unit (OU). The node ID serves as the cryptographically secure node identity for the lifetime of the node in the current swarm. In this mutual TLS architecture, all nodes encrypt communications using a minimum of TLS 1.2, thereby satisfying the requirements of this control. This information can also be referenced at https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/ and https://docs.docker.com/ee/ucp/ucp-architecture/.
 
 By itself, Docker Engine - Enterprise is configured by default to listen for API requests via a UNIX domain socket (or IPC socket) created at /var/run/docker.sock on supported Linux distributions and via a named pipe at npipe:////./pipe/docker_engine on Windows Server 2016 and newer. Docker Engine - Enterprise can also be configured to listen for API requests via additional socket types, including both TCP and FD (only on supported systemd-based Linux distributions). If configured to listen for API requests via the TCP socket type over TCP port 2376 and with the daemon flags and SSL certificates, then, at a minimum, TLS 1.2 is used for encryption; therefore this control is applicable and is inherently met in this configuration. If configured to listen for API requests via the TCP socket type, but without TLS verification and certifications, then the instance remains vulnerable and is not properly configured to meet the requirements of this control. If configured to listen for API requests via the FD socket type, then this control is not applicable. More information can be found at https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-socket-option. The TCP socket binding should be disabled when running Engine as part of a UCP cluster.
 
-Satisfies: SRG-APP-000014, SRG-APP-000141, SRG-APP-000219, SRG-APP-000383, SRG-APP-000439, SRG-APP-000440, SRG-APP-000441, SRG-APP-000442, SRG-APP-000142&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><ident system="http://iase.disa.mil/cci">CCI-000381</ident><ident system="http://iase.disa.mil/cci">CCI-000382</ident><ident system="http://iase.disa.mil/cci">CCI-001184</ident><ident system="http://iase.disa.mil/cci">CCI-001762</ident><ident system="http://iase.disa.mil/cci">CCI-002418</ident><ident system="http://iase.disa.mil/cci">CCI-002420</ident><ident system="http://iase.disa.mil/cci">CCI-002421</ident><ident system="http://iase.disa.mil/cci">CCI-002422</ident><fixtext fixref="F-101011r1_fix">This fix only applies to Docker Engine - Enterprise nodes that are part of a UCP cluster.
+Satisfies: SRG-APP-000014, SRG-APP-000141, SRG-APP-000219, SRG-APP-000383, SRG-APP-000439, SRG-APP-000440, SRG-APP-000441, SRG-APP-000442, SRG-APP-000142&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000068</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000382</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001184</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001762</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002418</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002420</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002421</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002422</ident>
+            <fixtext fixref="F-101011r1_fix">This fix only applies to Docker Engine - Enterprise nodes that are part of a UCP cluster.
 
 Apply this fix to every node in the cluster.
 
@@ -48,7 +1043,11 @@ sudo systemctl daemon-reload
 
 Restart Docker with the following command:
 
-sudo systemctl restart docker.service</fixtext><fix id="F-101011r1_fix" /><check system="C-94173r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+sudo systemctl restart docker.service</fixtext>
+            <fix id="F-101011r1_fix" />
+            <check system="C-94173r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
@@ -58,13 +1057,46 @@ ps -ef | grep dockerd
 
 If -H UNIX://, this is not a finding.
 
-If the "-H TCP://[host]" argument appears in the output, then this is a finding.</check-content></check></Rule></Group><Group id="V-94867"><title>SRG-APP-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104697r1_rule" severity="high" weight="10.0"><version>DKER-EE-001070</version><title>FIPS mode must be enabled on all Docker Engine - Enterprise nodes.</title><description>&lt;VulnDiscussion&gt;When FIPS mode is enabled on a Docker Engine - Enterprise node, it uses FIPS-validated cryptography to protect the confidentiality of remote access sessions to any bound TCP sockets with TLS enabled and configured. FIPS mode in Docker Engine - Enterprise is automatically enabled when FIPS mode is also enabled on the underlying host operating system.
+If the "-H TCP://[host]" argument appears in the output, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-94867">
+        <title>SRG-APP-000015</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104697r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-001070</version>
+            <title>FIPS mode must be enabled on all Docker Engine - Enterprise nodes.</title>
+            <description>&lt;VulnDiscussion&gt;When FIPS mode is enabled on a Docker Engine - Enterprise node, it uses FIPS-validated cryptography to protect the confidentiality of remote access sessions to any bound TCP sockets with TLS enabled and configured. FIPS mode in Docker Engine - Enterprise is automatically enabled when FIPS mode is also enabled on the underlying host operating system.
 
 This control is only configurable for the Docker Engine - Enterprise component of Docker Enterprise as only the Engine includes FIPS-validated cryptography. Neither Universal Control Plane (UCP) nor Docker Trusted Registry (DTR) include FIPS-validated cryptography at this time. However, both UCP and DTR will include FIPS-validated cryptography in a future release. Therefore, for UCP/DTR this control is applicable but not yet met.
 
-Satisfies: SRG-APP-000015, SRG-APP-000231, SRG-APP-000014, SRG-APP-000570, SRG-APP-000395, SRG-APP-000514, SRG-APP-000416, SRG-APP-000156, SRG-APP-000172, SRG-APP-000179, SRG-APP-000224, SRG-APP-000411, SRG-APP-000412, SRG-APP-000555, SRG-APP-000635&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><ident system="http://iase.disa.mil/cci">CCI-000197</ident><ident system="http://iase.disa.mil/cci">CCI-000803</ident><ident system="http://iase.disa.mil/cci">CCI-001188</ident><ident system="http://iase.disa.mil/cci">CCI-001199</ident><ident system="http://iase.disa.mil/cci">CCI-001453</ident><ident system="http://iase.disa.mil/cci">CCI-001941</ident><ident system="http://iase.disa.mil/cci">CCI-001967</ident><ident system="http://iase.disa.mil/cci">CCI-002450</ident><ident system="http://iase.disa.mil/cci">CCI-002890</ident><ident system="http://iase.disa.mil/cci">CCI-003123</ident><fixtext fixref="F-101013r1_fix">Enable FIPS mode on the host operating system. Start the Engine after FIPS mode is enabled on the host to automatically enable FIPS mode on the Engine.
-
-FIPS mode can also be enabled by explicitly setting the DOCKER_FIPS=1 environment variable in an active terminal session prior to the execution of any Docker commands.</fixtext><fix id="F-101013r1_fix" /><check system="C-94175r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to Docker Engine - Enterprise.
+Satisfies: SRG-APP-000015, SRG-APP-000231, SRG-APP-000014, SRG-APP-000570, SRG-APP-000395, SRG-APP-000514, SRG-APP-000416, SRG-APP-000156, SRG-APP-000172, SRG-APP-000179, SRG-APP-000224, SRG-APP-000411, SRG-APP-000412, SRG-APP-000555, SRG-APP-000635&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000068</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000197</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000803</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001188</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001199</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001453</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001941</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001967</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002450</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002890</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-003123</ident>
+            <fixtext fixref="F-101013r1_fix">Enable FIPS mode on the host operating system. Start the Engine after FIPS mode is enabled on the host to automatically enable FIPS mode on the Engine.
+
+FIPS mode can also be enabled by explicitly setting the DOCKER_FIPS=1 environment variable in an active terminal session prior to the execution of any Docker commands.</fixtext>
+            <fix id="F-101013r1_fix" />
+            <check system="C-94175r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to Docker Engine - Enterprise.
 
 Verify FIPS mode is enabled on the host operating system.
 
@@ -74,7 +1106,17 @@ docker info
 
 The "Security Options" section in the response should show a "fips" label, indicating that, when configured, the remotely accessible Engine API uses FIPS-validated digital signatures in conjunction with an approved hash function to protect the integrity of remote access sessions.
 
-If the "fips" label is not shown in the "Security Options" section, then this is a finding.</check-content></check></Rule></Group><Group id="V-94869"><title>SRG-APP-000016</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104699r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001080</version><title>The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If the "fips" label is not shown in the "Security Options" section, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-94869">
+        <title>SRG-APP-000016</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104699r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001080</version>
+            <title>The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -95,7 +1137,32 @@ DTR audits all events associated with repository activities. Events are consider
 
 The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.
 
-Satisfies: SRG-APP-000016, SRG-APP-000089, SRG-APP-000515, SRG-APP-000510, SRG-APP-000509, SRG-APP-000508, SRG-APP-000507, SRG-APP-000506, SRG-APP-000505, SRG-APP-000504, SRG-APP-000503, SRG-APP-000502, SRG-APP-000501, SRG-APP-000500, SRG-APP-000499, SRG-APP-000498, SRG-APP-000497, SRG-APP-000496, SRG-APP-000495, SRG-APP-000494, SRG-APP-000493, SRG-APP-000492, SRG-APP-000484, SRG-APP-000447, SRG-APP-000381, SRG-APP-000343, SRG-APP-000101, SRG-APP-000100, SRG-APP-000099, SRG-APP-000098, SRG-APP-000097, SRG-APP-000096, SRG-APP-000095, SRG-APP-000093, SRG-APP-000092, SRG-APP-000091&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000067</ident><ident system="http://iase.disa.mil/cci">CCI-000130</ident><ident system="http://iase.disa.mil/cci">CCI-000131</ident><ident system="http://iase.disa.mil/cci">CCI-000132</ident><ident system="http://iase.disa.mil/cci">CCI-000133</ident><ident system="http://iase.disa.mil/cci">CCI-000134</ident><ident system="http://iase.disa.mil/cci">CCI-000135</ident><ident system="http://iase.disa.mil/cci">CCI-000169</ident><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-001462</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><ident system="http://iase.disa.mil/cci">CCI-001487</ident><ident system="http://iase.disa.mil/cci">CCI-001814</ident><ident system="http://iase.disa.mil/cci">CCI-001851</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><ident system="http://iase.disa.mil/cci">CCI-002723</ident><ident system="http://iase.disa.mil/cci">CCI-002754</ident><fixtext fixref="F-101015r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+Satisfies: SRG-APP-000016, SRG-APP-000089, SRG-APP-000515, SRG-APP-000510, SRG-APP-000509, SRG-APP-000508, SRG-APP-000507, SRG-APP-000506, SRG-APP-000505, SRG-APP-000504, SRG-APP-000503, SRG-APP-000502, SRG-APP-000501, SRG-APP-000500, SRG-APP-000499, SRG-APP-000498, SRG-APP-000497, SRG-APP-000496, SRG-APP-000495, SRG-APP-000494, SRG-APP-000493, SRG-APP-000492, SRG-APP-000484, SRG-APP-000447, SRG-APP-000381, SRG-APP-000343, SRG-APP-000101, SRG-APP-000100, SRG-APP-000099, SRG-APP-000098, SRG-APP-000097, SRG-APP-000096, SRG-APP-000095, SRG-APP-000093, SRG-APP-000092, SRG-APP-000091&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000067</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000130</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000131</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000132</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000133</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000134</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000135</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000169</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000172</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001462</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001464</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001487</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001814</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001851</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002234</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002723</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002754</ident>
+            <fixtext fixref="F-101015r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Set the remote syslog configuration in UCP:
 
@@ -105,9 +1172,7 @@ As a Docker EE Admin, navigate to "Admin Settings" | "Audit Logs" in the UCP man
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file under the "[audit_log_configuration]" section set "level = request". 
@@ -115,7 +1180,11 @@ Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101015r1_fix" /><check system="C-94177r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101015r1_fix" />
+            <check system="C-94177r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Verify that the audit log configuration level in UCP is set to "request":
 
@@ -125,14 +1194,22 @@ As a Docker EE Admin, navigate to "Admin Settings" | "Audit Logs" in the UCP man
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "level" entry under the "[audit_log_configuration]" section in the output, and verify that it is set to "request".
 
-If the "level" entry under the "[audit_log_configuration]" section in the output is not set to "request", then this is a finding.</check-content></check></Rule></Group><Group id="V-95111"><title>SRG-APP-000016</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104701r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001090</version><title>The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If the "level" entry under the "[audit_log_configuration]" section in the output is not set to "request", then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95111">
+        <title>SRG-APP-000016</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104701r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001090</version>
+            <title>The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -153,7 +1230,34 @@ DTR audits all events associated with repository activities. Events are consider
 
 The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.
 
-Satisfies: SRG-APP-000016, SRG-APP-000090, SRG-APP-000091, SRG-APP-000097, SRG-APP-000098, SRG-APP-000496, SRG-APP-000504, SRG-APP-000510, SRG-APP-000509, SRG-APP-000508, SRG-APP-000507, SRG-APP-000506, SRG-APP-000505, SRG-APP-000503, SRG-APP-000502, SRG-APP-000500, SRG-APP-000499, SRG-APP-000498, SRG-APP-000497, SRG-APP-000495, SRG-APP-000494, SRG-APP-000493, SRG-APP-000492, SRG-APP-000485, SRG-APP-000484, SRG-APP-000381, SRG-APP-000343, SRG-APP-000115, SRG-APP-000111, SRG-APP-000101, SRG-APP-000100, SRG-APP-000099, SRG-APP-000096, SRG-APP-000095, SRG-APP-000092, SRG-APP-000089, SRG-APP-000501, SRG-APP-000447&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000067</ident><ident system="http://iase.disa.mil/cci">CCI-000130</ident><ident system="http://iase.disa.mil/cci">CCI-000131</ident><ident system="http://iase.disa.mil/cci">CCI-000132</ident><ident system="http://iase.disa.mil/cci">CCI-000133</ident><ident system="http://iase.disa.mil/cci">CCI-000134</ident><ident system="http://iase.disa.mil/cci">CCI-000135</ident><ident system="http://iase.disa.mil/cci">CCI-000154</ident><ident system="http://iase.disa.mil/cci">CCI-000158</ident><ident system="http://iase.disa.mil/cci">CCI-000169</ident><ident system="http://iase.disa.mil/cci">CCI-000171</ident><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><ident system="http://iase.disa.mil/cci">CCI-001487</ident><ident system="http://iase.disa.mil/cci">CCI-001814</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><ident system="http://iase.disa.mil/cci">CCI-002723</ident><ident system="http://iase.disa.mil/cci">CCI-002724</ident><ident system="http://iase.disa.mil/cci">CCI-002754</ident><fixtext fixref="F-101017r1_fix">This fix applies to the underlying host operating system on which the Docker Engine - Enterprise instance is running.
+Satisfies: SRG-APP-000016, SRG-APP-000090, SRG-APP-000091, SRG-APP-000097, SRG-APP-000098, SRG-APP-000496, SRG-APP-000504, SRG-APP-000510, SRG-APP-000509, SRG-APP-000508, SRG-APP-000507, SRG-APP-000506, SRG-APP-000505, SRG-APP-000503, SRG-APP-000502, SRG-APP-000500, SRG-APP-000499, SRG-APP-000498, SRG-APP-000497, SRG-APP-000495, SRG-APP-000494, SRG-APP-000493, SRG-APP-000492, SRG-APP-000485, SRG-APP-000484, SRG-APP-000381, SRG-APP-000343, SRG-APP-000115, SRG-APP-000111, SRG-APP-000101, SRG-APP-000100, SRG-APP-000099, SRG-APP-000096, SRG-APP-000095, SRG-APP-000092, SRG-APP-000089, SRG-APP-000501, SRG-APP-000447&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000067</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000130</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000131</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000132</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000133</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000134</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000135</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000154</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000158</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000169</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000171</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000172</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001464</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001487</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001814</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002234</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002723</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002724</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002754</ident>
+            <fixtext fixref="F-101017r1_fix">This fix applies to the underlying host operating system on which the Docker Engine - Enterprise instance is running.
 
 Enable and configure audit policies for Docker Engine - Enterprise on the host operating system:
 
@@ -167,7 +1271,11 @@ auditctl -w [docker.socket-path] -k docker (where [docker.socket-path] is the re
 auditctl -w /etc/default/docker -k docker
 auditctl -w /etc/docker/daemon.json
 auditctl -w /usr/bin/docker-containerd -k docker
-auditctl -w /usr/bin/docker-runc -k docker</fixtext><fix id="F-101017r1_fix" /><check system="C-94179r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the underlying host operating system on which the Docker Engine - Enterprise instance is running.
+auditctl -w /usr/bin/docker-runc -k docker</fixtext>
+            <fix id="F-101017r1_fix" />
+            <check system="C-94179r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the underlying host operating system on which the Docker Engine - Enterprise instance is running.
 
 Verify that the auditing capabilities provided by the underlying host have been properly configured to audit Docker Engine - Enterprise:
 
@@ -178,9 +1286,37 @@ auditctl -l | grep -e /usr/bin/docker -e /var/lib/docker -e /etc/docker -e /etc/
 systemctl show -p FragmentPath docker.service or auditctl -l | grep docker.service
 systemctl show -p FragmentPath docker.socket or auditctl -l | grep docker.sock
 
-If audit rules aren't properly configured for the paths and services listed above, then this is a finding.</check-content></check></Rule></Group><Group id="V-95113"><title>SRG-APP-000023</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104703r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001100</version><title>LDAP integration in Docker Enterprise must be configured.</title><description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane provides automated mechanisms for supporting account management functions and allows for LDAP integration in UCP and DTR. While eNZi includes its own managed user database, it is recommended that LDAP integration be configured to more completely satisfy the requirements of this control.
-
-Satisfies: SRG-APP-000023, SRG-APP-000405, SRG-APP-000404, SRG-APP-000403, SRG-APP-000401, SRG-APP-000397, SRG-APP-000392, SRG-APP-000148, SRG-APP-000141, SRG-APP-000391&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000015</ident><ident system="http://iase.disa.mil/cci">CCI-000381</ident><ident system="http://iase.disa.mil/cci">CCI-000764</ident><ident system="http://iase.disa.mil/cci">CCI-001953</ident><ident system="http://iase.disa.mil/cci">CCI-001954</ident><ident system="http://iase.disa.mil/cci">CCI-001991</ident><ident system="http://iase.disa.mil/cci">CCI-002010</ident><ident system="http://iase.disa.mil/cci">CCI-002011</ident><ident system="http://iase.disa.mil/cci">CCI-002014</ident><ident system="http://iase.disa.mil/cci">CCI-002041</ident><fixtext fixref="F-101019r1_fix">Enable and configure LDAP integration in the UCP Admin Settings.
+If audit rules aren't properly configured for the paths and services listed above, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95113">
+        <title>SRG-APP-000023</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104703r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001100</version>
+            <title>LDAP integration in Docker Enterprise must be configured.</title>
+            <description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane provides automated mechanisms for supporting account management functions and allows for LDAP integration in UCP and DTR. While eNZi includes its own managed user database, it is recommended that LDAP integration be configured to more completely satisfy the requirements of this control.
+
+Satisfies: SRG-APP-000023, SRG-APP-000405, SRG-APP-000404, SRG-APP-000403, SRG-APP-000401, SRG-APP-000397, SRG-APP-000392, SRG-APP-000148, SRG-APP-000141, SRG-APP-000391&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000015</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000764</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001953</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001954</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001991</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002010</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002011</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002014</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002041</ident>
+            <fixtext fixref="F-101019r1_fix">Enable and configure LDAP integration in the UCP Admin Settings.
 
 via UI:
 
@@ -188,16 +1324,18 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on either a UCP Manager node or using a UCP client bundle. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on either a UCP Manager node or using a UCP client bundle. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "backend" entry under the "[auth]" section to "ldap", and add an "[auth.ldap]" sub-section per the UCP configuration options as documented at https://docs.docker.com/ee/ucp/admin/configure/ucp-configuration-file/#authldap-optional. Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101019r1_fix" /><check system="C-94181r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that LDAP integration is enabled and properly configured in the UCP Admin Settings and verify that the LDAP/AD server is configured per the requirements set forth
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101019r1_fix" />
+            <check system="C-94181r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that LDAP integration is enabled and properly configured in the UCP Admin Settings and verify that the LDAP/AD server is configured per the requirements set forth
 in the appropriate OS STIG.
 
 via UI:
@@ -208,16 +1346,49 @@ If it is not set to yes and if the LDAP server is not configured then this is a
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "backend" entry under the "[auth]" section in the output, and verify that it is set to "ldap". *NOTE: For security reasons, the "[auth.ldap]" section is not stored in the config file and can only be viewed from the UCP Admin Settings UI.
 
-If the "backend =" entry under the "[auth]" section in the output is not set to "ldap", then this is a finding.</check-content></check></Rule></Group><Group id="V-95355"><title>SRG-APP-000033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104705r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001170</version><title>A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.</title><description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. eNZi provides UCP and DTR with role-based access control functionality to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. While role-based access control mechanisms are provided regardless of whether or not LDAP integration is enabled, it is recommended to enable LDAP integration to better meet the requirements of this control.
-
-Satisfies: SRG-APP-000033, SRG-APP-000038, SRG-APP-000039, SRG-APP-000080, SRG-APP-000243, SRG-APP-000246, SRG-APP-000247, SRG-APP-000267, SRG-APP-000311, SRG-APP-000313, SRG-APP-000314, SRG-APP-000328, SRG-APP-000340, SRG-APP-000342, SRG-APP-000378, SRG-APP-000380, SRG-APP-000384&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000166</ident><ident system="http://iase.disa.mil/cci">CCI-000213</ident><ident system="http://iase.disa.mil/cci">CCI-001090</ident><ident system="http://iase.disa.mil/cci">CCI-001094</ident><ident system="http://iase.disa.mil/cci">CCI-001095</ident><ident system="http://iase.disa.mil/cci">CCI-001314</ident><ident system="http://iase.disa.mil/cci">CCI-001368</ident><ident system="http://iase.disa.mil/cci">CCI-001414</ident><ident system="http://iase.disa.mil/cci">CCI-001764</ident><ident system="http://iase.disa.mil/cci">CCI-001812</ident><ident system="http://iase.disa.mil/cci">CCI-001813</ident><ident system="http://iase.disa.mil/cci">CCI-002165</ident><ident system="http://iase.disa.mil/cci">CCI-002233</ident><ident system="http://iase.disa.mil/cci">CCI-002235</ident><ident system="http://iase.disa.mil/cci">CCI-002262</ident><ident system="http://iase.disa.mil/cci">CCI-002263</ident><ident system="http://iase.disa.mil/cci">CCI-002264</ident><fixtext fixref="F-101021r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+If the "backend =" entry under the "[auth]" section in the output is not set to "ldap", then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95355">
+        <title>SRG-APP-000033</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104705r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001170</version>
+            <title>A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.</title>
+            <description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. eNZi provides UCP and DTR with role-based access control functionality to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. While role-based access control mechanisms are provided regardless of whether or not LDAP integration is enabled, it is recommended to enable LDAP integration to better meet the requirements of this control.
+
+Satisfies: SRG-APP-000033, SRG-APP-000038, SRG-APP-000039, SRG-APP-000080, SRG-APP-000243, SRG-APP-000246, SRG-APP-000247, SRG-APP-000267, SRG-APP-000311, SRG-APP-000313, SRG-APP-000314, SRG-APP-000328, SRG-APP-000340, SRG-APP-000342, SRG-APP-000378, SRG-APP-000380, SRG-APP-000384&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000166</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000213</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001090</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001094</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001095</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001314</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001368</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001414</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001764</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001812</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001813</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002165</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002233</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002235</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002262</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002263</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002264</ident>
+            <fixtext fixref="F-101021r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Apply RBAC policy sets in UCP per the requirements set forth by the SSP.
 
@@ -227,13 +1398,15 @@ As a Docker EE Admin, navigate to "Access Control" | "Grants" in the UCP web con
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 
 Create grants for Swarm for applicable subjects, objects and roles using the following command:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X PUT https://[ucp_url]/collectionGrants/[subjectID]/[objectID]/[roleID]</fixtext><fix id="F-101021r1_fix" /><check system="C-94183r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise. 
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X PUT https://[ucp_url]/collectionGrants/[subjectID]/[objectID]/[roleID]</fixtext>
+            <fix id="F-101021r1_fix" />
+            <check system="C-94183r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise. 
 
 Verify that the applied RBAC policy sets in UCP are configured per the requirements set forth by the System Security Plan (SSP).
 
@@ -245,17 +1418,50 @@ If the applied RBAC policy sets in UCP are not configured per the requirements s
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/collectionGrants?subjectType=all&amp;expandUser=true&amp;showPaths=true
 
 Verify that all grants applied to Swarm in the API response are configured per the requirements set forth by the System Security Plan (SSP).
 
-If the applied RBAC policy sets in UCP are not configured per the requirements set forth by the SSP, then this is a finding.</check-content></check></Rule></Group><Group id="V-95357"><title>SRG-APP-000033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104707r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001180</version><title>A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set.</title><description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and DTR components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. eNZi provides UCP and DTR with role-based access control functionality to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. These policies are defined in the System Security Plan along with organization information, application user roles, system resources and access requirements. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. While role-based access control mechanisms are provided regardless of whether or not LDAP integration is enabled, it is recommended to enable LDAP integration to better meet the requirements of this control.
-
-Satisfies: SRG-APP-000033, SRG-APP-000243, SRG-APP-000246, SRG-APP-000247, SRG-APP-000267, SRG-APP-000328, SRG-APP-000340, SRG-APP-000342, SRG-APP-000378, SRG-APP-000380, SRG-APP-000384, SRG-APP-000038, SRG-APP-000039, SRG-APP-000080, SRG-APP-000311, SRG-APP-000313, SRG-APP-000314&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000166</ident><ident system="http://iase.disa.mil/cci">CCI-000213</ident><ident system="http://iase.disa.mil/cci">CCI-001090</ident><ident system="http://iase.disa.mil/cci">CCI-001094</ident><ident system="http://iase.disa.mil/cci">CCI-001095</ident><ident system="http://iase.disa.mil/cci">CCI-001314</ident><ident system="http://iase.disa.mil/cci">CCI-001368</ident><ident system="http://iase.disa.mil/cci">CCI-001414</ident><ident system="http://iase.disa.mil/cci">CCI-001764</ident><ident system="http://iase.disa.mil/cci">CCI-001812</ident><ident system="http://iase.disa.mil/cci">CCI-001813</ident><ident system="http://iase.disa.mil/cci">CCI-002165</ident><ident system="http://iase.disa.mil/cci">CCI-002233</ident><ident system="http://iase.disa.mil/cci">CCI-002235</ident><ident system="http://iase.disa.mil/cci">CCI-002262</ident><ident system="http://iase.disa.mil/cci">CCI-002263</ident><ident system="http://iase.disa.mil/cci">CCI-002264</ident><fixtext fixref="F-101023r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+If the applied RBAC policy sets in UCP are not configured per the requirements set forth by the SSP, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95357">
+        <title>SRG-APP-000033</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104707r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001180</version>
+            <title>A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set.</title>
+            <description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and DTR components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. eNZi provides UCP and DTR with role-based access control functionality to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. These policies are defined in the System Security Plan along with organization information, application user roles, system resources and access requirements. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. While role-based access control mechanisms are provided regardless of whether or not LDAP integration is enabled, it is recommended to enable LDAP integration to better meet the requirements of this control.
+
+Satisfies: SRG-APP-000033, SRG-APP-000243, SRG-APP-000246, SRG-APP-000247, SRG-APP-000267, SRG-APP-000328, SRG-APP-000340, SRG-APP-000342, SRG-APP-000378, SRG-APP-000380, SRG-APP-000384, SRG-APP-000038, SRG-APP-000039, SRG-APP-000080, SRG-APP-000311, SRG-APP-000313, SRG-APP-000314&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000166</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000213</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001090</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001094</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001095</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001314</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001368</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001414</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001764</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001812</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001813</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002165</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002233</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002235</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002262</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002263</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002264</ident>
+            <fixtext fixref="F-101023r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Verify that the applied organization, team and user permissions in DTR are configured per the SSP.
 
@@ -265,20 +1471,20 @@ As a Docker EE Admin, navigate to "Organizations" and setup the list of organiza
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE admin, execute the following commands on a machine that can communicate with the DTR management console:
-
-AUTHTOKEN=$(curl -kLsS -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): As a Docker EE admin, execute the following commands on a machine that can communicate with the DTR management console: AUTHTOKEN=$(curl -kLsS -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 
 Execute the following command to give teams in an organization access to the appropriate repositories per the System Security Plan:
 
 curl -k -H "Authorization: Bearer $AUTHTOKEN" -X PUT "https://[dtr_url]/api/v0/repositories/[namespace]/[reponame]/teamAccess/[teamname]"
 
-Execute the following commands on a machine that can communicate with the UCP management console to add/remove members to/from the team with access to these repositories as appropriate per the SSP:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Execute the following commands on a machine that can communicate with the UCP management console to add/remove members to/from the team with access to these repositories as appropriate per the SSP: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 
 Add: curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X PUT https://[ucp_url]/accounts/[orgNameOrID]/teams/[teamNameOrID]/members/[memberNameOrID]
-Remove: curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X DELETE https://[ucp_url]/accounts/[orgNameOrID]/teams/[teamNameOrID]/members/[memberNameOrID]</fixtext><fix id="F-101023r1_fix" /><check system="C-94185r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+Remove: curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X DELETE https://[ucp_url]/accounts/[orgNameOrID]/teams/[teamNameOrID]/members/[memberNameOrID]</fixtext>
+            <fix id="F-101023r1_fix" />
+            <check system="C-94185r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Verify that the organization, team and user permissions in DTR are configured per the System Security Plan (SSP). Obtain and review SSP. Identify organization roles, teams and users.
 
@@ -290,20 +1496,26 @@ If the organization, team and user permissions in DTR are not configured per the
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE admin, execute the following commands on a machine that can communicate with the DTR management console:
-
-AUTHTOKEN=$(curl -kLsS -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): As a Docker EE admin, execute the following commands on a machine that can communicate with the DTR management console: AUTHTOKEN=$(curl -kLsS -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 
 Execute the following command to verify that the teams associated with an organization have access to the appropriate repositories per the System Security Plan:
 
 curl -k -H "Authorization: Bearer $AUTHTOKEN" -X GET "https://[dtr_url]/api/v0/accounts/[org_name]/teams/[team_name]/repositoryAccess"
 
-Execute the following commands on a machine that can communicate with the UCP management console to verify that the members of the team with access to these repositories is appropriate per the SSP:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Execute the following commands on a machine that can communicate with the UCP management console to verify that the members of the team with access to these repositories is appropriate per the SSP: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/accounts/[orgNameOrID]/teams/[teamNameOrID]/members
 
-If the organization, team and user permissions in DTR are not configured per the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95599"><title>SRG-APP-000033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104737r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001190</version><title>Docker Enterprise sensitive host system directories must not be mounted on containers.</title><description>&lt;VulnDiscussion&gt;Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in read-write mode.
+If the organization, team and user permissions in DTR are not configured per the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95599">
+        <title>SRG-APP-000033</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104737r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001190</version>
+            <title>Docker Enterprise sensitive host system directories must not be mounted on containers.</title>
+            <description>&lt;VulnDiscussion&gt;Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in read-write mode.
 
 Linux:
 
@@ -328,9 +1540,22 @@ C:\Users
 
 If sensitive directories are mounted in read-write mode, it would be possible to make changes to files within those sensitive directories. The changes might bring down security implications or unwarranted changes that could put the Docker host in compromised state.
 
-Docker defaults to a read-write volume but the user can also mount a directory read-only. By default, no sensitive host directories are mounted on containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000213</ident><fixtext fixref="F-101265r1_fix">This fix only applies to the use of Docker Engine - Enterprise.
-
-Do not mount host sensitive directories on containers especially in read-write mode.</fixtext><fix id="F-101265r1_fix" /><check system="C-94427r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise.
+Docker defaults to a read-write volume but the user can also mount a directory read-only. By default, no sensitive host directories are mounted on containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000213</ident>
+            <fixtext fixref="F-101265r1_fix">This fix only applies to the use of Docker Engine - Enterprise.
+
+Do not mount host sensitive directories on containers especially in read-write mode.</fixtext>
+            <fix id="F-101265r1_fix" />
+            <check system="C-94427r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise.
 
 Verify that no running containers have mounted sensitive host system directories. Refer to System Security Plan for list of sensitive folders.
 
@@ -340,7 +1565,17 @@ Execute the following command as a trusted user on the host operating system:
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep -iv "ucp\|kubelet\|dtr"
 
-Verify in the output that no containers are running with mounted RW access to sensitive host system directories. If there are containers mounted with RW access to sensitive host system directories, this is a finding.</check-content></check></Rule></Group><Group id="V-95601"><title>SRG-APP-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104739r2_rule" severity="medium" weight="10.0"><version>DKER-EE-001240</version><title>The Docker Enterprise hosts process namespace must not be shared.</title><description>&lt;VulnDiscussion&gt;Process ID (PID) namespaces isolate the PID number space, meaning that processes in different PID namespaces can have the same PID. This is process level isolation between containers and the host.
+Verify in the output that no containers are running with mounted RW access to sensitive host system directories. If there are containers mounted with RW access to sensitive host system directories, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95601">
+        <title>SRG-APP-000039</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104739r2_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001240</version>
+            <title>The Docker Enterprise hosts process namespace must not be shared.</title>
+            <description>&lt;VulnDiscussion&gt;Process ID (PID) namespaces isolate the PID number space, meaning that processes in different PID namespaces can have the same PID. This is process level isolation between containers and the host.
 
 PID namespace provides separation of processes. The PID Namespace removes the view of the system processes, and allows process IDs to be reused including PID 1. If the host's PID namespace is shared with the container, it would allow processes within the container to see all of the processes on the host system. This breaks the benefit of process level isolation between the host and the containers. Someone having access to the container can eventually know all the processes running on the host system and can even kill the host system processes from within the container. Hence, do not share the host's process namespace with the containers.
 
@@ -349,13 +1584,26 @@ Container processes cannot see the processes on the host system. In certain case
 Example:
 docker run --pid=host rhel7 strace -p 1234
 
-By default, all containers have the PID namespace enabled and the host's process namespace is not shared with the containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001414</ident><fixtext fixref="F-101267r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, all containers have the PID namespace enabled and the host's process namespace is not shared with the containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001414</ident>
+            <fixtext fixref="F-101267r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not start a container with --pid=host argument.
 
 For example, do not start a container as below:
 
-docker run --interactive --tty --pid=host centos /bin/bash</fixtext><fix id="F-101267r1_fix" /><check system="C-94429r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+docker run --interactive --tty --pid=host centos /bin/bash</fixtext>
+            <fix id="F-101267r1_fix" />
+            <check system="C-94429r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Ensure the host's process namespace is not shared.
 
@@ -365,7 +1613,17 @@ Linux: As a Docker EE Admin, execute the following command using a UCP client bu
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: PidMode={{ .HostConfig.PidMode }}'
 
-If PidMode = "host", it means the host PID namespace is shared with the container and this is a finding.</check-content></check></Rule></Group><Group id="V-95603"><title>SRG-APP-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104741r2_rule" severity="medium" weight="10.0"><version>DKER-EE-001250</version><title>The Docker Enterprise hosts IPC namespace must not be shared.</title><description>&lt;VulnDiscussion&gt;IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores, and message queues. IPC namespace on the host thus should not be shared with the containers and should remain isolated.
+If PidMode = "host", it means the host PID namespace is shared with the container and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95603">
+        <title>SRG-APP-000039</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104741r2_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001250</version>
+            <title>The Docker Enterprise hosts IPC namespace must not be shared.</title>
+            <description>&lt;VulnDiscussion&gt;IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores, and message queues. IPC namespace on the host thus should not be shared with the containers and should remain isolated.
 
 IPC namespace provides separation of IPC between the host and containers. If the host's IPC namespace is shared with the container, it would allow processes within the container to see all of the IPC on the host system. This breaks the benefit of IPC level isolation between the host and the containers. Someone having access to the container can eventually manipulate the host IPC. Hence, do not share the host's IPC namespace with the containers.
 
@@ -374,13 +1632,26 @@ Shared memory segments are used to accelerate inter-process communication. It is
 Example:
 docker run --interactive --tty --ipc=container:e3a7a1a97c58 centos /bin/bash
 
-By default, all containers have the IPC namespace enabled and host IPC namespace is not shared with any container.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001414</ident><fixtext fixref="F-101269r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, all containers have the IPC namespace enabled and host IPC namespace is not shared with any container.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001414</ident>
+            <fixtext fixref="F-101269r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not start a container with --ipc=host argument. 
 
 For example, do not start a container as below:
 
-docker run --interactive --tty --ipc=host centos /bin/bash</fixtext><fix id="F-101269r1_fix" /><check system="C-94431r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+docker run --interactive --tty --ipc=host centos /bin/bash</fixtext>
+            <fix id="F-101269r1_fix" />
+            <check system="C-94431r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Ensure the host's IPC namespace is not shared.
 
@@ -390,7 +1661,17 @@ Linux: As a Docker EE Admin, execute the following command using a UCP client bu
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: IpcMode={{ .HostConfig.IpcMode }}'
 
-If IpcMode="shareable", then the host's IPC namespace is shared and this is a finding.</check-content></check></Rule></Group><Group id="V-95605"><title>SRG-APP-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104743r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001370</version><title>log-opts on all Docker Engine - Enterprise nodes must be configured.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If IpcMode="shareable", then the host's IPC namespace is shared and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95605">
+        <title>SRG-APP-000090</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104743r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001370</version>
+            <title>log-opts on all Docker Engine - Enterprise nodes must be configured.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -411,7 +1692,16 @@ DTR audits all events associated with repository activities. Events are consider
 
 All audit logs generated by UCP and DTR can be forwarded to a remote log aggregation system by configuring an appropriate log driver plugin on all Docker Engine - Enterprise nodes in a cluster.
 
-The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000171</ident><fixtext fixref="F-101271r1_fix">Execute this fix on all Docker Engine - Enterprise nodes in the cluster.
+The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000171</ident>
+            <fixtext fixref="F-101271r1_fix">Execute this fix on all Docker Engine - Enterprise nodes in the cluster.
 
 via CLI:
 
@@ -421,7 +1711,11 @@ Open "/etc/docker/daemon.json" for editing.
 
 Set the "log-opts" object and its "max-size" and "max-file" properties accordingly.
 
-Save the file. Restart the Docker daemon.</fixtext><fix id="F-101271r1_fix" /><check system="C-94433r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify this check on all Docker Engine - Enterprise nodes in the cluster.
+Save the file. Restart the Docker daemon.</fixtext>
+            <fix id="F-101271r1_fix" />
+            <check system="C-94433r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify this check on all Docker Engine - Enterprise nodes in the cluster.
 
 via CLI:
 
@@ -432,7 +1726,17 @@ cat /etc/docker/daemon.json
 
 Verify that the "log-opts" object includes the "max-size" and "max-file" properties and that they are set accordingly in the output.
 
-If the "log-opts" object does not include the "max-size" and "max-file" properties and/or are not set accordingly, then this is a finding.</check-content></check></Rule></Group><Group id="V-95607"><title>SRG-APP-000108</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104745r1_rule" severity="low" weight="10.0"><version>DKER-EE-001590</version><title>Docker Enterprise must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If the "log-opts" object does not include the "max-size" and "max-file" properties and/or are not set accordingly, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95607">
+        <title>SRG-APP-000108</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104745r1_rule" severity="low" weight="10.0">
+            <version>DKER-EE-001590</version>
+            <title>Docker Enterprise must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -453,7 +1757,16 @@ DTR audits all events associated with repository activities. Events are consider
 
 All audit logs generated by UCP and DTR can be forwarded to a remote log aggregation system by configuring an appropriate log driver plugin on all Docker Engine - Enterprise nodes in a cluster.
 
-The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000139</ident><fixtext fixref="F-101273r1_fix">via CLI:
+The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000139</ident>
+            <fixtext fixref="F-101273r1_fix">via CLI:
 
 Linux: As a trusted user on the host operating system, open the /etc/docker/daemon.json file for editing. If the file doesn't exist, it must be created.
 
@@ -461,7 +1774,11 @@ Set the "log-driver" property to one of the following: "syslog", "awslogs", "spl
 
 Save the file. Restart the docker daemon.
 
-Work with the SIEM administrator to configure an alert when no audit data is received from Docker.</fixtext><fix id="F-101273r1_fix" /><check system="C-94435r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>via CLI:
+Work with the SIEM administrator to configure an alert when no audit data is received from Docker.</fixtext>
+            <fix id="F-101273r1_fix" />
+            <check system="C-94435r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>via CLI:
 
 Linux: Execute the following commands as a trusted user on the host operating system:
 
@@ -470,7 +1787,26 @@ cat /etc/docker/daemon.json
 Verify that the "log-driver" property is set to one of the following: "syslog", "awslogs", "splunk", "gcplogs", "logentries" or "&lt;plugin&gt;" (where &lt;plugin&gt; is the naming of a third-party Docker logging driver plugin).
 
 Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected.
-If "log-driver" is not set, or if alarms are not configured in the SIEM, then this is a finding.</check-content></check></Rule></Group><Group id="V-95609"><title>SRG-APP-000131</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104747r1_rule" severity="low" weight="10.0"><version>DKER-EE-001770</version><title>Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling.</title><description>&lt;VulnDiscussion&gt;All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001749</ident><fixtext fixref="F-101275r1_fix">For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc.
+If "log-driver" is not set, or if alarms are not configured in the SIEM, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95609">
+        <title>SRG-APP-000131</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104747r1_rule" severity="low" weight="10.0">
+            <version>DKER-EE-001770</version>
+            <title>Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling.</title>
+            <description>&lt;VulnDiscussion&gt;All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001749</ident>
+            <fixtext fixref="F-101275r1_fix">For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc.
 
 When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows:
 
@@ -480,13 +1816,27 @@ docker.io/docker/dtr:[dtr_version]
 If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows:
 
 https://docs.docker.com/ee/ucp/admin/install/install-offline/
-https://docs.docker.com/ee/dtr/admin/install/install-offline/</fixtext><fix id="F-101275r1_fix" /><check system="C-94437r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc.
+https://docs.docker.com/ee/dtr/admin/install/install-offline/</fixtext>
+            <fix id="F-101275r1_fix" />
+            <check system="C-94437r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc.
 
 Execute the following command to validate the Docker image signature digests of UCP and DTR:
 
 docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version]
 
-Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.</check-content></check></Rule></Group><Group id="V-95611"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104749r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001800</version><title>The insecure registry capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title><description>&lt;VulnDiscussion&gt;Docker considers a private registry either secure or insecure. By default, registries are considered secure.
+Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95611">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104749r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001800</version>
+            <title>The insecure registry capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title>
+            <description>&lt;VulnDiscussion&gt;Docker considers a private registry either secure or insecure. By default, registries are considered secure.
 
 Docker Enterprise includes the following capabilities that are considered non-essential:
 
@@ -516,13 +1866,26 @@ Docker Enterprise includes the following capabilities that are considered non-es
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101277r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101277r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
 Linux: As a trusted user on the underlying host operating system, edit the "/etc/docker/daemon.json" file and set the "insecure-registries" property to an empty array. If the daemon.json file doesn't exist, it must be created.
 
-Restart the Docker daemon.</fixtext><fix id="F-101277r1_fix" /><check system="C-94439r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+Restart the Docker daemon.</fixtext>
+            <fix id="F-101277r1_fix" />
+            <check system="C-94439r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
@@ -532,7 +1895,17 @@ ps -ef | grep dockerd
 
 Ensure that the "--insecure-registry" parameter is not present.
 
-If it is present, then this is a finding.</check-content></check></Rule></Group><Group id="V-95613"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104751r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001810</version><title>On Linux, a non-AUFS storage driver in the Docker Engine - Enterprise component of Docker Enterprise must be used.</title><description>&lt;VulnDiscussion&gt;The aufs storage driver is the oldest storage driver. It is based on a Linux kernel patch-set that is unlikely to be merged into the main Linux kernel. aufs driver is also known to cause some serious kernel crashes. aufs just has legacy support from Docker. Most importantly, aufs is not a supported driver in many Linux distributions using latest Linux kernels.
+If it is present, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95613">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104751r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001810</version>
+            <title>On Linux, a non-AUFS storage driver in the Docker Engine - Enterprise component of Docker Enterprise must be used.</title>
+            <description>&lt;VulnDiscussion&gt;The aufs storage driver is the oldest storage driver. It is based on a Linux kernel patch-set that is unlikely to be merged into the main Linux kernel. aufs driver is also known to cause some serious kernel crashes. aufs just has legacy support from Docker. Most importantly, aufs is not a supported driver in many Linux distributions using latest Linux kernels.
 
 Docker Enterprise includes the following capabilities that are considered non-essential:
 
@@ -562,13 +1935,26 @@ Docker Enterprise includes the following capabilities that are considered non-es
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101279r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is used on a Linux host operating system.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101279r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is used on a Linux host operating system.
 
 via CLI:
 
 Linux: As a trusted user on the underlying host operating system, edit the "/etc/docker/daemon.json" file and set the "storage-driver" property to a value that is not "aufs". If the daemon.json file does not exist, it must be created.
 
-Restart the Docker daemon.</fixtext><fix id="F-101279r1_fix" /><check system="C-94441r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is used on a Linux host operating system.
+Restart the Docker daemon.</fixtext>
+            <fix id="F-101279r1_fix" />
+            <check system="C-94441r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is used on a Linux host operating system.
 
 via CLI:
 
@@ -576,7 +1962,17 @@ Linux: As a trusted user on the underlying host operating system, execute the fo
 
 docker info | grep -e "^Storage Driver:\s*aufs\s*$"
 
-If the Storage Driver setting contains *aufs, then this is a finding. If the above command returns no values, this is not a finding.</check-content></check></Rule></Group><Group id="V-95615"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104753r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001830</version><title>The userland proxy capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title><description>&lt;VulnDiscussion&gt;The docker daemon starts a userland proxy service for port forwarding whenever a port is exposed. Where hairpin NAT is available, this service is generally superfluous to requirements and can be disabled. Docker engine provides two mechanisms for forwarding ports from the host to containers, hairpin NAT, and a userland proxy. In most circumstances, the hairpin NAT mode is preferred as it improves performance and makes use of native Linux iptables functionality instead of an additional component. Where hairpin NAT is available, the userland proxy should be disabled on startup to reduce the attack surface of the installation.
+If the Storage Driver setting contains *aufs, then this is a finding. If the above command returns no values, this is not a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95615">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104753r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001830</version>
+            <title>The userland proxy capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title>
+            <description>&lt;VulnDiscussion&gt;The docker daemon starts a userland proxy service for port forwarding whenever a port is exposed. Where hairpin NAT is available, this service is generally superfluous to requirements and can be disabled. Docker engine provides two mechanisms for forwarding ports from the host to containers, hairpin NAT, and a userland proxy. In most circumstances, the hairpin NAT mode is preferred as it improves performance and makes use of native Linux iptables functionality instead of an additional component. Where hairpin NAT is available, the userland proxy should be disabled on startup to reduce the attack surface of the installation.
 
 Docker Enterprise includes the following capabilities that are considered non-essential:
 
@@ -606,13 +2002,26 @@ Docker Enterprise includes the following capabilities that are considered non-es
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101281r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is not being operated as part of a UCP cluster.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101281r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is not being operated as part of a UCP cluster.
 
 via CLI:
 
 Linux: As a trusted user on the underlying host operating system, edit the "/etc/docker/daemon.json" file and set the "userland-proxy" property to a value of "false".
 
-Restart the Docker daemon.</fixtext><fix id="F-101281r1_fix" /><check system="C-94443r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is not being operated as part of a UCP cluster.
+Restart the Docker daemon.</fixtext>
+            <fix id="F-101281r1_fix" />
+            <check system="C-94443r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise and only when it is not being operated as part of a UCP cluster.
 
 via CLI:
 
@@ -620,7 +2029,17 @@ Linux: As a trusted user on the underlying host operating system, execute the fo
 
 ps -ef | grep dockerd
 
-Ensure that the "--userland-proxy" parameter is set to "false". If it is not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95617"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104755r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001840</version><title>Experimental features in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title><description>&lt;VulnDiscussion&gt;Avoid experimental features in production.
+Ensure that the "--userland-proxy" parameter is set to "false". If it is not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95617">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104755r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001840</version>
+            <title>Experimental features in the Docker Engine - Enterprise component of Docker Enterprise must be disabled.</title>
+            <description>&lt;VulnDiscussion&gt;Avoid experimental features in production.
 
 Docker Enterprise includes the following capabilities that are considered non-essential:
 
@@ -650,13 +2069,26 @@ Docker Enterprise includes the following capabilities that are considered non-es
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101283r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101283r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
 Linux: As a trusted user on the underlying host operating system, edit the "/etc/docker/daemon.json" file and set the "experimental" property to a value of "false". If the daemon.json file doesn't exist, it must be created.
 
-Restart the Docker daemon.</fixtext><fix id="F-101283r1_fix" /><check system="C-94445r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+Restart the Docker daemon.</fixtext>
+            <fix id="F-101283r1_fix" />
+            <check system="C-94445r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
@@ -664,7 +2096,17 @@ Linux: As a trusted user on the underlying host operating system, execute the fo
 
 docker version --format '{{ .Server.Experimental }}'
 
-Ensure that the "Experimental" property is set to "false". If it is not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95619"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104757r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001870</version><title>The Docker Enterprise self-signed certificates in Universal Control Plane (UCP) must be replaced with DoD trusted, signed certificates.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+Ensure that the "Experimental" property is set to "false". If it is not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95619">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104757r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001870</version>
+            <title>The Docker Enterprise self-signed certificates in Universal Control Plane (UCP) must be replaced with DoD trusted, signed certificates.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of Docker Trusted Registry (DTR) and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -692,7 +2134,16 @@ Ensure that the "Experimental" property is set to "false". If it is not, then th
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101285r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101285r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Integrate UCP with a trusted certificate authority CA.
 
@@ -727,7 +2178,11 @@ Restart the ucp-controller container:
 
 docker restart ucp-controller
 
-If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext><fix id="F-101285r1_fix" /><check system="C-94447r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Check that UCP has been integrated with a trusted certificate authority (CA).
+If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext>
+            <fix id="F-101285r1_fix" />
+            <check system="C-94447r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Check that UCP has been integrated with a trusted certificate authority (CA).
 
 via UI:
 
@@ -739,7 +2194,17 @@ Linux: Execute the following command and verify the certificate chain in the out
 
 echo "" | openssl s_client -connect [ucp_url]:443 | openssl x509 -noout -text
 
-If the certificate chain does not match the chain as defined by the System Security Plan, then this is a finding.</check-content></check></Rule></Group><Group id="V-95621"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104759r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001880</version><title>The Docker Enterprise self-signed certificates in Docker Trusted Registry (DTR) must be replaced with DoD trusted, signed certificates.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+If the certificate chain does not match the chain as defined by the System Security Plan, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95621">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104759r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001880</version>
+            <title>The Docker Enterprise self-signed certificates in Docker Trusted Registry (DTR) must be replaced with DoD trusted, signed certificates.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of Universal Control Plane (UCP) and DTR and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -767,7 +2232,16 @@ If the certificate chain does not match the chain as defined by the System Secur
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101287r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101287r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Integrate DTR with a trusted CA.
 
@@ -779,7 +2253,11 @@ via CLI:
 
 Linux: Execute the following command as a superuser on one of the UCP Manager nodes in the cluster:
 
-docker run -it --rm docker/dtr:[dtr_version] reconfigure --dtr-ca "$(cat [ca.pem])" --dtr-cert "$(cat [dtr_cert.pem])" --dtr-key "$(cat [dtr_private_key.pem])"</fixtext><fix id="F-101287r1_fix" /><check system="C-94449r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Check that DTR has been integrated with a trusted certificate authority (CA).
+docker run -it --rm docker/dtr:[dtr_version] reconfigure --dtr-ca "$(cat [ca.pem])" --dtr-cert "$(cat [dtr_cert.pem])" --dtr-key "$(cat [dtr_private_key.pem])"</fixtext>
+            <fix id="F-101287r1_fix" />
+            <check system="C-94449r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Check that DTR has been integrated with a trusted certificate authority (CA).
 
 via UI:
 
@@ -791,7 +2269,17 @@ Linux: Execute the following command and verify the certificate chain in the out
 
 echo "" | openssl s_client -connect [dtr_url]:443 | openssl x509 -noout -text
 
-If the certificate chain in the output is not valid and does not match that of the trusted CA, then this is a finding.</check-content></check></Rule></Group><Group id="V-95623"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104761r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001890</version><title>The option in Universal Control Plane (UCP) allowing users and administrators to schedule containers on all nodes, including UCP managers and Docker Trusted Registry (DTR) nodes must be disabled in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+If the certificate chain in the output is not valid and does not match that of the trusted CA, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95623">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104761r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001890</version>
+            <title>The option in Universal Control Plane (UCP) allowing users and administrators to schedule containers on all nodes, including UCP managers and Docker Trusted Registry (DTR) nodes must be disabled in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of UCP and DTR and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -819,7 +2307,16 @@ If the certificate chain in the output is not valid and does not match that of t
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101289r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101289r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Prevent admins and users from being able to schedule containers on manager nodes and DTR nodes.
 
@@ -829,9 +2326,7 @@ As a Docker EE Admin, navigate to "Admin Settings" | "Scheduler" in the UCP mana
 
 via CLI:
 
-Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "enable_admin_ucp_scheduling" entry under the "[scheduling_configuration]" section to "false". Save the file.
@@ -842,7 +2337,11 @@ curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml htt
 
 Delete the Grant for the "Scheduler" role against the "/" collection for the "docker-datacenter" organization by executing the following command:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X DELETE https://[ucp_url]/collectionGrants/[subjectID]/[objectID]/[roleID]</fixtext><fix id="F-101289r1_fix" /><check system="C-94451r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that admins and users are not allowed to schedule containers on manager nodes and DTR nodes.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X DELETE https://[ucp_url]/collectionGrants/[subjectID]/[objectID]/[roleID]</fixtext>
+            <fix id="F-101289r1_fix" />
+            <check system="C-94451r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that admins and users are not allowed to schedule containers on manager nodes and DTR nodes.
 
 via UI:
 
@@ -850,9 +2349,7 @@ As a Docker EE Admin, navigate to "Admin Settings" | "Scheduler" in the UCP mana
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "enable_admin_ucp_scheduling" entry under the "[scheduling_configuration]" section in the output, and verify that it is set to "false".
@@ -862,7 +2359,17 @@ Execute the following command:
 
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/collectionGrants?subjectType=all&amp;expandUser=true&amp;showPaths=true
 
-Ensure a Grant for the "Scheduler" role against the "/" collection for the "docker-datacenter" organization does not exist in the output. If it does, then this is a finding.</check-content></check></Rule></Group><Group id="V-95625"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104763r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001900</version><title>The Create repository on push option in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+Ensure a Grant for the "Scheduler" role against the "/" collection for the "docker-datacenter" organization does not exist in the output. If it does, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95625">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104763r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001900</version>
+            <title>The Create repository on push option in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of Universal Control Plane (UCP) and DTR and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -890,7 +2397,16 @@ Ensure a Grant for the "Scheduler" role against the "/" collection for the "dock
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101291r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101291r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Disable the "Create repository on push" option in DTR:
 
@@ -900,10 +2416,12 @@ As a Docker EE Admin, navigate to "System" | "General" in the DTR management con
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console:
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
-curl -k -H "Authorization: Bearer $AUTHTOKEN" -X POST -d '{"createRepositoryOnPush":true}' -H 'Content-Type: application/json' "https://[dtr_url]/api/v0/meta/settings"</fixtext><fix id="F-101291r1_fix" /><check system="C-94453r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console: AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+curl -k -H "Authorization: Bearer $AUTHTOKEN" -X POST -d '{"createRepositoryOnPush":true}' -H 'Content-Type: application/json' "https://[dtr_url]/api/v0/meta/settings"</fixtext>
+            <fix id="F-101291r1_fix" />
+            <check system="C-94453r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Verify that the "Create repository on push" option is disabled in DTR:
 
@@ -913,12 +2431,20 @@ As a Docker EE Admin, navigate to "System" | "General" in the DTR management con
 
 via CLI:
 
-Linux (requires curl and jq):
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 curl -k -H "Authorization: Bearer $AUTHTOKEN"" -X GET ""https://[dtr_url]/api/v0/meta/settings"
 
-Look for the "createRepositoryOnPush" field in the output and verify that it is set to "false". If it is not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95627"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104765r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001910</version><title>Periodic data usage and analytics reporting in Universal Control Plane (UCP) must be disabled in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+Look for the "createRepositoryOnPush" field in the output and verify that it is set to "false". If it is not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95627">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104765r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001910</version>
+            <title>Periodic data usage and analytics reporting in Universal Control Plane (UCP) must be disabled in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of UCP and Docker Trusted Registry (DTR) and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -946,7 +2472,16 @@ Look for the "createRepositoryOnPush" field in the output and verify that it is
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101293r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101293r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Disable usage and API analytics tracking in UCP:
 
@@ -956,16 +2491,18 @@ As a Docker EE Admin, navigate to "Admin Settings" | "Usage" in the UCP manageme
 
 via CLI:
 
-Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file. Set both the "disable_usageinfo" and "disable_tracking" entries under the "[tracking_configuration]" section to "true". Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101293r1_fix" /><check system="C-94455r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101293r1_fix" />
+            <check system="C-94455r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Verify that usage and API analytics tracking is disabled in UCP:
 
@@ -977,11 +2514,20 @@ If either box is checked, this is a finding.
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
-Look for the "disable_usageinfo" and "disable_tracking" entries under the "[tracking_configuration]" section in the output, and verify that they are both set to "true". If they are not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95629"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104767r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001920</version><title>Periodic data usage and analytics reporting in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
+Look for the "disable_usageinfo" and "disable_tracking" entries under the "[tracking_configuration]" section in the output, and verify that they are both set to "true". If they are not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95629">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104767r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001920</version>
+            <title>Periodic data usage and analytics reporting in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Docker Enterprise includes the following capabilities that are considered non-essential:
 
 *NOTE: disabling these capabilities negatively affects the operation of Universal Control Plane (UCP) and DTR and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
 
@@ -1009,7 +2555,16 @@ Look for the "disable_usageinfo" and "disable_tracking" entries under the "[trac
 (DTR)
 - periodic data usage/analytics reporting
 - create repository on push
-- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101295r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+- self-signed certificates&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101295r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Disable usage and API analytics tracking in DTR:
 
@@ -1019,10 +2574,12 @@ As a Docker EE Admin, navigate to "System" | "General" in the DTR management con
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console:
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
-curl -k -H "Authorization: Bearer $AUTHTOKEN" -X POST -d '{"reportAnalytics":false}' -H 'Content-Type: application/json' "https://[dtr_url]/api/v0/meta/settings"</fixtext><fix id="F-101295r1_fix" /><check system="C-94457r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console: AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+curl -k -H "Authorization: Bearer $AUTHTOKEN" -X POST -d '{"reportAnalytics":false}' -H 'Content-Type: application/json' "https://[dtr_url]/api/v0/meta/settings"</fixtext>
+            <fix id="F-101295r1_fix" />
+            <check system="C-94457r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Verify that usage and API analytics tracking is disabled in DTR:
 
@@ -1032,14 +2589,31 @@ As a Docker EE Admin, navigate to "System" | "General" in the DTR management con
 
 via CLI:
 
-Linux (requires curl and jq):
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 curl -k -H "Authorization: Bearer $AUTHTOKEN"" -X GET ""https://[dtr_url]/api/v0/meta/settings"
 
-Look for the "reportAnalytics" field in the output and verify that it is set to "false". If it is not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95631"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104769r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001930</version><title>An appropriate AppArmor profile must be enabled on Ubuntu systems for Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;AppArmor protects the Ubuntu OS and applications from various threats by enforcing security policy which is also known as AppArmor profile. The user can create their own AppArmor profile for containers or use the Docker's default AppArmor profile. This would enforce security policies on the containers as defined in the profile.
-
-By default, docker-default AppArmor profile is applied for running containers and this profile can be found at /etc/apparmor.d/docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101297r1_fix">This fix only applies to the use of Docker Engine - Enterprise on the Ubuntu host operating system where AppArmor is in use and should be executed on all nodes in a Docker Enterprise cluster.
+Look for the "reportAnalytics" field in the output and verify that it is set to "false". If it is not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95631">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104769r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001930</version>
+            <title>An appropriate AppArmor profile must be enabled on Ubuntu systems for Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;AppArmor protects the Ubuntu OS and applications from various threats by enforcing security policy which is also known as AppArmor profile. The user can create their own AppArmor profile for containers or use the Docker's default AppArmor profile. This would enforce security policies on the containers as defined in the profile.
+
+By default, docker-default AppArmor profile is applied for running containers and this profile can be found at /etc/apparmor.d/docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101297r1_fix">This fix only applies to the use of Docker Engine - Enterprise on the Ubuntu host operating system where AppArmor is in use and should be executed on all nodes in a Docker Enterprise cluster.
 
 Run all containers using an AppArmor profile:
 
@@ -1053,7 +2627,11 @@ docker run [options] --security-opt="apparmor:[PROFILENAME]" [image] [command]
 
 If using the "docker-default" default profile, run the container using the following command instead:
 
-docker run [options] --security-opt apparmor=docker-default [image] [command]</fixtext><fix id="F-101297r1_fix" /><check system="C-94459r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on the Ubuntu host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+docker run [options] --security-opt apparmor=docker-default [image] [command]</fixtext>
+            <fix id="F-101297r1_fix" />
+            <check system="C-94459r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on the Ubuntu host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that all running containers include a valid AppArmor profile:
 
@@ -1063,15 +2641,38 @@ Linux: Execute the following command as a trusted user on the host operating sys
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: AppArmorProfile={{ .AppArmorProfile }}'
 
-Verify that all containers include a valid AppArmor Profile in the output. If they do not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95635"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104773r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001940</version><title>SELinux security options must be set on Red Hat or CentOS systems for Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;SELinux provides a Mandatory Access Control (MAC) system on RHEL and CentOS that greatly augments the default Discretionary Access Control (DAC) model. The user can thus add an extra layer of safety by enabling SELinux on the RHEL or CentOS host.
-
-By default, no SELinux security options are applied on containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101301r1_fix">This fix only applies to the use of Docker Engine - Enterprise on either the Red Hat Enterprise Linux or CentOS host operating systems where SELinux is in use and should be executed on all nodes in a Docker Enterprise cluster.
+Verify that all containers include a valid AppArmor Profile in the output. If they do not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95635">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104773r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001940</version>
+            <title>SELinux security options must be set on Red Hat or CentOS systems for Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;SELinux provides a Mandatory Access Control (MAC) system on RHEL and CentOS that greatly augments the default Discretionary Access Control (DAC) model. The user can thus add an extra layer of safety by enabling SELinux on the RHEL or CentOS host.
+
+By default, no SELinux security options are applied on containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101301r1_fix">This fix only applies to the use of Docker Engine - Enterprise on either the Red Hat Enterprise Linux or CentOS host operating systems where SELinux is in use and should be executed on all nodes in a Docker Enterprise cluster.
 
 Start the Docker daemon with SELinux mode enabled. Run Docker containers using appropriate security options.
 
 via CLI:
 
-Linux: Set the SE Linux state. Set the SELinux policy. Create or import a SELinux policy template for Docker containers. Start the Docker daemon with SELinux mode enabled by either adding the "--selinux-enabled" flag to the systemd drop-in file or by setting the "selinux-enabled" property to "true" in the "/etc/docker/daemon.json" daemon configuration file. Restart the Docker daemon.</fixtext><fix id="F-101301r1_fix" /><check system="C-94463r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on either the Red Hat Enterprise Linux or CentOS host operating systems where SELinux is in use and should be executed on all nodes in a Docker Enterprise cluster.
+Linux: Set the SE Linux state. Set the SELinux policy. Create or import a SELinux policy template for Docker containers. Start the Docker daemon with SELinux mode enabled by either adding the "--selinux-enabled" flag to the systemd drop-in file or by setting the "selinux-enabled" property to "true" in the "/etc/docker/daemon.json" daemon configuration file. Restart the Docker daemon.</fixtext>
+            <fix id="F-101301r1_fix" />
+            <check system="C-94463r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on either the Red Hat Enterprise Linux or CentOS host operating systems where SELinux is in use and should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that the appropriate security options are configured for all running containers:
 
@@ -1081,7 +2682,17 @@ Linux: Execute the following command as a trusted user on the host operating sys
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' | grep -iv "ucp\|kube\|dtr"
 
-If SecurityOpt=[label=disable], then this is a finding.</check-content></check></Rule></Group><Group id="V-95637"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104775r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001950</version><title>Linux Kernel capabilities must be restricted within containers as defined in the System Security Plan (SSP) for Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;By default, Docker starts containers with a restricted set of Linux Kernel Capabilities. It means that any process may be granted the required capabilities instead of root access. Using Linux Kernel Capabilities, the processes do not have to run as root for almost all the specific areas where root privileges are usually needed. Docker supports the addition and removal of capabilities, allowing the use of a non-default profile. This may make Docker more secure through capability removal, or less secure through the addition of capabilities. It is thus recommended to remove all capabilities except those explicitly required for the user's container process.
+If SecurityOpt=[label=disable], then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95637">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104775r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001950</version>
+            <title>Linux Kernel capabilities must be restricted within containers as defined in the System Security Plan (SSP) for Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;By default, Docker starts containers with a restricted set of Linux Kernel Capabilities. It means that any process may be granted the required capabilities instead of root access. Using Linux Kernel Capabilities, the processes do not have to run as root for almost all the specific areas where root privileges are usually needed. Docker supports the addition and removal of capabilities, allowing the use of a non-default profile. This may make Docker more secure through capability removal, or less secure through the addition of capabilities. It is thus recommended to remove all capabilities except those explicitly required for the user's container process.
 
 By default, below capabilities are available for Linux containers:
 
@@ -1098,7 +2709,16 @@ SETFCAP
 SETGID
 SETPCAP
 SETUID
-SYS_CHROOT&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101303r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+SYS_CHROOT&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101303r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Document the required Kernel Capabilities for each container in the SSP. Only add needed capabilities when running containers. 
 
@@ -1114,7 +2734,11 @@ $&gt; docker run --cap-drop={"Capability 1","Capability 2"}
 
 The user may also choose to drop all capabilities and add only add the needed ones as per the SSP:
 
-$&gt; docker run --cap-drop=all --cap-add={"Capability 1","Capability 2"}</fixtext><fix id="F-101303r1_fix" /><check system="C-94465r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+$&gt; docker run --cap-drop=all --cap-add={"Capability 1","Capability 2"}</fixtext>
+            <fix id="F-101303r1_fix" />
+            <check system="C-94465r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that the added and dropped Linux Kernel Capabilities are in line with the ones needed for container processes for each container instance as defined in the SSP.
 
@@ -1123,13 +2747,36 @@ via CLI:
 Linux: Execute the following command as a trusted user on the host operating system:
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}'
 
-If Linux Kernel Capabilities exceed what is defined in the SSP, then this is a finding.</check-content></check></Rule></Group><Group id="V-95639"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104777r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001960</version><title>Privileged Linux containers must not be used for Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Using the --privileged flag gives all Linux Kernel Capabilities to the container thus overwriting the --cap-add and --cap-drop flags. Ensure that it is not used. The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101305r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+If Linux Kernel Capabilities exceed what is defined in the SSP, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95639">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104777r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001960</version>
+            <title>Privileged Linux containers must not be used for Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Using the --privileged flag gives all Linux Kernel Capabilities to the container thus overwriting the --cap-add and --cap-drop flags. Ensure that it is not used. The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101305r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Do not run containers with the --privileged flag.
 
 For example, do not start a container as below:
 
-docker run --interactive --tty --privileged centos /bin/bash</fixtext><fix id="F-101305r1_fix" /><check system="C-94467r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+docker run --interactive --tty --privileged centos /bin/bash</fixtext>
+            <fix id="F-101305r1_fix" />
+            <check system="C-94467r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that no containers are running with the --privileged flag. The --privileged flag provides full kernel capabilities. Capabilities must be specified in the System Security Plan (SSP) rather than allowing full privileges.
 
@@ -1139,7 +2786,17 @@ Linux: Execute the following command as a trusted user on the host operating sys
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}'
 
-Verify in the output that no containers are running with the --privileged flag. If there are, then this is a finding.</check-content></check></Rule></Group><Group id="V-95641"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104779r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001970</version><title>SSH must not run within Linux containers for Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;SSH server should not be running within the container. The user should instead use Universal Control Plane (UCP) to console in to running containers.
+Verify in the output that no containers are running with the --privileged flag. If there are, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95641">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104779r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001970</version>
+            <title>SSH must not run within Linux containers for Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;SSH server should not be running within the container. The user should instead use Universal Control Plane (UCP) to console in to running containers.
 
 Running SSH within the container increases the complexity of security management by making it:
 
@@ -1148,9 +2805,22 @@ Running SSH within the container increases the complexity of security management
 - Difficult to manage security upgrades for SSH server
 - It is possible to have shell access to a container without using SSH, the needlessly increasing the complexity of security management should be avoided
 
-By default, SSH server is not running inside the container. Only one process per container is allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101307r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
-
-Remove SSH packages from all Docker base images in use in the user's environment.</fixtext><fix id="F-101307r1_fix" /><check system="C-94469r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+By default, SSH server is not running inside the container. Only one process per container is allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101307r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+
+Remove SSH packages from all Docker base images in use in the user's environment.</fixtext>
+            <fix id="F-101307r1_fix" />
+            <check system="C-94469r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that no running containers have a process for SSH server.
 
@@ -1160,16 +2830,39 @@ for i in $(docker ps -qa); do echo $i; docker exec $i ps -el | grep -i sshd;done
 
 Container not running errors are not a finding.
 
-If running containers have a process for SSH server, this is a finding.</check-content></check></Rule></Group><Group id="V-95643"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104781r1_rule" severity="medium" weight="10.0"><version>DKER-EE-001990</version><title>Only required ports must be open on the containers in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Dockerfile for a container image defines the ports to be opened by default on a container instance. The list of ports may or may not be relevant to the application running within the container.
+If running containers have a process for SSH server, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95643">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104781r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-001990</version>
+            <title>Only required ports must be open on the containers in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Dockerfile for a container image defines the ports to be opened by default on a container instance. The list of ports may or may not be relevant to the application running within the container.
 
 A container can be run just with the ports defined in the Dockerfile for its image or can be arbitrarily passed run time parameters to open a list of ports. Additionally, over time, Dockerfile may undergo various changes and the list of exposed ports may or may not be relevant to the application running within the container. Opening unneeded ports increase the attack surface of the container and the containerized application. As a recommended practice, do not open unneeded ports.
 
-By default, all the ports that are listed in the Dockerfile under EXPOSE instruction for an image are opened when a container is run with -P or --publish-all flag.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101309r1_fix">Document the ports required for each container in the SSP. 
+By default, all the ports that are listed in the Dockerfile under EXPOSE instruction for an image are opened when a container is run with -P or --publish-all flag.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101309r1_fix">Document the ports required for each container in the SSP. 
 
 Fix the Dockerfile of the container image to expose only needed ports by the containerized application. Ignore the list of ports defined in the Dockerfile by NOT using -P (UPPERCASE) or --publish-all flag when starting the container. Use the -p (lowercase) or --publish flag to explicitly define the ports needed for a particular container instance.
 
 Example:
-docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash</fixtext><fix id="F-101309r1_fix" /><check system="C-94471r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that mapped ports are the ones that are needed by the containers.
+docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash</fixtext>
+            <fix id="F-101309r1_fix" />
+            <check system="C-94471r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that mapped ports are the ones that are needed by the containers.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1179,15 +2872,38 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'
 
-Review the list and ensure that the ports mapped are the ones that are really needed for the container. If there are any mapped ports that aren't documented by the System Security Plan (SSP), then this is a finding.</check-content></check></Rule></Group><Group id="V-95645"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104783r1_rule" severity="high" weight="10.0"><version>DKER-EE-002000</version><title>Docker Enterprise hosts network namespace must not be shared.</title><description>&lt;VulnDiscussion&gt;The networking mode on a container when set to --net=host, skips placing the container inside separate network stack. In essence, this choice tells Docker to not containerize the container's networking. This would network-wise mean that the container lives "outside" in the main Docker host and has full access to its network interfaces.
+Review the list and ensure that the ports mapped are the ones that are really needed for the container. If there are any mapped ports that aren't documented by the System Security Plan (SSP), then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95645">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104783r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002000</version>
+            <title>Docker Enterprise hosts network namespace must not be shared.</title>
+            <description>&lt;VulnDiscussion&gt;The networking mode on a container when set to --net=host, skips placing the container inside separate network stack. In essence, this choice tells Docker to not containerize the container's networking. This would network-wise mean that the container lives "outside" in the main Docker host and has full access to its network interfaces.
 
 This is potentially dangerous. It allows the container process to open low-numbered ports like any other root process. It also allows the container to access network services like D-bus on the Docker host. Thus, a container process can potentially do unexpected things such as shutting down the Docker host. Do not use this option.
 
-By default, container connects to Docker bridge.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101311r1_fix">Do not pass --net=host or --network=host options when starting the container.
+By default, container connects to Docker bridge.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101311r1_fix">Do not pass --net=host or --network=host options when starting the container.
 
 For example, when executing docker run, do not use the --net=host nor --network=host arguments.
 
-A more detailed reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext><fix id="F-101311r1_fix" /><check system="C-94473r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure the host's network namespace is not shared.
+A more detailed reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext>
+            <fix id="F-101311r1_fix" />
+            <check system="C-94473r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure the host's network namespace is not shared.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1197,11 +2913,30 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: NetworkMode={{ .HostConfig.NetworkMode }}'
 
-If the above command returns NetworkMode=host, this is a finding.</check-content></check></Rule></Group><Group id="V-95647"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104785r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002010</version><title>Memory usage for all containers must be limited in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of Docker host, such as memory limit, the amount of memory that a container may consume can be controlled.
+If the above command returns NetworkMode=host, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95647">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104785r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002010</version>
+            <title>Memory usage for all containers must be limited in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of Docker host, such as memory limit, the amount of memory that a container may consume can be controlled.
 
 By default, container can use all of the memory on the host. The user can use memory limit mechanism to prevent a denial of service arising from one container consuming all of the host’s resources such that other containers on the same host cannot perform their intended functions. Having no limit on memory can lead to issues where one container can easily make the whole system unstable, and as a result, unusable.
 
-By default, all containers on a Docker host share the resources equally. No memory limits are enforced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101313r1_fix">Document container memory requirements in the System Security Plan (SSP).
+By default, all containers on a Docker host share the resources equally. No memory limits are enforced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101313r1_fix">Document container memory requirements in the System Security Plan (SSP).
 
 Run the container with only as much memory as required. Always run the container using the --memory argument.
 
@@ -1215,7 +2950,11 @@ Note: The output of the below command would return values in scientific notation
 
 docker inspect --format='{{.Config.Memory}}' 7c5a2d4c7fe0
 
-For example, if the memory limit is set to 256 MB for the above container instance, the output of the above command would be 2.68435456e+08 and NOT 256m. Convert this value using a scientific calculator or programmatic methods.</fixtext><fix id="F-101313r1_fix" /><check system="C-94475r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure memory limits are in place for all containers.
+For example, if the memory limit is set to 256 MB for the above container instance, the output of the above command would be 2.68435456e+08 and NOT 256m. Convert this value using a scientific calculator or programmatic methods.</fixtext>
+            <fix id="F-101313r1_fix" />
+            <check system="C-94475r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure memory limits are in place for all containers.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1225,13 +2964,32 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Memory={{ .HostConfig.Memory }}'
 
-If the above command returns 0, it means the memory limits are not in place and this is a finding.</check-content></check></Rule></Group><Group id="V-95649"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104787r1_rule" severity="low" weight="10.0"><version>DKER-EE-002020</version><title>Docker Enterprise CPU priority must be set appropriately on all containers.</title><description>&lt;VulnDiscussion&gt;By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of Docker host, such as CPU shares, the user control the host CPU resources that a container may consume.
+If the above command returns 0, it means the memory limits are not in place and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95649">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104787r1_rule" severity="low" weight="10.0">
+            <version>DKER-EE-002020</version>
+            <title>Docker Enterprise CPU priority must be set appropriately on all containers.</title>
+            <description>&lt;VulnDiscussion&gt;By default, all containers on a Docker host share the resources equally. By using the resource management capabilities of Docker host, such as CPU shares, the user control the host CPU resources that a container may consume.
 
 By default, CPU time is divided between containers equally. If it is desired, to control the CPU time amongst the container instances, use CPU sharing feature. CPU sharing allows to prioritize one container over the other and forbids the lower priority container to claim CPU resources more often. This ensures that the high priority containers are served better.
 
 If CPU shares are not properly set, the container process may have to starve if the resources on the host are not available. If the CPU resources on the host are free, CPU shares do not place any restrictions on the CPU that the container may use.
 
-By default, all containers on a Docker host share the resources equally. No CPU shares are enforced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101315r1_fix">Document container CPU requirements in the System Security Plan (SSP). 
+By default, all containers on a Docker host share the resources equally. No CPU shares are enforced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101315r1_fix">Document container CPU requirements in the System Security Plan (SSP). 
 
 Manage the CPU shares between containers. To do so, start the container using the --cpu-shares argument.
 
@@ -1250,7 +3008,11 @@ Alternatively,
 3. Now, inside the above directory (in step 1), there will be a directory by name docker-&lt;Instance ID&gt;.scope. For example, docker-4acae729e8659c6be696ee35b2237cc1fe4edd2672e9186434c5116e1a6fbed6.scope. Navigate to this directory.
 4. Find a file named cpu.shares. Execute cat cpu.shares. This will always show the CPU share value based on the system. So, even if there is no CPU shares configured using -c or --cpu-shares argument in the docker run command, this file will have a value of 1024.
 
-By setting one container’s CPU shares to 512, it will receive half of the CPU time compared to the other container. So, take 1024 as 100% and then do quick math to derive the number that set for respective CPU shares. For example, use 512 to set 50% and 256 to set 25%.</fixtext><fix id="F-101315r1_fix" /><check system="C-94477r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure CPU shares are in place for all containers.
+By setting one container’s CPU shares to 512, it will receive half of the CPU time compared to the other container. So, take 1024 as 100% and then do quick math to derive the number that set for respective CPU shares. For example, use 512 to set 50% and 256 to set 25%.</fixtext>
+            <fix id="F-101315r1_fix" />
+            <check system="C-94477r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure CPU shares are in place for all containers.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1260,7 +3022,17 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CpuShares={{ .HostConfig.CpuShares }}'
 
-If the above command returns 0 or 1024, it means the CPU shares are not in place and this is a finding.</check-content></check></Rule></Group><Group id="V-95651"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104789r1_rule" severity="high" weight="10.0"><version>DKER-EE-002030</version><title>All Docker Enterprise containers root filesystem must be mounted as read only.</title><description>&lt;VulnDiscussion&gt;The container's root filesystem should be treated as a 'golden image' by using Docker run's --read-only option. This prevents any writes to the container's root filesystem at container runtime and enforces the principle of immutable infrastructure.
+If the above command returns 0 or 1024, it means the CPU shares are not in place and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95651">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104789r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002030</version>
+            <title>All Docker Enterprise containers root filesystem must be mounted as read only.</title>
+            <description>&lt;VulnDiscussion&gt;The container's root filesystem should be treated as a 'golden image' by using Docker run's --read-only option. This prevents any writes to the container's root filesystem at container runtime and enforces the principle of immutable infrastructure.
 
 Enabling this option forces containers at runtime to explicitly define their data writing strategy to persist or not persist their data. This also reduces security attack vectors since the container instance's filesystem cannot be tampered with or written to unless it has explicit read-write permissions on its filesystem folder and directories.
 
@@ -1271,7 +3043,16 @@ Example:
 - Enable use --tmpfs for temporary file writes to /tmp
 - Use Docker shared data volumes for persistent data writes
 
-By default, a container will have its root filesystem writable allowing all container processes to write files owned by the container's runtime user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101317r1_fix">Add a --read-only flag at a container's runtime to enforce the container's root filesystem to be mounted as read only.
+By default, a container will have its root filesystem writable allowing all container processes to write files owned by the container's runtime user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101317r1_fix">Add a --read-only flag at a container's runtime to enforce the container's root filesystem to be mounted as read only.
 
 docker run &lt;Run arguments&gt; --read-only &lt;Container Image Name or ID&gt; &lt;Command&gt;
 
@@ -1293,7 +3074,11 @@ docker run --interactive --tty --read-only -v /opt/app/data:/run/app/data:rw [im
 
 docker volume create -d convoy --opt o=size=20GB my-named-volume
 
-docker run --interactive --tty --read-only -v my-named-volume:/run/app/data [image] [command]</fixtext><fix id="F-101317r1_fix" /><check system="C-94479r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure all containers' root filesystem is mounted as read only.
+docker run --interactive --tty --read-only -v my-named-volume:/run/app/data [image] [command]</fixtext>
+            <fix id="F-101317r1_fix" />
+            <check system="C-94479r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure all containers' root filesystem is mounted as read only.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1303,7 +3088,17 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: ReadonlyRootfs={{ .HostConfig.ReadonlyRootfs }}' 
 
- If ReadonlyRootfs=false, it means the container's root filesystem is writable and this is a finding.</check-content></check></Rule></Group><Group id="V-95653"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104791r1_rule" severity="high" weight="10.0"><version>DKER-EE-002040</version><title>Docker Enterprise host devices must not be directly exposed to containers.</title><description>&lt;VulnDiscussion&gt;Host devices can be directly exposed to containers at runtime. Do not directly expose host devices to containers especially for containers that are not trusted.
+ If ReadonlyRootfs=false, it means the container's root filesystem is writable and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95653">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104791r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002040</version>
+            <title>Docker Enterprise host devices must not be directly exposed to containers.</title>
+            <description>&lt;VulnDiscussion&gt;Host devices can be directly exposed to containers at runtime. Do not directly expose host devices to containers especially for containers that are not trusted.
 
 The --device option exposes the host devices to the containers and consequently, the containers can directly access such host devices. Do not require the container to run in privileged mode to access and manipulate the host devices. By default, the container will be able to read, write and mknod these devices. Additionally, it is possible for containers to remove block devices from the host. Hence, do not expose host devices to containers directly.
 
@@ -1315,7 +3110,16 @@ m - mknod allowed
 
 The user would not be able to use the host devices directly within the containers.
 
-By default, no host devices are exposed to containers. If the user does not provide sharing permissions and choose to expose a host device to a container, the host device would be exposed with read, write, and mknod permissions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101319r1_fix">Do not directly expose the host devices to containers. If at all, expose the host devices to containers, use the correct set of permissions:
+By default, no host devices are exposed to containers. If the user does not provide sharing permissions and choose to expose a host device to a container, the host device would be exposed with read, write, and mknod permissions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101319r1_fix">Do not directly expose the host devices to containers. If at all, expose the host devices to containers, use the correct set of permissions:
 
 For example, do not start a container as below:
 
@@ -1323,7 +3127,11 @@ docker run --interactive --tty --device=/dev/tty0:/dev/tty0:rwm --device=/dev/te
 
 For example, share the host device with correct permissions:
 
-docker run --interactive --tty --device=/dev/tty0:/dev/tty0:rw --device=/dev/temp_sda:/dev/temp_sda:r centos bash</fixtext><fix id="F-101319r1_fix" /><check system="C-94481r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure host devices are not directly exposed to containers. Verify that the host device needs to be accessed from within the container and the permissions required are correctly set.
+docker run --interactive --tty --device=/dev/tty0:/dev/tty0:rw --device=/dev/temp_sda:/dev/temp_sda:r centos bash</fixtext>
+            <fix id="F-101319r1_fix" />
+            <check system="C-94481r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure host devices are not directly exposed to containers. Verify that the host device needs to be accessed from within the container and the permissions required are correctly set.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1339,15 +3147,38 @@ The above command lists out each device with below information:
 - PathInContainer - Device path within the container
 - PathOnHost - Device path on the host
 
-If Devices=[], or Devices=&lt;no value&gt;, this is not a finding. If Devices are listed and the host device is not documented and approved in the System Security Plan (SSP), this is a finding.</check-content></check></Rule></Group><Group id="V-95655"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104793r2_rule" severity="medium" weight="10.0"><version>DKER-EE-002050</version><title>Mount propagation mode must not set to shared in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Mount propagation mode allows mounting volumes in shared, slave or private mode on a container. Do not use shared mount propagation mode until needed.
+If Devices=[], or Devices=&lt;no value&gt;, this is not a finding. If Devices are listed and the host device is not documented and approved in the System Security Plan (SSP), this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95655">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104793r2_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002050</version>
+            <title>Mount propagation mode must not set to shared in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Mount propagation mode allows mounting volumes in shared, slave or private mode on a container. Do not use shared mount propagation mode until needed.
 
 A shared mount is replicated at all mounts and the changes made at any mount point are propagated to all mounts. Mounting a volume in shared mode does not restrict any other container to mount and make changes to that volume. This unintended volume changes could potentially impact data hosted on the mounted volume. Do not set mount propagation mode to shared until needed.
 
-By default, the container mounts are private.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101321r1_fix">Do not mount volumes in shared mode propagation.
+By default, the container mounts are private.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101321r1_fix">Do not mount volumes in shared mode propagation.
 
 For example, do not start container as below:
 
-docker run &lt;Run arguments&gt; --volume=/hostPath:/containerPath:shared &lt;Container Image Name or ID&gt; &lt;Command&gt;</fixtext><fix id="F-101321r1_fix" /><check system="C-94483r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure mount propagation mode is not set to shared or rshared.
+docker run &lt;Run arguments&gt; --volume=/hostPath:/containerPath:shared &lt;Container Image Name or ID&gt; &lt;Command&gt;</fixtext>
+            <fix id="F-101321r1_fix" />
+            <check system="C-94483r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure mount propagation mode is not set to shared or rshared.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1357,17 +3188,40 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: Propagation={{range $mnt := .Mounts}} {{json $mnt.Propagation}} {{end}}'
 
-If Propagation=shared or Propagation-rshared, then this is a finding.</check-content></check></Rule></Group><Group id="V-95657"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104795r2_rule" severity="medium" weight="10.0"><version>DKER-EE-002060</version><title>The Docker Enterprise hosts UTS namespace must not be shared.</title><description>&lt;VulnDiscussion&gt;UTS namespaces provide isolation of two system identifiers: the hostname and the NIS domain name. It is used for setting the hostname and the domain that is visible to running processes in that namespace. Processes running within containers do not typically require to know hostname and domain name. Hence, the namespace should not be shared with the host.
+If Propagation=shared or Propagation-rshared, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95657">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104795r2_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002060</version>
+            <title>The Docker Enterprise hosts UTS namespace must not be shared.</title>
+            <description>&lt;VulnDiscussion&gt;UTS namespaces provide isolation of two system identifiers: the hostname and the NIS domain name. It is used for setting the hostname and the domain that is visible to running processes in that namespace. Processes running within containers do not typically require to know hostname and domain name. Hence, the namespace should not be shared with the host.
 
 Sharing the UTS namespace with the host provides full permission to the container to change the hostname of the host. This must not be allowed.
 
-By default, all containers have the UTS namespace enabled and host UTS namespace is not shared with any container.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101323r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, all containers have the UTS namespace enabled and host UTS namespace is not shared with any container.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101323r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not start a container with --uts=host argument.
 
 For example, do not start a container as below:
 
-docker run --rm --interactive --tty --uts=host rhel7.2</fixtext><fix id="F-101323r1_fix" /><check system="C-94485r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+docker run --rm --interactive --tty --uts=host rhel7.2</fixtext>
+            <fix id="F-101323r1_fix" />
+            <check system="C-94485r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure the host's UTS namespace is not shared.
 
@@ -1377,16 +3231,39 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UTSMode={{ .HostConfig.UTSMode }}' 
 
-If the above command returns host, it means the host UTS namespace is shared with the container and this is a finding.</check-content></check></Rule></Group><Group id="V-95659"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104797r1_rule" severity="high" weight="10.0"><version>DKER-EE-002070</version><title>The Docker Enterprise default seccomp profile must not be disabled.</title><description>&lt;VulnDiscussion&gt;Seccomp filtering provides a means for a process to specify a filter for incoming system calls. The default Docker seccomp profile works on whitelist basis and allows 311 system calls blocking all others. It should not be disabled unless it hinders the container application usage.
+If the above command returns host, it means the host UTS namespace is shared with the container and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95659">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104797r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002070</version>
+            <title>The Docker Enterprise default seccomp profile must not be disabled.</title>
+            <description>&lt;VulnDiscussion&gt;Seccomp filtering provides a means for a process to specify a filter for incoming system calls. The default Docker seccomp profile works on whitelist basis and allows 311 system calls blocking all others. It should not be disabled unless it hinders the container application usage.
 
 A large number of system calls are exposed to every userland process with many of them going unused for the entire lifetime of the process. Most of the applications do not need all the system calls and thus benefit by having a reduced set of available system calls. The reduced set of system calls reduces the total kernel surface exposed to the application and thus improvises application security.
 
 The default seccomp profile blocks syscalls, regardless of --cap-add passed to the container. Create a custom seccomp profile in such cases. Disable the default seccomp profile by passing --security-opt=seccomp:unconfined on docker run.
 
-When running a container, it uses the default profile unless it is overridden with the --security-opt option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101325r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+When running a container, it uses the default profile unless it is overridden with the --security-opt option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101325r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 By default, seccomp profiles are enabled. It is not necessary to do anything unless the user wants to modify the seccomp profile. Do not pass unconfined flags to run a container without the default seccomp profile. Refer to seccomp documentation for details.
-https://docs.docker.com/engine/security/seccomp/</fixtext><fix id="F-101325r1_fix" /><check system="C-94487r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+https://docs.docker.com/engine/security/seccomp/</fixtext>
+            <fix id="F-101325r1_fix" />
+            <check system="C-94487r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure the default seccomp profile is not disabled.
 
@@ -1396,13 +3273,36 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'
 
-If seccomp:=unconfined, then the container is running without any seccomp profiles and this is a finding.</check-content></check></Rule></Group><Group id="V-95661"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104799r2_rule" severity="high" weight="10.0"><version>DKER-EE-002080</version><title>Docker Enterprise exec commands must not be used with privileged option.</title><description>&lt;VulnDiscussion&gt;Do not use docker exec with --privileged option.
-
-Using --privileged option in docker exec gives extended Linux capabilities to the command. Do not run docker exec with the --privileged option, especially when running containers with dropped capabilities or with enhanced restrictions. By default, docker exec command runs without --privileged option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101327r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+If seccomp:=unconfined, then the container is running without any seccomp profiles and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95661">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104799r2_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002080</version>
+            <title>Docker Enterprise exec commands must not be used with privileged option.</title>
+            <description>&lt;VulnDiscussion&gt;Do not use docker exec with --privileged option.
+
+Using --privileged option in docker exec gives extended Linux capabilities to the command. Do not run docker exec with the --privileged option, especially when running containers with dropped capabilities or with enhanced restrictions. By default, docker exec command runs without --privileged option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101327r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not use --privileged option in docker exec command.
 
-A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.</fixtext><fix id="F-101327r1_fix" /><check system="C-94489r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.</fixtext>
+            <fix id="F-101327r1_fix" />
+            <check system="C-94489r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure the default seccomp profile is not disabled, if applicable.
 
@@ -1412,15 +3312,38 @@ Linux: As a trusted user on the host operating system, use the below command to
 
 sudo ausearch -k docker | grep exec | grep privileged
 
-If there are any in the output, then this is a finding.</check-content></check></Rule></Group><Group id="V-95663"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104801r2_rule" severity="medium" weight="10.0"><version>DKER-EE-002090</version><title>Docker Enterprise exec commands must not be used with the user option.</title><description>&lt;VulnDiscussion&gt;Do not docker exec with --user option.
+If there are any in the output, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95663">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104801r2_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002090</version>
+            <title>Docker Enterprise exec commands must not be used with the user option.</title>
+            <description>&lt;VulnDiscussion&gt;Do not docker exec with --user option.
 
 Using --user option in docker exec executes the command within the container as that user. Do not run docker exec with the --user option , especially when running containers with dropped capabilities or with enhanced restrictions. For example, suppose the container is running as tomcat user (or any other non-root user), it would be possible to run a command through docker exec as rootwith --user=root option. 
 
-By default, docker exec command runs without --user option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101329r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, docker exec command runs without --user option.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101329r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not use --user option in docker exec command.
 
-A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.</fixtext><fix id="F-101329r1_fix" /><check system="C-94491r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.</fixtext>
+            <fix id="F-101329r1_fix" />
+            <check system="C-94491r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure docker exec commands are not used with the user option.
 
@@ -1430,16 +3353,39 @@ Linux: As a trusted user on the host operating system, use the below command to
 
 sudo ausearch -k docker | grep exec | grep user
 
-If there are any in the output, then this is a finding.</check-content></check></Rule></Group><Group id="V-95665"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104803r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002100</version><title>cgroup usage must be confirmed in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;It is possible to attach to a particular cgroup on container run. Confirming cgroup usage would ensure that containers are running under defined cgroups.
+If there are any in the output, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95665">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104803r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002100</version>
+            <title>cgroup usage must be confirmed in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;It is possible to attach to a particular cgroup on container run. Confirming cgroup usage would ensure that containers are running under defined cgroups.
 
 System administrators typically define cgroups under which containers are supposed to run. Even if cgroups are not explicitly defined by the system administrators, containers run under docker cgroup by default. At run-time, it is possible to attach to a different cgroup other than the one that was expected to be used. This usage should be monitored and confirmed. By attaching to a different cgroup than the one that is expected, excess permissions and resources might be granted to the container and thus, can prove to be unsafe.
 
-By default, containers run under docker cgroup.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101331r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, containers run under docker cgroup.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101331r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not use --cgroup-parent option in docker run command unless needed.
 If required, document cgroup usage in the SSP.
 
-A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext><fix id="F-101331r1_fix" /><check system="C-94493r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext>
+            <fix id="F-101331r1_fix" />
+            <check system="C-94493r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure cgroup usage is confirmed.
 
@@ -1449,19 +3395,42 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CgroupParent={{ .HostConfig.CgroupParent }}' 
 
-If the cgroup is blank, the container is running under default docker cgroup. If the containers are found to be running under cgroup other than the one that is documented in the System Security Plan (SSP), then this is a finding.</check-content></check></Rule></Group><Group id="V-95667"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104805r1_rule" severity="high" weight="10.0"><version>DKER-EE-002110</version><title>All Docker Enterprise containers must be restricted from acquiring additional privileges.</title><description>&lt;VulnDiscussion&gt;Restrict the container from acquiring additional privileges via suid or sgid bits.
+If the cgroup is blank, the container is running under default docker cgroup. If the containers are found to be running under cgroup other than the one that is documented in the System Security Plan (SSP), then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95667">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104805r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002110</version>
+            <title>All Docker Enterprise containers must be restricted from acquiring additional privileges.</title>
+            <description>&lt;VulnDiscussion&gt;Restrict the container from acquiring additional privileges via suid or sgid bits.
 
 A process can set the no_new_priv bit in the kernel. It persists across fork, clone, and execve. The no_new_priv bit ensures that the process or its children processes do not gain any additional privileges via suid or sgid bits. This way a lot of dangerous operations become a lot less dangerous because there is no possibility of subverting privileged binaries.
 
 no_new_priv prevents LSMs like SELinux from transitioning to process labels that have access not allowed to the current process.
 
-By default, new privileges are not restricted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101333r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, new privileges are not restricted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101333r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Start the containers as below:
 
 docker run --rm -it --security-opt=no-new-privileges &lt;image&gt;
 
-A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext><fix id="F-101333r1_fix" /><check system="C-94495r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext>
+            <fix id="F-101333r1_fix" />
+            <check system="C-94495r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure all containers are restricted from acquiring additional privileges.
 
@@ -1471,17 +3440,40 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'
 
-The above command should return all the security options currently configured for the containers, and no-new-privileges should also be one of them. If it is, then this is a finding.</check-content></check></Rule></Group><Group id="V-95669"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104807r1_rule" severity="high" weight="10.0"><version>DKER-EE-002120</version><title>The Docker Enterprise hosts user namespace must not be shared.</title><description>&lt;VulnDiscussion&gt;Do not share the host's user namespaces with the containers.
+The above command should return all the security options currently configured for the containers, and no-new-privileges should also be one of them. If it is, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95669">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104807r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002120</version>
+            <title>The Docker Enterprise hosts user namespace must not be shared.</title>
+            <description>&lt;VulnDiscussion&gt;Do not share the host's user namespaces with the containers.
 
 User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container thus does not isolate users on the host with users on the containers.
 
-By default, the host user namespace is shared with the containers until user namespace support is enabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101335r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+By default, the host user namespace is shared with the containers until user namespace support is enabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101335r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Do not share user namespaces between host and containers.
 
 For example, do not run a container as below:
 
-docker run --rm -it --userns=host &lt;image&gt;</fixtext><fix id="F-101335r1_fix" /><check system="C-94497r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
+docker run --rm -it --userns=host &lt;image&gt;</fixtext>
+            <fix id="F-101335r1_fix" />
+            <check system="C-94497r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.
 
 Ensure PIDs cgroup limit is used.
 
@@ -1491,13 +3483,36 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}'
 
-Ensure that it does not return any value for UsernsMode. If it returns a value of host, it means the host user namespace is shared with the containers and this is a finding.</check-content></check></Rule></Group><Group id="V-95671"><title>SRG-APP-000141</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104809r1_rule" severity="high" weight="10.0"><version>DKER-EE-002130</version><title>The Docker Enterprise socket must not be mounted inside any containers.</title><description>&lt;VulnDiscussion&gt;The docker socket docker.sock (Linux) and \\.\pipe\docker_engine (Windows) should not be mounted inside a container, with the exception case being during the installation of Universal Control Plane (UCP) component of Docker Enterprise as it is required for install.
+Ensure that it does not return any value for UsernsMode. If it returns a value of host, it means the host user namespace is shared with the containers and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95671">
+        <title>SRG-APP-000141</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104809r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002130</version>
+            <title>The Docker Enterprise socket must not be mounted inside any containers.</title>
+            <description>&lt;VulnDiscussion&gt;The docker socket docker.sock (Linux) and \\.\pipe\docker_engine (Windows) should not be mounted inside a container, with the exception case being during the installation of Universal Control Plane (UCP) component of Docker Enterprise as it is required for install.
 
 If the docker socket is mounted inside a container it would allow processes running within the container to execute docker commands which effectively allows for full control of the host.
 
-By default, docker.sock (linux) and \\.\pipe\docker_engine (windows) is not mounted inside containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-101337r1_fix">When using the -v/--volume flags to mount volumes to containers in a docker run command, do not use docker.sock as a volume.
-
-A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext><fix id="F-101337r1_fix" /><check system="C-94499r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check should be executed on all nodes in a Docker Enterprise cluster.
+By default, docker.sock (linux) and \\.\pipe\docker_engine (windows) is not mounted inside containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000381</ident>
+            <fixtext fixref="F-101337r1_fix">When using the -v/--volume flags to mount volumes to containers in a docker run command, do not use docker.sock as a volume.
+
+A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.</fixtext>
+            <fix id="F-101337r1_fix" />
+            <check system="C-94499r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check should be executed on all nodes in a Docker Enterprise cluster.
 
 via CLI:
 
@@ -1505,11 +3520,34 @@ As a Docker EE Admin, execute the following command using a UCP client bundle:
 
 docker ps --all | grep -iv "ucp\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep -i "docker.sock\|docker_engine"
 
-If the Docker socket is mounted inside containers, this is a finding.</check-content></check></Rule></Group><Group id="V-95673"><title>SRG-APP-000142</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104811r1_rule" severity="high" weight="10.0"><version>DKER-EE-002150</version><title>Docker Enterprise privileged ports must not be mapped within containers.</title><description>&lt;VulnDiscussion&gt;The TCP/IP port numbers below 1024 are considered privileged ports. Normal users and processes are not allowed to use them for various security reasons. Docker allows a container port to be mapped to a privileged port.
-
-By default, if the user does not specifically declare the container port to host port mapping, Docker automatically and correctly maps the container port to one available in 49153-65535 block on the host. But, Docker allows a container port to be mapped to a privileged port on the host if the user explicitly declared it. This is so because containers are executed with NET_BIND_SERVICE Linux kernel capability that does not restrict the privileged port mapping. The privileged ports receive and transmit various sensitive and privileged data. Allowing containers to use them can bring serious implications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-101339r1_fix">This fix only applies to the use of Docker Engine - Enterprise.
-
-Do not map the container ports to privileged host ports when starting a container. Also, ensure that there is no such container to host privileged port mapping declarations in the Dockerfile.</fixtext><fix id="F-101339r1_fix" /><check system="C-94501r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check should be executed on all nodes in a Docker Enterprise cluster.
+If the Docker socket is mounted inside containers, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95673">
+        <title>SRG-APP-000142</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104811r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-002150</version>
+            <title>Docker Enterprise privileged ports must not be mapped within containers.</title>
+            <description>&lt;VulnDiscussion&gt;The TCP/IP port numbers below 1024 are considered privileged ports. Normal users and processes are not allowed to use them for various security reasons. Docker allows a container port to be mapped to a privileged port.
+
+By default, if the user does not specifically declare the container port to host port mapping, Docker automatically and correctly maps the container port to one available in 49153-65535 block on the host. But, Docker allows a container port to be mapped to a privileged port on the host if the user explicitly declared it. This is so because containers are executed with NET_BIND_SERVICE Linux kernel capability that does not restrict the privileged port mapping. The privileged ports receive and transmit various sensitive and privileged data. Allowing containers to use them can bring serious implications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000382</ident>
+            <fixtext fixref="F-101339r1_fix">This fix only applies to the use of Docker Engine - Enterprise.
+
+Do not map the container ports to privileged host ports when starting a container. Also, ensure that there is no such container to host privileged port mapping declarations in the Dockerfile.</fixtext>
+            <fix id="F-101339r1_fix" />
+            <check system="C-94501r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check should be executed on all nodes in a Docker Enterprise cluster.
 
 Verify that no running containers are mapping host port numbers below 1024.
 
@@ -1519,16 +3557,39 @@ Linux: Execute the following command as a trusted user on the host operating sys
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'
 
-Review the list and ensure that container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.</check-content></check></Rule></Group><Group id="V-95675"><title>SRG-APP-000142</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104813r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002160</version><title>Docker Enterprise incoming container traffic must be bound to a specific host interface.</title><description>&lt;VulnDiscussion&gt;By default, Docker containers can make connections to the outside world, but the outside world cannot connect to containers. Each outgoing connection will appear to originate from one of the host machine's own IP addresses. Only allow container services to be contacted through a specific external interface on the host machine.
+Review the list and ensure that container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95675">
+        <title>SRG-APP-000142</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104813r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002160</version>
+            <title>Docker Enterprise incoming container traffic must be bound to a specific host interface.</title>
+            <description>&lt;VulnDiscussion&gt;By default, Docker containers can make connections to the outside world, but the outside world cannot connect to containers. Each outgoing connection will appear to originate from one of the host machine's own IP addresses. Only allow container services to be contacted through a specific external interface on the host machine.
 
 If there are multiple network interfaces on the host machine, the container can accept connections on the exposed ports on any network interface. This might not be desired and may not be secured. Many times, a particular interface is exposed externally and services such as intrusion detection, intrusion prevention, firewall, load balancing, etc. are run on those interfaces to screen incoming public traffic. Hence, do not accept incoming connections on any interface. Only allow incoming connections from a particular external interface.
 
-By default, Docker exposes the container ports on 0.0.0.0, the wildcard IP address that will match any possible incoming network interface on the host machine.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-101341r1_fix">Bind the container port to a specific host interface on the desired host port.
+By default, Docker exposes the container ports on 0.0.0.0, the wildcard IP address that will match any possible incoming network interface on the host machine.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000382</ident>
+            <fixtext fixref="F-101341r1_fix">Bind the container port to a specific host interface on the desired host port.
 
 Example:
 docker run --detach --publish 10.2.3.4:49153:80 nginx
 
-In the example above, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from 10.2.3.4 external interface.</fixtext><fix id="F-101341r1_fix" /><check system="C-94503r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure incoming container traffic is bound to a specific host interface.
+In the example above, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from 10.2.3.4 external interface.</fixtext>
+            <fix id="F-101341r1_fix" />
+            <check system="C-94503r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure incoming container traffic is bound to a specific host interface.
 
 This check should be executed on all nodes in a Docker Enterprise cluster.
 
@@ -1540,15 +3601,40 @@ docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkS
 
 Review the list and ensure that the exposed container ports are tied to a particular interface and not to the wildcard IP address - 0.0.0.0. If they are, then this is a finding.
 
-For example, if the above command returns as below the container can accept connections on any host interface on the specified port 49153, this is a finding.
-
-Ports=map[443/TCP:&lt;nil&gt; 80/TCP:[map[HostPort:49153 HostIp:0.0.0.0]]]
-
-However, if the exposed port is tied to a particular interface on the host as below, then this recommendation is configured as desired and is compliant.
-
-Ports=map[443/TCP:&lt;nil&gt; 80/TCP:[map[HostIp:10.2.3.4 HostPort:49153]]]</check-content></check></Rule></Group><Group id="V-95677"><title>SRG-APP-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104815r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002180</version><title>SAML integration must be enabled in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP and SAML integration in UCP and DTR. To meet the requirements of this control, configure LDAP and SAML integration.
-
-Satisfies: SRG-APP-000149, SRG-APP-000150, SRG-APP-000151, SRG-APP-000152, SRG-APP-000153, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403, SRG-APP-000404, SRG-APP-000405&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000765</ident><ident system="http://iase.disa.mil/cci">CCI-000766</ident><ident system="http://iase.disa.mil/cci">CCI-000767</ident><ident system="http://iase.disa.mil/cci">CCI-000768</ident><ident system="http://iase.disa.mil/cci">CCI-000770</ident><ident system="http://iase.disa.mil/cci">CCI-001953</ident><ident system="http://iase.disa.mil/cci">CCI-001954</ident><ident system="http://iase.disa.mil/cci">CCI-002009</ident><ident system="http://iase.disa.mil/cci">CCI-002010</ident><ident system="http://iase.disa.mil/cci">CCI-002011</ident><ident system="http://iase.disa.mil/cci">CCI-002014</ident><fixtext fixref="F-101343r1_fix">Enable and configure SAML integration in the UCP Admin Settings.
+For example, if the above command returns as below the container can accept connections on any host interface on the specified port 49153, this is a finding. Ports=map[443/TCP:&lt;nil&gt; 80/TCP:[map[HostPort:49153 HostIp:0.0.0.0]]]
+
+However, if the exposed port is tied to a particular interface on the host as below, then this recommendation is configured as desired and is compliant. Ports=map[443/TCP:&lt;nil&gt; 80/TCP:[map[HostIp:10.2.3.4 HostPort:49153]]]</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95677">
+        <title>SRG-APP-000149</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104815r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002180</version>
+            <title>SAML integration must be enabled in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP and SAML integration in UCP and DTR. To meet the requirements of this control, configure LDAP and SAML integration.
+
+Satisfies: SRG-APP-000149, SRG-APP-000150, SRG-APP-000151, SRG-APP-000152, SRG-APP-000153, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403, SRG-APP-000404, SRG-APP-000405&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000765</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000766</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000767</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000768</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000770</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001953</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001954</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002009</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002010</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002011</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002014</ident>
+            <fixtext fixref="F-101343r1_fix">Enable and configure SAML integration in the UCP Admin Settings.
 
 via UI:
 
@@ -1556,16 +3642,18 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file. Set the "samlEnabled" entry under the "[auth]" section to "true". Set the "idpMetadataURL" and "spHost" entries under the "[auth.saml]" to appropriate values per the UCP configuration options as documented at https://docs.docker.com/ee/ucp/admin/configure/ucp-configuration-file/#authsaml-optional. Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101343r1_fix" /><check system="C-94505r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that SAML integration is enabled and properly configured in the UCP Admin Settings.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101343r1_fix" />
+            <check system="C-94505r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that SAML integration is enabled and properly configured in the UCP Admin Settings.
 
 via UI:
 
@@ -1573,14 +3661,31 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Verify that the "samlEnabled" entry under the "[auth]" section is set to "true".
 
-If the "samlEnabled" entry under the "[auth]" section is not set to "true", then this is a finding.</check-content></check></Rule></Group><Group id="V-95679"><title>SRG-APP-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104817r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002380</version><title>The certificate chain used by Universal Control Plane (UCP) client bundles must match what is defined in the System Security Plan (SSP) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. UCP has the ability to use external certificates or internal self-signed. In the case of self-signed UCP includes a certificate authority which is used to sign client bundles and to authenticate users via the eNZi backplane. With an external certificate authority (CA) users will use their existing x509 certs. The external CA will be added in an administrative function and will dictate the root CA for the user's chain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-101345r2_fix">via GUI:
+If the "samlEnabled" entry under the "[auth]" section is not set to "true", then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95679">
+        <title>SRG-APP-000175</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104817r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002380</version>
+            <title>The certificate chain used by Universal Control Plane (UCP) client bundles must match what is defined in the System Security Plan (SSP) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. UCP has the ability to use external certificates or internal self-signed. In the case of self-signed UCP includes a certificate authority which is used to sign client bundles and to authenticate users via the eNZi backplane. With an external certificate authority (CA) users will use their existing x509 certs. The external CA will be added in an administrative function and will dictate the root CA for the user's chain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000186</ident>
+            <fixtext fixref="F-101345r2_fix">via GUI:
 
 As any user with access to UCP, within the UCP web console, click on the username dropdown in the top-left corner, and select "My Profile". On the "Client Bundles" tab, select the "New Client Bundle" dropdown and click "Add Existing Client Bundle". Provide an appropriate "Label", and in the "Public Key" field, paste the public key of the certificate chain provided to that user by the organization. Click "Confirm" to save the bundle.
 
@@ -1588,17 +3693,54 @@ via CLI:
 
 Linux (requires curl): As a Docker EE Admin, execute the following commands using a client bundle and from a machine with connectivity to the UCP management console.
 
-curl --cacert ca.pem --cert cert.pem --key key.pem -X POST -H "Content-Type: application/json" -d '{"certificates":[{"cert":"[encoded_PEM_for_cert]","label":"[cert_label]"}],"label":"[key_description]","publicKey":"[encoded_PEM_for_public_key]"}' https://[ucp_url]/api/accounts/[account_name_or_id]/publickeys</fixtext><fix id="F-101345r2_fix" /><check system="C-94507r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>via CLI: Execute the following command from within the directory in which the UCP client bundle is located.
+curl --cacert ca.pem --cert cert.pem --key key.pem -X POST -H "Content-Type: application/json" -d '{"certificates":[{"cert":"[encoded_PEM_for_cert]","label":"[cert_label]"}],"label":"[key_description]","publicKey":"[encoded_PEM_for_public_key]"}' https://[ucp_url]/api/accounts/[account_name_or_id]/publickeys</fixtext>
+            <fix id="F-101345r2_fix" />
+            <check system="C-94507r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>via CLI: Execute the following command from within the directory in which the UCP client bundle is located.
 
 (Linux) openssl x509 -noout -text -in cert.pem |grep "Subject\|Issuer"
 
 Verify that the Subject and Issuer output matches that which is defined in the SSP.
 
-If the Subject and Issuer do not match what is documented in the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95681"><title>SRG-APP-000176</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104819r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002410</version><title>Docker Enterprise secret management commands must be used for managing secrets in a Swarm cluster.</title><description>&lt;VulnDiscussion&gt;Use Docker's in-built secret management commands for managing sensitive data that which can be stored in key/value pairs. Examples include API tokens, database connection strings and credentials, SSL certificates, and the like.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-101347r1_fix">Update the SSP so that it includes documented processes for using Docker secrets commands to manage sensitive data that can be stored in key/value pairs. Examples include API tokens, database connection strings and credentials, SSL certificates, and the like. Follow docker secret documentation and use it to manage secrets effectively. This documentation can be found at https://docs.docker.com/engine/swarm/secrets/.</fixtext><fix id="F-101347r1_fix" /><check system="C-94509r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster.
+If the Subject and Issuer do not match what is documented in the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95681">
+        <title>SRG-APP-000176</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104819r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002410</version>
+            <title>Docker Enterprise secret management commands must be used for managing secrets in a Swarm cluster.</title>
+            <description>&lt;VulnDiscussion&gt;Use Docker's in-built secret management commands for managing sensitive data that which can be stored in key/value pairs. Examples include API tokens, database connection strings and credentials, SSL certificates, and the like.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000186</ident>
+            <fixtext fixref="F-101347r1_fix">Update the SSP so that it includes documented processes for using Docker secrets commands to manage sensitive data that can be stored in key/value pairs. Examples include API tokens, database connection strings and credentials, SSL certificates, and the like. Follow docker secret documentation and use it to manage secrets effectively. This documentation can be found at https://docs.docker.com/engine/swarm/secrets/.</fixtext>
+            <fix id="F-101347r1_fix" />
+            <check system="C-94509r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster.
 
 Refer to the System Security Plan (SSP) and verify that it includes documented processes for using Docker secrets commands to manage sensitive data that can be stored in key/value pairs. Examples include API tokens, database connection strings and credentials, SSL certificates, and the like.
 
-If the SSP does not have this documented, then this is a finding.</check-content></check></Rule></Group><Group id="V-95683"><title>SRG-APP-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104821r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002490</version><title>The Lifetime Minutes and Renewal Threshold Minutes Login Session Controls must be set to 10 and 0 respectively in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and subsequently terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements. The lifetime minutes login session control is configured with a default of 60 minutes (1 hour) and the renewal threshold minutes is configured with a default of 20 minutes. For reference, the lifetime login session control in UCP specifies the initial lifetime (in minutes) of a session from the moment it is generated. The renewal threshold setting indicates a period of time (in minutes) before the expiration of a session where, if used, a session will be extended by the current configured lifetime from then. This value cannot be greater than the configured lifetime. A value equal to the lifetime means that sessions will be extended with every use. A value of zero indicates that sessions should never be extended but this may result in unexpectedly being logged out if the session expires while performing a series of actions in the UI. This configuration only applies to both the UCP and Docker Trusted Registry (DTR) management consoles and not when connecting via the command line. When connecting via the command line, this control is not applicable.
+If the SSP does not have this documented, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95683">
+        <title>SRG-APP-000190</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104821r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002490</version>
+            <title>The Lifetime Minutes and Renewal Threshold Minutes Login Session Controls must be set to 10 and 0 respectively in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and subsequently terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements. The lifetime minutes login session control is configured with a default of 60 minutes (1 hour) and the renewal threshold minutes is configured with a default of 20 minutes. For reference, the lifetime login session control in UCP specifies the initial lifetime (in minutes) of a session from the moment it is generated. The renewal threshold setting indicates a period of time (in minutes) before the expiration of a session where, if used, a session will be extended by the current configured lifetime from then. This value cannot be greater than the configured lifetime. A value equal to the lifetime means that sessions will be extended with every use. A value of zero indicates that sessions should never be extended but this may result in unexpectedly being logged out if the session expires while performing a series of actions in the UI. This configuration only applies to both the UCP and Docker Trusted Registry (DTR) management consoles and not when connecting via the command line. When connecting via the command line, this control is not applicable.
 
 It's important to note that the notion of a session varies depending on how one is connecting to a UCP cluster or DTR. In all of these cases, there is no specific session termination capability. Either the session times out, the user's client bundle has expired, or a user explicitly logs out. This has been outlined as follows:
 
@@ -1612,7 +3754,21 @@ It's important to note that the notion of a session varies depending on how one
 - the user's account is no longer active (either explicitly disabled from within the UCP user management options or at the LDAP server)
 - the user's password is changed
 
-Satisfies: SRG-APP-000190, SRG-APP-000002, SRG-APP-000003, SRG-APP-000295, SRG-APP-000389, SRG-APP-000400&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000057</ident><ident system="http://iase.disa.mil/cci">CCI-000060</ident><ident system="http://iase.disa.mil/cci">CCI-001133</ident><ident system="http://iase.disa.mil/cci">CCI-002007</ident><ident system="http://iase.disa.mil/cci">CCI-002038</ident><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-101349r1_fix">Set the "Lifetime Minutes" and "Renewal Threshold Minutes" Login Session Controls in the UCP Admin Settings to "10" and "0" respectively.
+Satisfies: SRG-APP-000190, SRG-APP-000002, SRG-APP-000003, SRG-APP-000295, SRG-APP-000389, SRG-APP-000400&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000057</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-000060</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001133</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002007</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002038</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002361</ident>
+            <fixtext fixref="F-101349r1_fix">Set the "Lifetime Minutes" and "Renewal Threshold Minutes" Login Session Controls in the UCP Admin Settings to "10" and "0" respectively.
 
 via UI:
 
@@ -1620,16 +3776,18 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "lifetime_minutes" and "renewal_threshold_minutes" entries under the "[auth.sessions]" section to "10" and "0" respectively.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101349r1_fix" /><check system="C-94511r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that the "Lifetime Minutes" and "Renewal Threshold Minutes" Login Session Controls in the Universal Control Plane (UCP) Admin Settings to "10" and "0" respectively.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101349r1_fix" />
+            <check system="C-94511r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that the "Lifetime Minutes" and "Renewal Threshold Minutes" Login Session Controls in the Universal Control Plane (UCP) Admin Settings to "10" and "0" respectively.
 
 via UI:
 
@@ -1637,32 +3795,76 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "lifetime_minutes" and "renewal_threshold_minutes" entries under the "[auth.sessions]" section in the output, and verify that the "lifetime_minutes" field is set to "10" and the "renewal_threshold_minutes" field is set to "0". 
 
-If they are not, then this is a finding.</check-content></check></Rule></Group><Group id="V-95685"><title>SRG-APP-000231</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104823r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002660</version><title>Docker Secrets must be used to store configuration files and small amounts of user-generated data (up to 500 kb in size) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;By leveraging Docker Secrets or Kubernetes secrets to store configuration files and small amounts of user-generated data (up to 500 kb in size), the data is encrypted at rest by the Engine's FIPS-validated cryptography.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-101351r1_fix">For all containerized applications that leverage configuration files and/or small amounts of user-generated data, store that data in Docker Secrets.
+If they are not, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95685">
+        <title>SRG-APP-000231</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104823r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002660</version>
+            <title>Docker Secrets must be used to store configuration files and small amounts of user-generated data (up to 500 kb in size) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;By leveraging Docker Secrets or Kubernetes secrets to store configuration files and small amounts of user-generated data (up to 500 kb in size), the data is encrypted at rest by the Engine's FIPS-validated cryptography.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001199</ident>
+            <fixtext fixref="F-101351r1_fix">For all containerized applications that leverage configuration files and/or small amounts of user-generated data, store that data in Docker Secrets.
 
 All secrets should be created and managed using a UCP client bundle.
 
-A reference for the use of docker secrets can be found at https://docs.docker.com/engine/swarm/secrets/.</fixtext><fix id="F-101351r1_fix" /><check system="C-94513r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Review System Security Plan (SSP) and identify applications that leverage configuration files and/or small amounts of user-generated data, ensure that data is stored in Docker Secrets or Kubernetes Secrets.
+A reference for the use of docker secrets can be found at https://docs.docker.com/engine/swarm/secrets/.</fixtext>
+            <fix id="F-101351r1_fix" />
+            <check system="C-94513r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Review System Security Plan (SSP) and identify applications that leverage configuration files and/or small amounts of user-generated data, ensure that data is stored in Docker Secrets or Kubernetes Secrets.
 
 Using a Universal Control Plane (UCP) client bundle, verify that secrets are in use by executing the following commands:
 
 docker secret ls
 
 Confirm containerized applications identified in SSP as utilizing Docker secrets have a corresponding secret configured.
-If the SSP requires Docker secrets be used but the containerized application does not use Docker secrets, this is a finding.</check-content></check></Rule></Group><Group id="V-95687"><title>SRG-APP-000247</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104825r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002770</version><title>Docker Enterprise container health must be checked at runtime.</title><description>&lt;VulnDiscussion&gt;If the container image does not have an HEALTHCHECK instruction defined, use --health-cmd parameter at container runtime for checking container health.
+If the SSP requires Docker secrets be used but the containerized application does not use Docker secrets, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95687">
+        <title>SRG-APP-000247</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104825r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002770</version>
+            <title>Docker Enterprise container health must be checked at runtime.</title>
+            <description>&lt;VulnDiscussion&gt;If the container image does not have an HEALTHCHECK instruction defined, use --health-cmd parameter at container runtime for checking container health.
 
 One of the important security triads is availability. If the container image being used does not have a pre-defined HEALTHCHECK instruction, use the --health-cmd parameter to check container health at runtime. Based on the reported health status, take necessary actions.
 
-By default, health checks are not done at container runtime.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001095</ident><fixtext fixref="F-101353r1_fix">Run the container using --health-cmd and the other parameters, or include the HEALTHCHECK instruction in the Dockerfiles.
+By default, health checks are not done at container runtime.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001095</ident>
+            <fixtext fixref="F-101353r1_fix">Run the container using --health-cmd and the other parameters, or include the HEALTHCHECK instruction in the Dockerfiles.
 
 Example:
-docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx</fixtext><fix id="F-101353r1_fix" /><check system="C-94515r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure container health is checked at runtime.
+docker run -d --health-cmd='stat /etc/passwd || exit 1' nginx</fixtext>
+            <fix id="F-101353r1_fix" />
+            <check system="C-94515r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure container health is checked at runtime.
 
 via CLI:
 
@@ -1672,17 +3874,40 @@ Run the below command and ensure that all the containers are reporting health st
 
 docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Health={{ .State.Health.Status }}'
 
-If Health does not = "Healthy", this is a finding.</check-content></check></Rule></Group><Group id="V-95689"><title>SRG-APP-000247</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104827r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002780</version><title>PIDs cgroup limits must be used in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Use --pids-limit flag at container runtime.
+If Health does not = "Healthy", this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95689">
+        <title>SRG-APP-000247</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104827r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002780</version>
+            <title>PIDs cgroup limits must be used in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Use --pids-limit flag at container runtime.
 
 Attackers could launch a fork bomb with a single command inside the container. This fork bomb can crash the entire system and requires a restart of the host to make the system functional again. PIDs cgroup --pids-limit will prevent this kind of attacks by restricting the number of forks that can happen inside a container at a given time.
 
-The Default value for --pids-limit is 0 which means there is no restriction on the number of forks. Also, note that PIDs cgroup limit works only for the kernel versions 4.3+.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001095</ident><fixtext fixref="F-101355r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+The Default value for --pids-limit is 0 which means there is no restriction on the number of forks. Also, note that PIDs cgroup limit works only for the kernel versions 4.3+.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001095</ident>
+            <fixtext fixref="F-101355r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Use --pids-limit flag while launching the container with an appropriate value.
 
 Example:
 docker run -it --pids-limit 100 &lt;Image_ID&gt;
-In the above example, the number of processes allowed to run at any given time is set to 100. After a limit of 100 concurrently running processes is reached, docker would restrict any new process creation.</fixtext><fix id="F-101355r1_fix" /><check system="C-94517r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+In the above example, the number of processes allowed to run at any given time is set to 100. After a limit of 100 concurrently running processes is reached, docker would restrict any new process creation.</fixtext>
+            <fix id="F-101355r1_fix" />
+            <check system="C-94517r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Ensure PIDs cgroup limit is used.
 
@@ -1692,7 +3917,17 @@ Linux: As a Docker EE Admin, execute the following command using a Universal Con
 
 docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: PidsLimit={{ .HostConfig.PidsLimit }}'
 
-Ensure that PidsLimit is not set to 0 or -1. A PidsLimit of 0 or -1 means that any number of processes can be forked inside the container concurrently. If the PidsLimit is set to either 0 or -1 then this is a finding.</check-content></check></Rule></Group><Group id="V-95691"><title>SRG-APP-000295</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104829r1_rule" severity="low" weight="10.0"><version>DKER-EE-002970</version><title>The Docker Enterprise per user limit login session control must be set per the requirements in the System Security Plan (SSP).</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and allows for automatic user session termination after organization-defined conditions or trigger events requiring session disconnect. The lifetime minutes login session control is configured with a default of 60 minutes (1 hour) and the renewal threshold minutes is configured with a default of 20 minutes. For reference, the lifetime login session control in UCP specifies the initial lifetime (in minutes) of a session from the moment it is generated. The renewal threshold setting indicates a period of time (in minutes) before the expiration of a session where, if used, a session will be extended by the current configured lifetime from then. This value cannot be greater than the configured lifetime. A value equal to the lifetime means that sessions will be extended with every use. A value of zero indicates that sessions should never be extended but this may result in unexpectedly being logged out if the session expires while performing a series of actions in the UI. This configuration only applies to both the UCP and Docker Trusted Registry (DTR) management consoles and not when connecting via the command line. When connecting via the command line, this control is not applicable.
+Ensure that PidsLimit is not set to 0 or -1. A PidsLimit of 0 or -1 means that any number of processes can be forked inside the container concurrently. If the PidsLimit is set to either 0 or -1 then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95691">
+        <title>SRG-APP-000295</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104829r1_rule" severity="low" weight="10.0">
+            <version>DKER-EE-002970</version>
+            <title>The Docker Enterprise per user limit login session control must be set per the requirements in the System Security Plan (SSP).</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) component of Docker Enterprise includes a built-in access authorization mechanism called eNZi which can be integrated with an LDAP server and allows for automatic user session termination after organization-defined conditions or trigger events requiring session disconnect. The lifetime minutes login session control is configured with a default of 60 minutes (1 hour) and the renewal threshold minutes is configured with a default of 20 minutes. For reference, the lifetime login session control in UCP specifies the initial lifetime (in minutes) of a session from the moment it is generated. The renewal threshold setting indicates a period of time (in minutes) before the expiration of a session where, if used, a session will be extended by the current configured lifetime from then. This value cannot be greater than the configured lifetime. A value equal to the lifetime means that sessions will be extended with every use. A value of zero indicates that sessions should never be extended but this may result in unexpectedly being logged out if the session expires while performing a series of actions in the UI. This configuration only applies to both the UCP and Docker Trusted Registry (DTR) management consoles and not when connecting via the command line. When connecting via the command line, this control is not applicable.
 
 It's important to note that the notion of a session varies depending on how one is connecting to a UCP cluster or DTR. In all of these cases, there is no specific session termination capability. Either the session times out, the user's client bundle has expired, or a user explicitly logs out. This has been outlined as follows:
 
@@ -1706,7 +3941,16 @@ It's important to note that the notion of a session varies depending on how one
 - the user's account is no longer active (either explicitly disabled from within the UCP user management options or at the LDAP server)
 - the user's password is changed
 
-*NOTE: Docker Engine - Enterprise, by itself, does not meet the requirements of this control. If the intent is to use Docker in a model consistent with the access control policies as required by this control, obtain and properly configure the UCP component of Docker Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-101357r1_fix">Set the "Per User Limit" Login Session Control in the UCP Admin Settings per the requirements set forth by the SSP but not "0".
+*NOTE: Docker Engine - Enterprise, by itself, does not meet the requirements of this control. If the intent is to use Docker in a model consistent with the access control policies as required by this control, obtain and properly configure the UCP component of Docker Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002361</ident>
+            <fixtext fixref="F-101357r1_fix">Set the "Per User Limit" Login Session Control in the UCP Admin Settings per the requirements set forth by the SSP but not "0".
 
 via UI:
 
@@ -1714,16 +3958,18 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "per_user_limit" entry under the "[auth.sessions]" section according to the SSP but not 0. Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101357r1_fix" /><check system="C-94519r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Check that the "Per User Limit" Login Session Control in the UCP Admin Settings are set according to the System Security Plan but not set to "0". 
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101357r1_fix" />
+            <check system="C-94519r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Check that the "Per User Limit" Login Session Control in the UCP Admin Settings are set according to the System Security Plan but not set to "0". 
 
 via UI:
 
@@ -1731,20 +3977,41 @@ In the UCP web console, navigate to "Admin Settings" | "Authentication &amp; Aut
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "per_user_limit" entry under the "[auth.sessions]" section in the output, and verify that it is set according to the requirements of this control.
 
-If the "per_user_limit" entry under the "[auth.sessions]" section in the output is not set according to the value defined in the SSP, or if the per user limit is set to "0", then this is a finding.</check-content></check></Rule></Group><Group id="V-95693"><title>SRG-APP-000342</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104831r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003200</version><title>Docker Enterprise images must be built with the USER instruction to prevent containers from running as root.</title><description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. Apply an applicable set of role-based access control (RBAC) policies using the built-in capabilities provided by UCP in order to prevent organization-defined software from executing at higher privilege levels than users executing the software.
-
-By default, Docker images that are built without the USER instruction will be run as containers as root. Therefore, it is imperative that container images include the USER instruction and that the referenced UID/GID has been defined in the base image or previous instruction set.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002233</ident><fixtext fixref="F-101359r1_fix">Set a non-root user for all container images.
+If the "per_user_limit" entry under the "[auth.sessions]" section in the output is not set according to the value defined in the SSP, or if the per user limit is set to "0", then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95693">
+        <title>SRG-APP-000342</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104831r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003200</version>
+            <title>Docker Enterprise images must be built with the USER instruction to prevent containers from running as root.</title>
+            <description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. Apply an applicable set of role-based access control (RBAC) policies using the built-in capabilities provided by UCP in order to prevent organization-defined software from executing at higher privilege levels than users executing the software.
+
+By default, Docker images that are built without the USER instruction will be run as containers as root. Therefore, it is imperative that container images include the USER instruction and that the referenced UID/GID has been defined in the base image or previous instruction set.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002233</ident>
+            <fixtext fixref="F-101359r1_fix">Set a non-root user for all container images.
 
 Include the following line in all Dockerfiles where username or ID refers to the user that can be found in the container base image or one that is created as part of that same Dockerfile:
 
-USER [username/ID]</fixtext><fix id="F-101359r1_fix" /><check system="C-94521r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that all containers are running as non-root users.
+USER [username/ID]</fixtext>
+            <fix id="F-101359r1_fix" />
+            <check system="C-94521r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that all containers are running as non-root users.
 
 via CLI: As a Docker EE admin, execute the following command using a client bundle:
 
@@ -1752,7 +4019,17 @@ docker ps -q -a | xargs docker inspect --format '{{ .Id }}: User={{ .Config.User
 
 Ensure that a non-admin username or user ID is returned for all containers in the output.
 
-If User is 0, root or undefined, this is a finding.</check-content></check></Rule></Group><Group id="V-95695"><title>SRG-APP-000343</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104833r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003230</version><title>An appropriate Docker Engine - Enterprise log driver plugin must be configured to collect audit events from Universal Control Plane (UCP) and Docker Trusted Registry (DTR).</title><description>&lt;VulnDiscussion&gt;The UCP and DTR components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If User is 0, root or undefined, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95695">
+        <title>SRG-APP-000343</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104833r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003230</version>
+            <title>An appropriate Docker Engine - Enterprise log driver plugin must be configured to collect audit events from Universal Control Plane (UCP) and Docker Trusted Registry (DTR).</title>
+            <description>&lt;VulnDiscussion&gt;The UCP and DTR components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -1775,13 +4052,28 @@ All audit logs generated by UCP and DTR can be forwarded to a remote log aggrega
 
 The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.
 
-Satisfies: SRG-APP-000343, SRG-APP-000381, SRG-APP-000492, SRG-APP-000493, SRG-APP-000494, SRG-APP-000495, SRG-APP-000496, SRG-APP-000497, SRG-APP-000498, SRG-APP-000499, SRG-APP-000501, SRG-APP-000502, SRG-APP-000503, SRG-APP-000504, SRG-APP-000505, SRG-APP-000506, SRG-APP-000507, SRG-APP-000508, SRG-APP-000509, SRG-APP-000510, SRG-APP-000500&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-001814</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><fixtext fixref="F-101361r1_fix">via CLI:
+Satisfies: SRG-APP-000343, SRG-APP-000381, SRG-APP-000492, SRG-APP-000493, SRG-APP-000494, SRG-APP-000495, SRG-APP-000496, SRG-APP-000497, SRG-APP-000498, SRG-APP-000499, SRG-APP-000501, SRG-APP-000502, SRG-APP-000503, SRG-APP-000504, SRG-APP-000505, SRG-APP-000506, SRG-APP-000507, SRG-APP-000508, SRG-APP-000509, SRG-APP-000510, SRG-APP-000500&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000172</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-001814</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002234</ident>
+            <fixtext fixref="F-101361r1_fix">via CLI:
 
 Linux: As a trusted user on the host operating system, open the /etc/docker/daemon.json file for editing. If the file doesn't exist, it must be created.
 
 Set the "log-driver" property to one of the following: "syslog", "awslogs", "splunk", "gcplogs", "logentries" or "&lt;plugin&gt;" (where &lt;plugin&gt; is the naming of a third-party Docker logging driver plugin). Configure the "log-opts" object as required by the selected "log-driver".
 
-Save the file. Restart the docker daemon.</fixtext><fix id="F-101361r1_fix" /><check system="C-94523r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>via CLI:
+Save the file. Restart the docker daemon.</fixtext>
+            <fix id="F-101361r1_fix" />
+            <check system="C-94523r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>via CLI:
 
 Linux: Execute the following commands as a trusted user on the host operating system:
 
@@ -1789,9 +4081,28 @@ cat /etc/docker/daemon.json | grep -i log-driver
 
 Verify that the "log-driver" property is set to one of the following: "syslog", "awslogs", "splunk", "gcplogs", "logentries" or "&lt;plugin&gt;" (where &lt;plugin&gt; is the naming of a third-party Docker logging driver plugin).
 
-If "log-driver" is not set, then this is a finding.</check-content></check></Rule></Group><Group id="V-95697"><title>SRG-APP-000357</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104835r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003310</version><title>The Docker Enterprise max-size and max-file json-file drivers logging options in the daemon.json configuration file must be configured to allocate audit record storage capacity for Universal Control Plane (UCP) and Docker Trusted Registry (DTR) per the requirements set forth by the System Security Plan (SSP).</title><description>&lt;VulnDiscussion&gt;By default, the UCP and DTR components of Docker Enterprise leverage the "json-file" Engine logging driver. This driver has configurable "max-size" and "max-file" options which are applicable in the context of this control. The "max-size" option defines the maximum size of the log before it is rolled. By default it is set to "unlimited" and is never rolled. The "max-file" option defines the maximum number of log files that can be present whereby if rolling the logs creates excess files, the oldest file is removed. This setting is only effective when "max-size" is also set. By default, "max-file" is set to "1".
-
-The Docker Engine - Enterprise audit logs are stored in default locations according to the chart on this site https://docs.docker.com/config/daemon/#read-the-logs. For the Engine's daemon logs, allocate sufficient storage for the default log locations on the underlying host operating system per the requirements set forth by the SSP.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-101365r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+If "log-driver" is not set, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95697">
+        <title>SRG-APP-000357</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104835r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003310</version>
+            <title>The Docker Enterprise max-size and max-file json-file drivers logging options in the daemon.json configuration file must be configured to allocate audit record storage capacity for Universal Control Plane (UCP) and Docker Trusted Registry (DTR) per the requirements set forth by the System Security Plan (SSP).</title>
+            <description>&lt;VulnDiscussion&gt;By default, the UCP and DTR components of Docker Enterprise leverage the "json-file" Engine logging driver. This driver has configurable "max-size" and "max-file" options which are applicable in the context of this control. The "max-size" option defines the maximum size of the log before it is rolled. By default it is set to "unlimited" and is never rolled. The "max-file" option defines the maximum number of log files that can be present whereby if rolling the logs creates excess files, the oldest file is removed. This setting is only effective when "max-size" is also set. By default, "max-file" is set to "1".
+
+The Docker Engine - Enterprise audit logs are stored in default locations according to the chart on this site https://docs.docker.com/config/daemon/#read-the-logs. For the Engine's daemon logs, allocate sufficient storage for the default log locations on the underlying host operating system per the requirements set forth by the SSP.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001849</ident>
+            <fixtext fixref="F-101365r1_fix">This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
@@ -1801,7 +4112,11 @@ Open "/etc/docker/daemon.json" for editing. If the file doesn't exist, it must b
 
 Set the "log-opts" object and its "max-size" and "max-file" properties according to values defined in the SSP.
 
-Save the file. Restart the Docker daemon.</fixtext><fix id="F-101365r1_fix" /><check system="C-94527r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
+Save the file. Restart the Docker daemon.</fixtext>
+            <fix id="F-101365r1_fix" />
+            <check system="C-94527r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.
 
 via CLI:
 
@@ -1809,7 +4124,17 @@ Linux: Execute the following commands as a trusted user on the host operating sy
 
 cat /etc/docker/daemon.json
 
-Verify that the "log-opts" object includes the "max-size" and "max-file" properties and that they are set according to requirements specified in the SSP. If they are not configured according to values defined in the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95699"><title>SRG-APP-000358</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104837r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003320</version><title>All Docker Engine - Enterprise nodes must be configured with a log driver plugin that sends logs to a remote log aggregation system (SIEM).</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+Verify that the "log-opts" object includes the "max-size" and "max-file" properties and that they are set according to requirements specified in the SSP. If they are not configured according to values defined in the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95699">
+        <title>SRG-APP-000358</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104837r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003320</version>
+            <title>All Docker Engine - Enterprise nodes must be configured with a log driver plugin that sends logs to a remote log aggregation system (SIEM).</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -1830,7 +4155,16 @@ DTR audits all events associated with repository activities. Events are consider
 
 All audit logs generated by UCP and DTR can be forwarded to a remote log aggregation system by configuring an appropriate log driver plugin on all Docker Engine - Enterprise nodes in a cluster.
 
-The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001851</ident><fixtext fixref="F-101367r1_fix">via CLI:
+The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001851</ident>
+            <fixtext fixref="F-101367r1_fix">via CLI:
 
 Linux: As a trusted user on the host operating system, open the /etc/docker/daemon.json file for editing. If the file doesn't exist, it must be created.
 
@@ -1838,7 +4172,11 @@ Set the "log-driver" property to one of the following: "syslog", "awslogs", "spl
 
 Save the file. Restart the docker daemon.
 
-Configure the selected log system to send Docker events to a log aggregation server or SIEM.</fixtext><fix id="F-101367r1_fix" /><check system="C-94529r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>via CLI:
+Configure the selected log system to send Docker events to a log aggregation server or SIEM.</fixtext>
+            <fix id="F-101367r1_fix" />
+            <check system="C-94529r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>via CLI:
 
 Linux: Execute the following commands as a trusted user on the host operating system:
 
@@ -1848,7 +4186,17 @@ Verify that the "log-driver" property is set to one of the following: "syslog",
 
 Ask the sys admin to demonstrate how the login driver that is being used is configured to send log events to a log aggregation server or SIEM.
 
-If "log-driver" is not set and configured to send logs to an aggregation server or SIEM, then this is a finding.</check-content></check></Rule></Group><Group id="V-95701"><title>SRG-APP-000359</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104839r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003330</version><title>Log aggregation/SIEM systems must be configured to alarm when audit storage space for Docker Engine - Enterprise nodes exceed 75% usage.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+If "log-driver" is not set and configured to send logs to an aggregation server or SIEM, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95701">
+        <title>SRG-APP-000359</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104839r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003330</version>
+            <title>Log aggregation/SIEM systems must be configured to alarm when audit storage space for Docker Engine - Enterprise nodes exceed 75% usage.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -1870,9 +4218,32 @@ DTR audits all events associated with repository activities. Events are consider
 All audit logs generated by UCP and DTR can be forwarded to a remote log aggregation system by configuring an appropriate log driver plugin on all Docker Engine - Enterprise nodes in a cluster.
 
 The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001855</ident><fixtext fixref="F-101369r1_fix">Work with the SIEM administrator to configure an alert when audit storage space exceeds 75% usage.</fixtext><fix id="F-101369r1_fix" /><check system="C-94531r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Work with the SIEM administrator to determine if an alert is configured to alarm when audit storage space for Docker Engine - Enterprise nodes exceed 75% usage.
-
-If there is no alert configured, this is a finding.</check-content></check></Rule></Group><Group id="V-95703"><title>SRG-APP-000360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104841r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003340</version><title>Log aggregation/SIEM systems must be configured to notify SA and ISSO on Docker Engine - Enterprise audit failure events.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001855</ident>
+            <fixtext fixref="F-101369r1_fix">Work with the SIEM administrator to configure an alert when audit storage space exceeds 75% usage.</fixtext>
+            <fix id="F-101369r1_fix" />
+            <check system="C-94531r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Work with the SIEM administrator to determine if an alert is configured to alarm when audit storage space for Docker Engine - Enterprise nodes exceed 75% usage.
+
+If there is no alert configured, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95703">
+        <title>SRG-APP-000360</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104841r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003340</version>
+            <title>Log aggregation/SIEM systems must be configured to notify SA and ISSO on Docker Engine - Enterprise audit failure events.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) components of Docker Enterprise provide audit record generation capabilities. Audit logs capture all HTTP actions for the following endpoints: Kubernetes API, Swarm API and UCP API. The following UCP API endpoints are excluded from audit logging (where "*" designates a wildcard of exclusions): "/_ping", "/ca", "/auth", "/trustedregistryca", "/kubeauth", "/metrics", "/info", "/version*", "/debug", "/openid_keys", "/apidocs", "kubernetesdocs" and "/manage". Audit log verbosity can be set to one of the following levels: "none", "metadata", or "request". To meet the requirements of this control, the "request" verbosity level must be configured in UCP.
 
 The data captured at each level for UCP and the eNZI authentication and authorization backplane is described below:
 
@@ -1893,9 +4264,32 @@ DTR audits all events associated with repository activities. Events are consider
 
 All audit logs generated by UCP and DTR can be forwarded to a remote log aggregation system by configuring an appropriate log driver plugin on all Docker Engine - Enterprise nodes in a cluster.
 
-The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001858</ident><fixtext fixref="F-101371r1_fix">Work with the SIEM administrator to create an alert to notify the SA and ISSO when audit failure events occur.</fixtext><fix id="F-101371r1_fix" /><check system="C-94533r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Work with the SIEM administrator to determine if an alert is configured to notify the SA and ISSO when audit failure events occur.
-
-If there is no alert configured, this is a finding.</check-content></check></Rule></Group><Group id="V-95705"><title>SRG-APP-000377</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104843r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003460</version><title>The Docker Enterprise log aggregation/SIEM systems must be configured to send an alert the ISSO/ISSM when unauthorized software is installed.</title><description>&lt;VulnDiscussion&gt;A Docker image is analogous to software in the context of this control.
+The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001858</ident>
+            <fixtext fixref="F-101371r1_fix">Work with the SIEM administrator to create an alert to notify the SA and ISSO when audit failure events occur.</fixtext>
+            <fix id="F-101371r1_fix" />
+            <check system="C-94533r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Work with the SIEM administrator to determine if an alert is configured to notify the SA and ISSO when audit failure events occur.
+
+If there is no alert configured, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95705">
+        <title>SRG-APP-000377</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104843r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003460</version>
+            <title>The Docker Enterprise log aggregation/SIEM systems must be configured to send an alert the ISSO/ISSM when unauthorized software is installed.</title>
+            <description>&lt;VulnDiscussion&gt;A Docker image is analogous to software in the context of this control.
 
 All components of Docker Enterprise can be configured to send logs to a remote syslog server in order to meet the requirements of this control. Universal Control Plane (UCP) remote syslog configuration is done via the UCP configuration settings. Docker Trusted Registry (DTR) remote syslog configuration is done via an appropriate Docker Engine - Enterprise logging driver.
 
@@ -1916,17 +4310,53 @@ The data captured at each level for UCP and the eNZI authentication and authoriz
 
 "request": includes all fields from the "metadata" level, as well as the request payload
 
-DTR audits all events associated with repository activities. Events are considered as follows: create, get, delete, update, send, fail, and scan. The following types are associated with the defined audit events: repository, tag, blob, manifest, webhook, uri, promotion, push mirroring, poll mirroring, garbage collector, system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001811</ident><fixtext fixref="F-101373r1_fix">Work with the SIEM administrator to create an alert to notify the ISSO/ISSM when unauthorized software is installed on Docker nodes.</fixtext><fix id="F-101373r1_fix" /><check system="C-94535r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Work with the SIEM administrator to determine if an alert is configured to notify the ISSO/ISSM when unauthorized software is installed on Docker nodes.
-
-If there is no alert configured, this is a finding.</check-content></check></Rule></Group><Group id="V-95707"><title>SRG-APP-000383</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104845r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003560</version><title>Docker Enterprise network ports on all running containers must be limited to what is needed.</title><description>&lt;VulnDiscussion&gt;By itself, Docker Engine - Enterprise is configured by default to listen for API requests via a UNIX domain socket (or IPC socket) created at /var/run/docker.sock on supported Linux distributions and via a named pipe at npipe:////./pipe/docker_engine on Windows Server 2016 and newer. In this configuration, this control is not applicable. Docker Engine - Enterprise can also be configured to listen for API requests via additional socket types, including both TCP and FD (only on supported systemd-based Linux distributions). If configured to listen for API requests via the TCP socket type over TCP port 2376 and with the daemon flags and SSL certificates, then, at a minimum, TLS 1.2 is used for encryption; therefore this control is applicable and is inherently met in this configuration. If configured to listen for API requests via the TCP socket type, but without TLS verification and certifications, then the instance remains vulnerable and is not properly configured to meet the requirements of this control. If configured to listen for API requests via the fd socket type, then this control is not applicable. More information can be found at https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-socket-option. The TCP socket binding should be disabled when running Engine as part of a UCP cluster.
-
-A container can be run just with the ports defined in the Dockerfile for its image or can be arbitrarily passed run time parameters to open a list of ports. Additionally, over time, Dockerfiles may undergo various changes and the list of exposed ports may or may not be relevant to the application running within the container. Opening unneeded ports increase the attack surface of the container and the containerized application. Per the requirements set forth by the System Security Plan (SSP), ensure only needed ports are open on all running containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-101375r1_fix">Publish only needed ports for all container images and running containers per the requirements set forth by the SSP.
+DTR audits all events associated with repository activities. Events are considered as follows: create, get, delete, update, send, fail, and scan. The following types are associated with the defined audit events: repository, tag, blob, manifest, webhook, uri, promotion, push mirroring, poll mirroring, garbage collector, system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001811</ident>
+            <fixtext fixref="F-101373r1_fix">Work with the SIEM administrator to create an alert to notify the ISSO/ISSM when unauthorized software is installed on Docker nodes.</fixtext>
+            <fix id="F-101373r1_fix" />
+            <check system="C-94535r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Work with the SIEM administrator to determine if an alert is configured to notify the ISSO/ISSM when unauthorized software is installed on Docker nodes.
+
+If there is no alert configured, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95707">
+        <title>SRG-APP-000383</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104845r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003560</version>
+            <title>Docker Enterprise network ports on all running containers must be limited to what is needed.</title>
+            <description>&lt;VulnDiscussion&gt;By itself, Docker Engine - Enterprise is configured by default to listen for API requests via a UNIX domain socket (or IPC socket) created at /var/run/docker.sock on supported Linux distributions and via a named pipe at npipe:////./pipe/docker_engine on Windows Server 2016 and newer. In this configuration, this control is not applicable. Docker Engine - Enterprise can also be configured to listen for API requests via additional socket types, including both TCP and FD (only on supported systemd-based Linux distributions). If configured to listen for API requests via the TCP socket type over TCP port 2376 and with the daemon flags and SSL certificates, then, at a minimum, TLS 1.2 is used for encryption; therefore this control is applicable and is inherently met in this configuration. If configured to listen for API requests via the TCP socket type, but without TLS verification and certifications, then the instance remains vulnerable and is not properly configured to meet the requirements of this control. If configured to listen for API requests via the fd socket type, then this control is not applicable. More information can be found at https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-socket-option. The TCP socket binding should be disabled when running Engine as part of a UCP cluster.
+
+A container can be run just with the ports defined in the Dockerfile for its image or can be arbitrarily passed run time parameters to open a list of ports. Additionally, over time, Dockerfiles may undergo various changes and the list of exposed ports may or may not be relevant to the application running within the container. Opening unneeded ports increase the attack surface of the container and the containerized application. Per the requirements set forth by the System Security Plan (SSP), ensure only needed ports are open on all running containers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001762</ident>
+            <fixtext fixref="F-101375r1_fix">Publish only needed ports for all container images and running containers per the requirements set forth by the SSP.
 
 Update Dockerfiles and set or remove any EXPOSE lines accordingly.
 
 To ignore exposed ports as defined by a Dockerfile during container start, do not pass the "-P/--publish-all" flag to the Docker commands.
 
-When publishing needed ports at container start, use the "-p/--publish" flag to explicitly define the ports that are needed.</fixtext><fix id="F-101375r1_fix" /><check system="C-94537r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that only needed ports are open on all running containers.
+When publishing needed ports at container start, use the "-p/--publish" flag to explicitly define the ports that are needed.</fixtext>
+            <fix id="F-101375r1_fix" />
+            <check system="C-94537r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that only needed ports are open on all running containers.
 
 via CLI: As a Docker EE admin, execute the following command using a client bundle:
 
@@ -1934,9 +4364,28 @@ docker ps -q | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettin
 
 Review the list and ensure that the ports mapped are the ones really needed for the containers per the requirements set forth by the SSP.
 
-If ports are not documented and approved in the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95709"><title>SRG-APP-000386</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104847r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003590</version><title>Content Trust enforcement must be enabled in Universal Control Plane (UCP) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, Docker Trusted Registry (DTR) and Universal Control Plane (UCP) to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
-
-An operational requirement of this control is that of the required use of an established continuous integration and deployment workflow that effectively dictates exactly what software is allowed to run on UCP.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001774</ident><fixtext fixref="F-101377r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+If ports are not documented and approved in the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95709">
+        <title>SRG-APP-000386</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104847r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003590</version>
+            <title>Content Trust enforcement must be enabled in Universal Control Plane (UCP) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, Docker Trusted Registry (DTR) and Universal Control Plane (UCP) to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
+
+An operational requirement of this control is that of the required use of an established continuous integration and deployment workflow that effectively dictates exactly what software is allowed to run on UCP.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001774</ident>
+            <fixtext fixref="F-101377r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Enable Content Trust enforcement in UCP.
 
@@ -1946,16 +4395,18 @@ In the UCP web console, navigate to "Admin Settings" | "Docker Content Trust" an
 
 via CLI:
 
-Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "require_content_trust" entry under the "[trust_configuration]" section to "true". Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101377r1_fix" /><check system="C-94539r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101377r1_fix" />
+            <check system="C-94539r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Check that UCP is configured to only run signed images by applicable Orgs and Teams.
 
@@ -1967,23 +4418,48 @@ If "Run only signed images" box is not checked, this is a finding.
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "require_content_trust" entry under the "[trust_configuration]" section in the output, and verify that it is set to "true".
-If require_content_trust is not set to true, this is a finding.</check-content></check></Rule></Group><Group id="V-95711"><title>SRG-APP-000386</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104849r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003610</version><title>Only trusted, signed images must be on Universal Control Plane (UCP) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, DTR and UCP to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
+If require_content_trust is not set to true, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95711">
+        <title>SRG-APP-000386</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104849r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003610</version>
+            <title>Only trusted, signed images must be on Universal Control Plane (UCP) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, DTR and UCP to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
 
 An operational requirement of this control is that of the required use of an established continuous integration and deployment workflow that effectively dictates exactly what software is allowed to run on UCP.
 
-Satisfies: SRG-APP-000386, SRG-APP-000480, SRG-APP-000484, SRG-APP-000485, SRG-APP-000475&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001774</ident><ident system="http://iase.disa.mil/cci">CCI-002710</ident><ident system="http://iase.disa.mil/cci">CCI-002715</ident><ident system="http://iase.disa.mil/cci">CCI-002723</ident><ident system="http://iase.disa.mil/cci">CCI-002724</ident><fixtext fixref="F-101379r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+Satisfies: SRG-APP-000386, SRG-APP-000480, SRG-APP-000484, SRG-APP-000485, SRG-APP-000475&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001774</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002710</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002715</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002723</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002724</ident>
+            <fixtext fixref="F-101379r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Pull and run only signed images on a UCP cluster.
 
 via CLI:
 
-Linux: When using a client bundle, set the "DOCKER_CONTENT_TRUST" environment variable to a value of "1" prior the execution of any of the following commands: docker push, docker build, docker create, docker pull and docker run.</fixtext><fix id="F-101379r1_fix" /><check system="C-94541r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+Linux: When using a client bundle, set the "DOCKER_CONTENT_TRUST" environment variable to a value of "1" prior the execution of any of the following commands: docker push, docker build, docker create, docker pull and docker run.</fixtext>
+            <fix id="F-101379r1_fix" />
+            <check system="C-94541r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Verify that all images sitting on a UCP cluster are signed.
 
@@ -1995,9 +4471,28 @@ docker trust inspect $(docker images | awk '{print $1 ":" $2}')
 
 Verify that all image tags in the output have valid signatures.
 
-If the images are not signed, this is a finding.</check-content></check></Rule></Group><Group id="V-95713"><title>SRG-APP-000414</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104851r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003840</version><title>Vulnerability scanning must be enabled for all repositories in the Docker Trusted Registry (DTR) component of Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;DTR can scan Docker images for vulnerabilities and this capability should be enabled to meet the requirements of this control.
-
-When enabled, for every Docker image that is pushed to DTR, a scan of each of the image layers is conducted. An analysis of all packages and compiled binaries is done for each image layer and if a package or binary is associated with a known vulnerability as identified by the MITRE CVE or NIST NVD databases, then it is flagged in DTR.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001067</ident><fixtext fixref="F-101381r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+If the images are not signed, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95713">
+        <title>SRG-APP-000414</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104851r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003840</version>
+            <title>Vulnerability scanning must be enabled for all repositories in the Docker Trusted Registry (DTR) component of Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;DTR can scan Docker images for vulnerabilities and this capability should be enabled to meet the requirements of this control.
+
+When enabled, for every Docker image that is pushed to DTR, a scan of each of the image layers is conducted. An analysis of all packages and compiled binaries is done for each image layer and if a package or binary is associated with a known vulnerability as identified by the MITRE CVE or NIST NVD databases, then it is flagged in DTR.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001067</ident>
+            <fixtext fixref="F-101381r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Enable vulnerability scanning:
 
@@ -2007,16 +4502,15 @@ As a Docker EE Admin, navigate to "System" | "Security" in the DTR management co
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console:
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console: AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 curl -k -H "Authorization: Bearer $AUTHTOKEN" -X POST -d '{"scanningEnabled":true}' -H 'Content-Type: application/json' "https://[dtr_url]/api/v0/meta/settings"
 
-If DTR is offline, upload the latest vulnerability database (retrievable via Docker Enterprise subscription):
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
-UPDATE_FILE="[path_to_cve_database].tar"
-curl -k -H "Authorization: Bearer $AUTHTOKEN" -H "Content-Type: multipart/form-data" -H "Accept: application/json" -X PUT -F upload=@${UPDATE_FILE} "https://[dtr_url]/api/v0/imagescan/scan/update?online=false"</fixtext><fix id="F-101381r1_fix" /><check system="C-94543r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+If DTR is offline, upload the latest vulnerability database (retrievable via Docker Enterprise subscription): AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token) UPDATE_FILE="[path_to_cve_database].tar"
+curl -k -H "Authorization: Bearer $AUTHTOKEN" -H "Content-Type: multipart/form-data" -H "Accept: application/json" -X PUT -F upload=@${UPDATE_FILE} "https://[dtr_url]/api/v0/imagescan/scan/update?online=false"</fixtext>
+            <fix id="F-101381r1_fix" />
+            <check system="C-94543r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Check image vulnerability scanning enabled for all repositories:
 
@@ -2028,14 +4522,31 @@ If "Enable Scanning" is tuned off or if the vulnerability database is not synced
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console:
-
-AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine with connectivity to the DTR management console: AUTHTOKEN=$(curl -sk -u &lt;username&gt;:&lt;password&gt; "https://[dtr_url]/auth/token" | jq -r .token)
 curl -k -H "Authorization: Bearer $AUTHTOKEN" -X GET "https://[dtr_url]/api/v0/imagescan/status"
 
 Verify that that the response is successful with HTTP Status Code 200, and look for the "lastDBUpdateFailed" and "lastVulnOverridesDBUpdateFailed" properties in the "Response body", and verify that are both "false".
 
-If they are both not "false", this is a finding.</check-content></check></Rule></Group><Group id="V-95715"><title>SRG-APP-000427</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104853r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003920</version><title>Universal Control Plane (UCP) must be integrated with a trusted certificate authority (CA) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. UCP also includes two certificate authorities for establishing root of trust. One CA is used to sign client bundles and the other is used for TLS communication between UCP components and nodes. Both of these CAs should be integrated with an external, trusted CA. DTR should be integrated with this same external, trusted CA as well.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-101385r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+If they are both not "false", this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95715">
+        <title>SRG-APP-000427</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104853r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003920</version>
+            <title>Universal Control Plane (UCP) must be integrated with a trusted certificate authority (CA) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Both the UCP and Docker Trusted Registry (DTR) components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. UCP also includes two certificate authorities for establishing root of trust. One CA is used to sign client bundles and the other is used for TLS communication between UCP components and nodes. Both of these CAs should be integrated with an external, trusted CA. DTR should be integrated with this same external, trusted CA as well.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002470</ident>
+            <fixtext fixref="F-101385r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Integrate UCP with a trusted CA.
 
@@ -2070,7 +4581,11 @@ Restart the ucp-controller container:
 
 docker restart ucp-controller
 
-If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext><fix id="F-101385r1_fix" /><check system="C-94547r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext>
+            <fix id="F-101385r1_fix" />
+            <check system="C-94547r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Check that UCP has been integrated with a trusted CA.
 
@@ -2086,7 +4601,26 @@ Linux: Execute the following command and verify the certificate chain in the out
 
 echo "" | openssl s_client -connect [ucp_url]:443 | openssl x509 -noout -text
 
-If the certificate chain is not valid or does not match the trusted CA, this is a finding.</check-content></check></Rule></Group><Group id="V-95719"><title>SRG-APP-000427</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104857r1_rule" severity="medium" weight="10.0"><version>DKER-EE-003930</version><title>Docker Trusted Registry (DTR) must be integrated with a trusted certificate authority (CA) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and DTR components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. UCP also includes two certificate authorities for establishing root of trust. One CA is used to sign client bundles and the other is used for TLS communication between UCP components and nodes. Both of these CAs should be integrated with an external, trusted CA. DTR should be integrated with this same external, trusted CA as well.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-101387r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+If the certificate chain is not valid or does not match the trusted CA, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95719">
+        <title>SRG-APP-000427</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104857r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-003930</version>
+            <title>Docker Trusted Registry (DTR) must be integrated with a trusted certificate authority (CA) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Both the Universal Control Plane (UCP) and DTR components of Docker Enterprise leverage the same authentication and authorization backplane known as eNZi. The eNZi backplane includes its own managed user database, and also allows for LDAP integration in UCP and DTR. To meet the requirements of this control, configure LDAP integration. UCP also includes two certificate authorities for establishing root of trust. One CA is used to sign client bundles and the other is used for TLS communication between UCP components and nodes. Both of these CAs should be integrated with an external, trusted CA. DTR should be integrated with this same external, trusted CA as well.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002470</ident>
+            <fixtext fixref="F-101387r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Integrate DTR with a trusted CA.
 
@@ -2098,7 +4632,11 @@ via CLI:
 
 Linux: Execute the following command as a superuser on one of the UCP Manager nodes in the cluster:
 
-docker run -it --rm docker/dtr:[dtr_version] reconfigure --dtr-ca "$(cat [ca.pem])" --dtr-cert "$(cat [dtr_cert.pem])" --dtr-key "$(cat [dtr_private_key.pem])"</fixtext><fix id="F-101387r1_fix" /><check system="C-94549r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+docker run -it --rm docker/dtr:[dtr_version] reconfigure --dtr-ca "$(cat [ca.pem])" --dtr-cert "$(cat [dtr_cert.pem])" --dtr-key "$(cat [dtr_private_key.pem])"</fixtext>
+            <fix id="F-101387r1_fix" />
+            <check system="C-94549r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Check that DTR has been integrated with a trusted CA.
 
@@ -2112,15 +4650,38 @@ Linux: Execute the following command and verify the certificate chain in the out
 
 echo "" | openssl s_client -connect [dtr_url]:443 | openssl x509 -noout -text
 
-If the certificate chain is not valid or does not match the trusted CA, this is a finding.</check-content></check></Rule></Group><Group id="V-95721"><title>SRG-APP-000435</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104859r1_rule" severity="medium" weight="10.0"><version>DKER-EE-004030</version><title>The on-failure container restart policy must be is set to 5 in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;Using the --restart flag in docker run command, specify a restart policy for how a container should or should not be restarted on exit. Choose the on-failure restart policy and limit the restart attempts to 5.
+If the certificate chain is not valid or does not match the trusted CA, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95721">
+        <title>SRG-APP-000435</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104859r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-004030</version>
+            <title>The on-failure container restart policy must be is set to 5 in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;Using the --restart flag in docker run command, specify a restart policy for how a container should or should not be restarted on exit. Choose the on-failure restart policy and limit the restart attempts to 5.
 
 If indefinitely trying to start the container, it could possibly lead to a denial of service on the host. It could be an easy way to do a distributed denial of service attack especially if there are many containers on the same host. Additionally, ignoring the exit status of the container and always attempting to restart the container leads to non-investigation of the root cause behind containers getting terminated. If a container gets terminated, investigate on the reason behind it instead of just attempting to restart it indefinitely. Thus, it is recommended to use on-failure restart policy and limit it to maximum of 5 restart attempts.
 
 The container would attempt to restart only for 5 times.
 
-By default, containers are not configured with restart policies. Hence, containers do not attempt to restart of their own.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002385</ident><fixtext fixref="F-101389r1_fix">If a container is desired to be restarted on its own, then, for example, start the container as below:
-
-docker run --detach --restart=on-failure:5 nginx</fixtext><fix id="F-101389r1_fix" /><check system="C-94551r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure 'on-failure' container restart policy is set to 5.
+By default, containers are not configured with restart policies. Hence, containers do not attempt to restart of their own.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002385</ident>
+            <fixtext fixref="F-101389r1_fix">If a container is desired to be restarted on its own, then, for example, start the container as below:
+
+docker run --detach --restart=on-failure:5 nginx</fixtext>
+            <fix id="F-101389r1_fix" />
+            <check system="C-94551r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure 'on-failure' container restart policy is set to 5.
 
 via CLI:
 
@@ -2133,7 +4694,17 @@ If RestartPolicyName=always, this is a finding.
 
 If RestartPolicyName=on-failure, verify that the number of restart attempts is set to 5 or less by looking at MaximumRetryCount. 
 
-If RestartPolicyName=failure and MaximumRetryCount is &gt; 5, this is a finding.</check-content></check></Rule></Group><Group id="V-95723"><title>SRG-APP-000435</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104861r1_rule" severity="medium" weight="10.0"><version>DKER-EE-004040</version><title>The Docker Enterprise default ulimit must not be overwritten at runtime unless approved in the System Security Plan (SSP).</title><description>&lt;VulnDiscussion&gt;The default ulimit is set at the Docker daemon level. However, override the default ulimit setting, if needed, during container runtime.
+If RestartPolicyName=failure and MaximumRetryCount is &gt; 5, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95723">
+        <title>SRG-APP-000435</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104861r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-004040</version>
+            <title>The Docker Enterprise default ulimit must not be overwritten at runtime unless approved in the System Security Plan (SSP).</title>
+            <description>&lt;VulnDiscussion&gt;The default ulimit is set at the Docker daemon level. However, override the default ulimit setting, if needed, during container runtime.
 
 ulimit provides control over the resources available to the shell and to processes started by it. Setting system resource limits judiciously prevents many disasters such as a fork bomb. Sometimes, even friendly users and legitimate processes can overuse system resources and in-turn can make the system unusable.
 
@@ -2141,13 +4712,26 @@ The default ulimit set at the Docker daemon level should be honored. If the defa
 
 If the ulimits are not set properly, the desired resource control might not be achieved and might even make the system unusable.
 
-Container instances inherit the default ulimit settings set at the Docker daemon level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002385</ident><fixtext fixref="F-101391r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+Container instances inherit the default ulimit settings set at the Docker daemon level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002385</ident>
+            <fixtext fixref="F-101391r1_fix">This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Only override the default ulimit settings if needed and if so, document these settings in the SSP.
 
 For example, to override default ulimit settings start a container as below:
 
-docker run --ulimit nofile=1024:1024 --interactive --tty [image] [command]</fixtext><fix id="F-101391r1_fix" /><check system="C-94553r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
+docker run --ulimit nofile=1024:1024 --interactive --tty [image] [command]</fixtext>
+            <fix id="F-101391r1_fix" />
+            <check system="C-94553r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
 
 Ensure the default ulimit is not overwritten at runtime unless approved in the SSP.
 
@@ -2159,14 +4743,37 @@ docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ulimits={{ .
 
 If each container instance returns Ulimits=&lt;no value&gt;, this is not a finding.
 
-If a container sets a Ulimit and the setting is not approved in the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95725"><title>SRG-APP-000454</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104863r1_rule" severity="medium" weight="10.0"><version>DKER-EE-004130</version><title>Docker Enterprise older Universal Control Plane (UCP) and Docker Trusted Registry (DTR) images must be removed from all cluster nodes upon upgrading.</title><description>&lt;VulnDiscussion&gt;When upgrading either the UCP or DTR components of Docker Enterprise, the newer images are pulled (or unpacked if offline) onto Engine nodes in a cluster. Once the upgrade is complete, one must manually remove all old image version from the cluster nodes to meet the requirements of this control.
-
-When upgrading the Docker Engine - Enterprise component of Docker Enterprise, the old package version is automatically replaced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002617</ident><fixtext fixref="F-101393r1_fix">Remove all outdated UCP and DTR container images from all nodes in the cluster:
+If a container sets a Ulimit and the setting is not approved in the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95725">
+        <title>SRG-APP-000454</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104863r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-004130</version>
+            <title>Docker Enterprise older Universal Control Plane (UCP) and Docker Trusted Registry (DTR) images must be removed from all cluster nodes upon upgrading.</title>
+            <description>&lt;VulnDiscussion&gt;When upgrading either the UCP or DTR components of Docker Enterprise, the newer images are pulled (or unpacked if offline) onto Engine nodes in a cluster. Once the upgrade is complete, one must manually remove all old image version from the cluster nodes to meet the requirements of this control.
+
+When upgrading the Docker Engine - Enterprise component of Docker Enterprise, the old package version is automatically replaced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002617</ident>
+            <fixtext fixref="F-101393r1_fix">Remove all outdated UCP and DTR container images from all nodes in the cluster:
 
 via CLI: As a Docker EE admin, execute the following commands using a client bundle:
 
 docker rmi -f $(docker images --filter reference='docker/ucp*:[outdated_tags]' -q)
-docker rmi -f $(docker images --filter reference='docker/dtr*:[outdated_tags]' -q)</fixtext><fix id="F-101393r1_fix" /><check system="C-94555r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Verify that all outdated UCP and DTR container images have been removed from all nodes in the cluster.
+docker rmi -f $(docker images --filter reference='docker/dtr*:[outdated_tags]' -q)</fixtext>
+            <fix id="F-101393r1_fix" />
+            <check system="C-94555r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Verify that all outdated UCP and DTR container images have been removed from all nodes in the cluster.
 
 via CLI: As a Docker EE admin, execute the following command using a client bundle:
 
@@ -2174,9 +4781,32 @@ docker images --filter reference='docker/[ucp|dtr]*'
 
 Verify that there are no tags listed that are older than the currently installed versions of UCP and DTR.
 
-If any of the tags listed are older than the currently installed versions of UCP and DTR, then this is a finding.</check-content></check></Rule></Group><Group id="V-95727"><title>SRG-APP-000475</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104865r1_rule" severity="medium" weight="10.0"><version>DKER-EE-004260</version><title>Only trusted, signed images must be stored in Docker Trusted Registry (DTR) in Docker Enterprise.</title><description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and DTR components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, DTR and UCP to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
-
-Satisfies: SRG-APP-000475, SRG-APP-000480, SRG-APP-000484, SRG-APP-000485, SRG-APP-000386&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001774</ident><ident system="http://iase.disa.mil/cci">CCI-002710</ident><ident system="http://iase.disa.mil/cci">CCI-002715</ident><ident system="http://iase.disa.mil/cci">CCI-002723</ident><ident system="http://iase.disa.mil/cci">CCI-002724</ident><fixtext fixref="F-101395r1_fix">This fix only applies to the DTR component of Docker Enterprise.
+If any of the tags listed are older than the currently installed versions of UCP and DTR, then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95727">
+        <title>SRG-APP-000475</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104865r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-004260</version>
+            <title>Only trusted, signed images must be stored in Docker Trusted Registry (DTR) in Docker Enterprise.</title>
+            <description>&lt;VulnDiscussion&gt;The Universal Control Plane (UCP) and DTR components of Docker Enterprise can be used in concert to perform an integrity check of organization-defined software at startup. In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, DTR and UCP to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
+
+Satisfies: SRG-APP-000475, SRG-APP-000480, SRG-APP-000484, SRG-APP-000485, SRG-APP-000386&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001774</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002710</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002715</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002723</ident>
+            <ident system="http://iase.disa.mil/cci">CCI-002724</ident>
+            <fixtext fixref="F-101395r1_fix">This fix only applies to the DTR component of Docker Enterprise.
 
 Store only trusted, signed images in DTR.
 
@@ -2189,7 +4819,11 @@ docker trust signer add --key [ucp_client_bundle_cert].pem [ucp_user] [dtr_url]/
 docker trust key load [ucp_client_bundle_key].pem
 docker tag [source_image] [dtr_url]/[namespace]/[imageName]:[tag]
 export DOCKER_CONTENT_TRUST=1
-docker push [dtr_url]/[namespace]/[imageName]:[tag]</fixtext><fix id="F-101395r1_fix" /><check system="C-94557r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the DTR component of Docker Enterprise.
+docker push [dtr_url]/[namespace]/[imageName]:[tag]</fixtext>
+            <fix id="F-101395r1_fix" />
+            <check system="C-94557r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the DTR component of Docker Enterprise.
 
 Verify that all images that are stored in DTR are trusted, signed images:
 
@@ -2199,15 +4833,22 @@ If images stored in DTR are not signed, this is a finding.
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the DTR management console. Replace [dtr_url] with the DTR URL, [dtr_username] with the username of a Docker EE Admin and [dtr_password] with the password of a Docker EE Admin.
-
-AUTHTOKEN=$(curl -sk -u [dtr_username]:[dtr_password] -X GET "https://[dtr_url]/auth/token" | jq -r .token)
-REPOS=$(curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X GET "https://[dtr_url]/api/v0/repositories" | jq -r '.repositories[] | "\(.namespace)/\(.name)"')
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the DTR management console. Replace [dtr_url] with the DTR URL, [dtr_username] with the username of a Docker EE Admin and [dtr_password] with the password of a Docker EE Admin. AUTHTOKEN=$(curl -sk -u [dtr_username]:[dtr_password] -X GET "https://[dtr_url]/auth/token" | jq -r .token) REPOS=$(curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X GET "https://[dtr_url]/api/v0/repositories" | jq -r '.repositories[] | "\(.namespace)/\(.name)"')
 for r in $REPOS; do curl -sk -H "Authorization: Bearer $AUTHTOKEN" -X GET "https://[dtr_url]/api/v0/repositories/$r/tags?domain=[dtr_url]"; done | jq -r '.[] | [.name, .inNotary] | @csv'
 
 Verify that "true" is output next to all tags listed.
 
-If all images stored in DTR are not signed and trusted, this is a finding.</check-content></check></Rule></Group><Group id="V-95729"><title>SRG-APP-000485</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104867r1_rule" severity="medium" weight="10.0"><version>DKER-EE-004370</version><title>Docker Content Trust enforcement must be enabled in Universal Control Plane (UCP).</title><description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert with built-in audit logging capabilities to audit detected potential integrity violations per the requirements set forth by the System Security Plan (SSP).
+If all images stored in DTR are not signed and trusted, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95729">
+        <title>SRG-APP-000485</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104867r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-004370</version>
+            <title>Docker Content Trust enforcement must be enabled in Universal Control Plane (UCP).</title>
+            <description>&lt;VulnDiscussion&gt;The UCP and Docker Trusted Registry (DTR) components of Docker Enterprise can be used in concert with built-in audit logging capabilities to audit detected potential integrity violations per the requirements set forth by the System Security Plan (SSP).
 
 In the context of Docker Enterprise, software would be analogous to Docker images that have been pulled from trusted or untrusted sources. Docker Hub is the most common upstream endpoint for retrieving Docker images. However, only "Docker Certified" images on Docker Hub are considered trusted and come with SLAs and trusted signatures from their respective vendors. All other images from Docker Hub or other external registries must be carefully inspected and triaged prior to use. Docker Content Trust (DCT) provides for content integrity checking mechanisms on Docker images. DCT can be combined with LDAP, DTR and UCP to enforce image signatures from users/accounts in LDAP. Therefore, to meet the requirements of this control, it is imperative that UCP has LDAP integration enabled and that content trust enforcement is enabled and properly configured.
 
@@ -2230,7 +4871,16 @@ The data captured at each level for UCP and the eNZI authentication and authoriz
 
 DTR audits all events associated with repository activities. Events are considered as follows: create, get, delete, update, send, fail, and scan. The following types are associated with the defined audit events: repository, tag, blob, manifest, webhook, uri, promotion, push mirroring, poll mirroring, garbage collector, system.
 
-The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002724</ident><fixtext fixref="F-101397r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+The Docker Engine - Enterprise component of Docker Enterprise relies on the underlying host operating system's auditing capabilities. By default, the host OS is not configured to audit Docker Engine - Enterprise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002724</ident>
+            <fixtext fixref="F-101397r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Enable Content Trust enforcement in UCP.
 
@@ -2240,16 +4890,18 @@ In the UCP web console, navigate to "Admin Settings" | "Docker Content Trust" an
 
 via CLI:
 
-Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator:
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux: As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator: AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file, set the "require_content_trust" entry under the "[trust_configuration]" section to "true". Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101397r1_fix" /><check system="C-94559r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101397r1_fix" />
+            <check system="C-94559r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Check that UCP is configured to only run signed images by applicable Orgs and Teams.
 
@@ -2261,19 +4913,40 @@ If "Run only signed images" is not checked, this is a finding.
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands on a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "require_content_trust" entry under the "[trust_configuration]" section in the output, and verify that it is set to "true".
 
-If require_content_trust is not set to true, this is a finding.</check-content></check></Rule></Group><Group id="V-95731"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104869r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005060</version><title>Docker Swarm must have the minimum number of manager nodes.</title><description>&lt;VulnDiscussion&gt;Ensure that the minimum number of required manager nodes is created in a swarm.
-
-Manager nodes within a swarm have control over the swarm and change its configuration modifying security parameters. Having excessive manager nodes could render the swarm more susceptible to compromise. If fault tolerance is not required in the manager nodes, a single node should be elected as a manger. If fault tolerance is required then the smallest practical odd number to achieve the appropriate level of tolerance should be configured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101399r1_fix">If an excessive number of managers is configured, the excess can be demoted to worker using the following command:
+If require_content_trust is not set to true, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95731">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104869r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005060</version>
+            <title>Docker Swarm must have the minimum number of manager nodes.</title>
+            <description>&lt;VulnDiscussion&gt;Ensure that the minimum number of required manager nodes is created in a swarm.
+
+Manager nodes within a swarm have control over the swarm and change its configuration modifying security parameters. Having excessive manager nodes could render the swarm more susceptible to compromise. If fault tolerance is not required in the manager nodes, a single node should be elected as a manger. If fault tolerance is required then the smallest practical odd number to achieve the appropriate level of tolerance should be configured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101399r1_fix">If an excessive number of managers is configured, the excess can be demoted to worker using the following command:
 
 docker node demote &lt;ID&gt; 
-Where is the node ID value of the manager to be demoted.</fixtext><fix id="F-101399r1_fix" /><check system="C-94561r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure the correct range of manager nodes have been created in a swarm.
+Where is the node ID value of the manager to be demoted.</fixtext>
+            <fix id="F-101399r1_fix" />
+            <check system="C-94561r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure the correct range of manager nodes have been created in a swarm.
 
 via CLI:
 
@@ -2286,24 +4959,70 @@ Alternatively run the below command.
 
 docker node ls | grep 'Leader'
 
-Ensure the number of leaders is between 1 and 3. If the number of leaders is not 1, 2 or 3, this is a finding.</check-content></check></Rule></Group><Group id="V-95733"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104871r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005070</version><title>Docker Enterprise Swarm manager auto-lock key must be rotated periodically.</title><description>&lt;VulnDiscussion&gt;Rotate swarm manager auto-lock key periodically.
+Ensure the number of leaders is between 1 and 3. If the number of leaders is not 1, 2 or 3, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95733">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104871r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005070</version>
+            <title>Docker Enterprise Swarm manager auto-lock key must be rotated periodically.</title>
+            <description>&lt;VulnDiscussion&gt;Rotate swarm manager auto-lock key periodically.
 
 Swarm manager auto-lock key is not automatically rotated. Rotate them periodically as a best practice.
 
-By default, keys are not rotated automatically.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101401r1_fix">Run the below command to rotate the keys.
+By default, keys are not rotated automatically.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101401r1_fix">Run the below command to rotate the keys.
 
 docker swarm unlock-key --rotate
 
-Additionally, to facilitate audit for this recommendation, maintain key rotation records and ensure that a pre-defined frequency for key rotation is established.</fixtext><fix id="F-101401r1_fix" /><check system="C-94563r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Interview the system administrator to identify the key rotation process. Determine if there is a key rotation record and if the keys are rotated at a pre-defined frequency.
-
-If the swarm manager auto-lock key is not rotated on a regular basis, this is a finding.</check-content></check></Rule></Group><Group id="V-95735"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104873r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005080</version><title>Docker Enterprise node certificates must be rotated as defined in the System Security Plan (SSP).</title><description>&lt;VulnDiscussion&gt;Rotate swarm node certificates as appropriate.
+Additionally, to facilitate audit for this recommendation, maintain key rotation records and ensure that a pre-defined frequency for key rotation is established.</fixtext>
+            <fix id="F-101401r1_fix" />
+            <check system="C-94563r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Interview the system administrator to identify the key rotation process. Determine if there is a key rotation record and if the keys are rotated at a pre-defined frequency.
+
+If the swarm manager auto-lock key is not rotated on a regular basis, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95735">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104873r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005080</version>
+            <title>Docker Enterprise node certificates must be rotated as defined in the System Security Plan (SSP).</title>
+            <description>&lt;VulnDiscussion&gt;Rotate swarm node certificates as appropriate.
 
 Docker Swarm uses mutual TLS for clustering operations amongst its nodes. Certificate rotation ensures that in an event such as compromised node or key, it is difficult to impersonate a node. By default, node certificates are rotated every 90 days. The user should rotate it more often or as appropriate in their environment.
 
-By default, node certificates are rotated automatically every 90 days.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101403r1_fix">Run the below command to set the desired expiry time.
+By default, node certificates are rotated automatically every 90 days.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101403r1_fix">Run the below command to set the desired expiry time.
 
 Example:
-docker swarm update --cert-expiry 48h</fixtext><fix id="F-101403r1_fix" /><check system="C-94565r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure node certificates are rotated as appropriate.
+docker swarm update --cert-expiry 48h</fixtext>
+            <fix id="F-101403r1_fix" />
+            <check system="C-94565r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure node certificates are rotated as appropriate.
 
 via CLI:
 
@@ -2313,18 +5032,41 @@ Run the below command and ensure that the node certificate Expiry Duration is se
 
 docker info | grep "Expiry Duration"
 
-If the expiry duration is not set according to the SSP, this is a finding.</check-content></check></Rule></Group><Group id="V-95739"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104877r1_rule" severity="high" weight="10.0"><version>DKER-EE-005170</version><title>Docker Enterprise docker.service file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the docker.service file ownership and group-ownership are correctly set to root.
+If the expiry duration is not set according to the SSP, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95739">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104877r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005170</version>
+            <title>Docker Enterprise docker.service file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the docker.service file ownership and group-ownership are correctly set to root.
 
 docker.service file contains sensitive parameters that may alter the behavior of Docker daemon. Hence, it should be owned and group-owned by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the ownership and group-ownership for this file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101407r1_fix">Step 1: Find out the file location:
+This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the ownership and group-ownership for this file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101407r1_fix">Step 1: Find out the file location:
 
 systemctl show -p FragmentPath docker.service
 
 Step 2: If the file exists, execute the below command with the correct file path to set the ownership and group ownership for the file to root.
 
 Example:
-chown root:root /usr/lib/systemd/system/docker.service</fixtext><fix id="F-101407r1_fix" /><check system="C-94569r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that docker.service file ownership is set to root:root
+chown root:root /usr/lib/systemd/system/docker.service</fixtext>
+            <fix id="F-101407r1_fix" />
+            <check system="C-94569r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that docker.service file ownership is set to root:root
 
 Step 1: Find out the file location:
 
@@ -2335,18 +5077,41 @@ Step 2: If the file does not exist, this is not a finding. If the file exists, e
 Example:
 stat -c %U:%G /usr/lib/systemd/system/docker.service | grep -v root:root 
 
-If the above command returns nothing, this is not a finding. If the command returns non root:root file permissions, this is a finding.</check-content></check></Rule></Group><Group id="V-95741"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104879r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005180</version><title>Docker Enterprise docker.service file permissions must be set to 644 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the docker.service file permissions are correctly set to 644 or more restrictive.
+If the above command returns nothing, this is not a finding. If the command returns non root:root file permissions, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95741">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104879r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005180</version>
+            <title>Docker Enterprise docker.service file permissions must be set to 644 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the docker.service file permissions are correctly set to 644 or more restrictive.
 
 docker.service file contains sensitive parameters that may alter the behavior of Docker daemon. Hence, it should not be writable by any other user other than root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the file permissions are correctly set to 644.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101409r1_fix">Step 1: Find out the file location:
+This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the file permissions are correctly set to 644.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101409r1_fix">Step 1: Find out the file location:
 
 systemctl show -p FragmentPath docker.service
 
 Step 2: If the file exists, execute the below command with the correct file path to set the file permissions to 644.
 
 Example:
-chmod 644 /usr/lib/systemd/system/docker.service</fixtext><fix id="F-101409r1_fix" /><check system="C-94571r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that docker.service file permissions are set to 644 or more restrictive.
+chmod 644 /usr/lib/systemd/system/docker.service</fixtext>
+            <fix id="F-101409r1_fix" />
+            <check system="C-94571r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that docker.service file permissions are set to 644 or more restrictive.
 
 Step 1: Find out the file location:
 
@@ -2358,18 +5123,41 @@ If the file exists, execute the below command with the correct file path to veri
 
 stat -c %a /usr/lib/systemd/system/docker.service
 
-If the file permissions are not set to 644 or a more restrictive permission, this is a finding.</check-content></check></Rule></Group><Group id="V-95743"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104881r1_rule" severity="high" weight="10.0"><version>DKER-EE-005190</version><title>Docker Enterprise docker.socket file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the docker.socket file ownership and group ownership is correctly set to root.
+If the file permissions are not set to 644 or a more restrictive permission, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95743">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104881r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005190</version>
+            <title>Docker Enterprise docker.socket file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the docker.socket file ownership and group ownership is correctly set to root.
 
 docker.socket file contains sensitive parameters that may alter the behavior of Docker remote API. Hence, it should be owned and group-owned by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the ownership and group-ownership for this file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101411r1_fix">Step 1: Find out the file location:
+This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the ownership and group-ownership for this file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101411r1_fix">Step 1: Find out the file location:
 
 systemctl show -p FragmentPath docker.socket
 
 Step 2: If the file exists, execute the below command with the correct file path to set the ownership and group ownership for the file to root.
 
 Example:
-chown root:root /usr/lib/systemd/system/docker.socket</fixtext><fix id="F-101411r1_fix" /><check system="C-94573r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that docker.socket file ownership is set to root:root.
+chown root:root /usr/lib/systemd/system/docker.socket</fixtext>
+            <fix id="F-101411r1_fix" />
+            <check system="C-94573r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that docker.socket file ownership is set to root:root.
 
 Step 1: Find out the file location:
 
@@ -2380,18 +5168,41 @@ Step 2: If the file does not exist, this is not a finding. If the file exists, e
 Example:
 stat -c %U:%G /usr/lib/systemd/system/docker.socket | grep -v root:root 
 
-If the above command returns nothing, this is not a finding. If the command returns non root:root file permissions, this is a finding.</check-content></check></Rule></Group><Group id="V-95745"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104883r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005200</version><title>Docker Enterprise docker.socket file permissions must be set to 644 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the docker.socket file permissions are correctly set to 644 or more restrictive.
+If the above command returns nothing, this is not a finding. If the command returns non root:root file permissions, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95745">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104883r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005200</version>
+            <title>Docker Enterprise docker.socket file permissions must be set to 644 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the docker.socket file permissions are correctly set to 644 or more restrictive.
 
 docker.socket file contains sensitive parameters that may alter the behavior of Docker remote API. Hence, it should be writable only by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the file permissions for this file are correctly set to 644.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101413r2_fix">Step 1: Find out the file location:
+This file may not be present on the system. In that case, this recommendation is not applicable. By default, if the file is present, the file permissions for this file are correctly set to 644.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101413r2_fix">Step 1: Find out the file location:
 
 systemctl show -p FragmentPath docker.socket
 
 Step 2: If the file exists, execute the below command with the correct file path to set the file permissions to 644.
 
 Example:
-chmod 644 /usr/lib/systemd/system/docker.socket</fixtext><fix id="F-101413r2_fix" /><check system="C-94575r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that docker.socket file permissions are set to 644 or more restrictive.
+chmod 644 /usr/lib/systemd/system/docker.socket</fixtext>
+            <fix id="F-101413r2_fix" />
+            <check system="C-94575r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that docker.socket file permissions are set to 644 or more restrictive.
 
 Step 1: Find out the file location:
 
@@ -2401,17 +5212,40 @@ Step 2: If the file does not exist, this is not a finding. If the file exists, e
 
 stat -c %a /usr/lib/systemd/system/docker.socket
 
-If the file permissions are not set to 644 or a more restrictive permission, this is a finding.</check-content></check></Rule></Group><Group id="V-95747"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104885r1_rule" severity="high" weight="10.0"><version>DKER-EE-005210</version><title>Docker Enterprise /etc/docker directory ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the /etc/docker directory ownership and group-ownership is correctly set to root.
+If the file permissions are not set to 644 or a more restrictive permission, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95747">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104885r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005210</version>
+            <title>Docker Enterprise /etc/docker directory ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the /etc/docker directory ownership and group-ownership is correctly set to root.
 
 /etc/docker directory contains certificates and keys in addition to various sensitive files. Hence, it should be owned and group-owned by root to maintain the integrity of the directory.
 
-By default, the ownership and group-ownership for this directory is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101415r1_fix">Set the ownership and group-ownership for the directory to root.
+By default, the ownership and group-ownership for this directory is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101415r1_fix">Set the ownership and group-ownership for the directory to root.
 
 On CentOS host OS's, execute the following command:
 chown root:root /etc/docker
 
 On Ubuntu host OS's, execute the following command:
-chown root:root /etc/default/docker</fixtext><fix id="F-101415r1_fix" /><check system="C-94577r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that /etc/docker directory ownership is set to root:root.
+chown root:root /etc/default/docker</fixtext>
+            <fix id="F-101415r1_fix" />
+            <check system="C-94577r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that /etc/docker directory ownership is set to root:root.
 
 On CentOS host OS's, execute the below command to verify that the directory is owned and group-owned by root:
 stat -c %U:%G /etc/docker 
@@ -2421,117 +5255,334 @@ If root:root is not displayed, this is a finding.
 On Ubuntu host OS's, execute the below command to verify that the /etc/default/docker directory ownership is set to root:root:
 stat -c %U:%G /etc/default/docker 
 
-If root:root is not displayed, this is a finding.</check-content></check></Rule></Group><Group id="V-95749"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104887r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005220</version><title>Docker Enterprise /etc/docker directory permissions must be set to 755 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the /etc/docker directory permissions are correctly set to 755 or more restrictive.
+If root:root is not displayed, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95749">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104887r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005220</version>
+            <title>Docker Enterprise /etc/docker directory permissions must be set to 755 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the /etc/docker directory permissions are correctly set to 755 or more restrictive.
 
 /etc/docker directory contains certificates and keys in addition to various sensitive files. Hence, it should only be writable by root to maintain the integrity of the directory.
 
-By default, the permissions for this directory are correctly set to 755.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101417r1_fix">set the permissions for the directory to 755.
+By default, the permissions for this directory are correctly set to 755.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101417r1_fix">set the permissions for the directory to 755.
 
 Execute the following command:
-chmod 755 /etc/docker</fixtext><fix id="F-101417r1_fix" /><check system="C-94579r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Execute the below command to verify that the directory has permissions of 755 or more restrictive:
+chmod 755 /etc/docker</fixtext>
+            <fix id="F-101417r1_fix" />
+            <check system="C-94579r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Execute the below command to verify that the directory has permissions of 755 or more restrictive:
 
 stat -c %a /etc/docker
 
-If the permissions are not set to 755, this is a finding.</check-content></check></Rule></Group><Group id="V-95751"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104889r1_rule" severity="high" weight="10.0"><version>DKER-EE-005230</version><title>Docker Enterprise registry certificate file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that all the registry certificate files (usually found under /etc/docker/certs.d/&lt;registry-name&gt; directory) are owned and group-owned by root.
+If the permissions are not set to 755, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95751">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104889r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005230</version>
+            <title>Docker Enterprise registry certificate file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that all the registry certificate files (usually found under /etc/docker/certs.d/&lt;registry-name&gt; directory) are owned and group-owned by root.
 
 /etc/docker/certs.d/&lt;registry-name&gt; directory contains Docker registry certificates. These certificate files must be owned and group-owned by root to maintain the integrity of the certificates.
 
-By default, the ownership and group-ownership for registry certificate files is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101419r1_fix">Set the ownership and group-ownership for the registry certificate files to root.
+By default, the ownership and group-ownership for registry certificate files is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101419r1_fix">Set the ownership and group-ownership for the registry certificate files to root.
 
 Run the following command:
-chown root:root /etc/docker/certs.d/&lt;registry-name&gt;/*</fixtext><fix id="F-101419r1_fix" /><check system="C-94581r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that registry certificate file ownership is set to root:root.
+chown root:root /etc/docker/certs.d/&lt;registry-name&gt;/*</fixtext>
+            <fix id="F-101419r1_fix" />
+            <check system="C-94581r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that registry certificate file ownership is set to root:root.
 
 Execute the below command to verify that the registry certificate files are owned and group-owned by root:
 
 stat -c %U:%G /etc/docker/certs.d/*
 
-If the certificate files are not owned by root, this is a finding.</check-content></check></Rule></Group><Group id="V-95753"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104891r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005240</version><title>Docker Enterprise registry certificate file permissions must be set to 444 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that all the registry certificate files (usually found under /etc/docker/certs.d/&lt;registry-name&gt; directory) have permissions of 444 or more restrictive.
+If the certificate files are not owned by root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95753">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104891r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005240</version>
+            <title>Docker Enterprise registry certificate file permissions must be set to 444 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that all the registry certificate files (usually found under /etc/docker/certs.d/&lt;registry-name&gt; directory) have permissions of 444 or more restrictive.
 
 /etc/docker/certs.d/&lt;registry-name&gt; directory contains Docker registry certificates. These certificate files must have permissions of 444 to maintain the integrity of the certificates.
 
-By default, the permissions for registry certificate files might not be 444. The default file permissions are governed by the system or user specific umaskvalues.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101421r1_fix">Set the permissions for registry certificate files to 444.
+By default, the permissions for registry certificate files might not be 444. The default file permissions are governed by the system or user specific umaskvalues.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101421r1_fix">Set the permissions for registry certificate files to 444.
 
 Run the following command:
-chmod 444 /etc/docker/certs.d/&lt;registry-name&gt;/*</fixtext><fix id="F-101421r1_fix" /><check system="C-94583r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that registry certificate file permissions are set to 444 or more restrictive.
+chmod 444 /etc/docker/certs.d/&lt;registry-name&gt;/*</fixtext>
+            <fix id="F-101421r1_fix" />
+            <check system="C-94583r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that registry certificate file permissions are set to 444 or more restrictive.
 
 Execute the below command to verify that the registry certificate files have permissions of 444 or more restrictive:
 
 stat -c %a /etc/docker/certs.d/&lt;registry-name&gt;/*
 
-If the permissions are not set to 444, this is a finding.</check-content></check></Rule></Group><Group id="V-95755"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104893r1_rule" severity="high" weight="10.0"><version>DKER-EE-005250</version><title>Docker Enterprise TLS certificate authority (CA) certificate file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the TLS CA certificate file (the file that is passed along with --TLScacert parameter) is owned and group-owned by root.
+If the permissions are not set to 444, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95755">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104893r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005250</version>
+            <title>Docker Enterprise TLS certificate authority (CA) certificate file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the TLS CA certificate file (the file that is passed along with --TLScacert parameter) is owned and group-owned by root.
 
 The TLS CA certificate file should be protected from any tampering. It is used to authenticate Docker server based on given CA certificate. Hence, it must be owned and group-owned by root to maintain the integrity of the CA certificate.
-By default, the ownership and group-ownership for TLS CA certificate file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101423r1_fix">Set the ownership and group-ownership for the TLS CA certificate file to root.
+By default, the ownership and group-ownership for TLS CA certificate file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101423r1_fix">Set the ownership and group-ownership for the TLS CA certificate file to root.
 
 Run the following command:
-chown root:root &lt;path to TLS CA certificate file&gt;</fixtext><fix id="F-101423r1_fix" /><check system="C-94585r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that TLS CA certificate file ownership is set to root:root.
+chown root:root &lt;path to TLS CA certificate file&gt;</fixtext>
+            <fix id="F-101423r1_fix" />
+            <check system="C-94585r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that TLS CA certificate file ownership is set to root:root.
 
 Execute the below command to verify that the TLS CA certificate file is owned and group-owned by root:
 
 stat -c %U:%G &lt;path to TLS CA certificate file&gt; 
 
-If the TLS CA certificate permissions are not set to root:root, this is a finding.</check-content></check></Rule></Group><Group id="V-95757"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104895r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005260</version><title>Docker Enterprise TLS certificate authority (CA) certificate file permissions must be set to 444 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the TLS CA certificate file (the file that is passed along with --TLScacert parameter) has permissions of 444 or more restrictive.
+If the TLS CA certificate permissions are not set to root:root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95757">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104895r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005260</version>
+            <title>Docker Enterprise TLS certificate authority (CA) certificate file permissions must be set to 444 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the TLS CA certificate file (the file that is passed along with --TLScacert parameter) has permissions of 444 or more restrictive.
 
 The TLS CA certificate file should be protected from any tampering. It is used to authenticate Docker server based on given CA certificate. Hence, it must have permissions of 444 to maintain the integrity of the CA certificate.
 
-By default, the permissions for TLS CA certificate file might not be 444. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101425r1_fix">chmod 444 &lt;path to TLS CA certificate file&gt;
-
-This sets the file permissions of the TLS CA file to 444.</fixtext><fix id="F-101425r1_fix" /><check system="C-94587r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that TLS CA certificate file permissions are set to 444 or more restrictive.
+By default, the permissions for TLS CA certificate file might not be 444. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101425r1_fix">chmod 444 &lt;path to TLS CA certificate file&gt;
+
+This sets the file permissions of the TLS CA file to 444.</fixtext>
+            <fix id="F-101425r1_fix" />
+            <check system="C-94587r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that TLS CA certificate file permissions are set to 444 or more restrictive.
 
 Execute the below command to verify that the TLS CA certificate file has permissions of 444 or more restrictive:
 
 stat -c %a &lt;path to TLS CA certificate file&gt;
 
-If the permissions are not set to 444, this is a finding.</check-content></check></Rule></Group><Group id="V-95759"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104897r1_rule" severity="high" weight="10.0"><version>DKER-EE-005270</version><title>Docker Enterprise server certificate file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate file (the file that is passed along with --TLScert parameter) is owned and group-owned by root.
+If the permissions are not set to 444, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95759">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104897r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005270</version>
+            <title>Docker Enterprise server certificate file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate file (the file that is passed along with --TLScert parameter) is owned and group-owned by root.
 
 The Docker server certificate file should be protected from any tampering. It is used to authenticate Docker server based on the given server certificate. Hence, it must be owned and group-owned by root to maintain the integrity of the certificate.
 
-By default, the ownership and group-ownership for Docker server certificate file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101427r1_fix">chown root:root &lt;path to Docker server certificate file&gt;
-
-This sets the ownership and group-ownership for the Docker server certificate file to root.</fixtext><fix id="F-101427r1_fix" /><check system="C-94589r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker server certificate file ownership is set to root:root.
+By default, the ownership and group-ownership for Docker server certificate file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101427r1_fix">chown root:root &lt;path to Docker server certificate file&gt;
+
+This sets the ownership and group-ownership for the Docker server certificate file to root.</fixtext>
+            <fix id="F-101427r1_fix" />
+            <check system="C-94589r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker server certificate file ownership is set to root:root.
 
 Execute the below command to verify that the Docker server certificate file is owned and group-owned by root:
 
 stat -c %U:%G &lt;path to Docker server certificate file&gt; 
 
-If the command does not return root:root, this is a finding.</check-content></check></Rule></Group><Group id="V-95761"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104899r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005280</version><title>Docker Enterprise server certificate file permissions must be set to 444 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate file (the file that is passed along with --TLScert parameter) has permissions of 444 or more restrictive.
+If the command does not return root:root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95761">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104899r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005280</version>
+            <title>Docker Enterprise server certificate file permissions must be set to 444 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate file (the file that is passed along with --TLScert parameter) has permissions of 444 or more restrictive.
 
 The Docker server certificate file should be protected from any tampering. It is used to authenticate Docker server based on the given server certificate. Hence, it must have permissions of 444 to maintain the integrity of the certificate.
 
-By default, the permissions for Docker server certificate file might not be 444. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101429r1_fix">chmod 444 &lt;path to Docker server certificate file&gt;
-
-This sets the file permissions of the Docker server file to 444.</fixtext><fix id="F-101429r1_fix" /><check system="C-94591r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker server certificate file permissions are set to 444 or more restrictive.
+By default, the permissions for Docker server certificate file might not be 444. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101429r1_fix">chmod 444 &lt;path to Docker server certificate file&gt;
+
+This sets the file permissions of the Docker server file to 444.</fixtext>
+            <fix id="F-101429r1_fix" />
+            <check system="C-94591r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker server certificate file permissions are set to 444 or more restrictive.
 
 Execute the below command to verify that the Docker server certificate file has permissions of 444 or more restrictive:
 
 stat -c %a &lt;path to Docker server certificate file&gt;
 
-If the permissions are not set to 444, this is a finding.</check-content></check></Rule></Group><Group id="V-95763"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104901r1_rule" severity="medium" weight="10.0"><version>DKER-EE-005290</version><title>Docker Enterprise server certificate key file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate key file (the file that is passed along with --TLSkey parameter) is owned and group-owned by root.
+If the permissions are not set to 444, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95763">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104901r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-005290</version>
+            <title>Docker Enterprise server certificate key file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate key file (the file that is passed along with --TLSkey parameter) is owned and group-owned by root.
 
 The Docker server certificate key file should be protected from any tampering or unneeded reads. It holds the private key for the Docker server certificate. Hence, it must be owned and group-owned by root to maintain the integrity of the Docker server certificate.
 
-By default, the ownership and group-ownership for Docker server certificate key file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101431r1_fix">chown root:root &lt;path to Docker server certificate key file&gt;
-
-This sets the ownership and group-ownership for the Docker server certificate key file to root.</fixtext><fix id="F-101431r1_fix" /><check system="C-94593r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker server certificate key file ownership is set to root:root.
+By default, the ownership and group-ownership for Docker server certificate key file is correctly set to root.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101431r1_fix">chown root:root &lt;path to Docker server certificate key file&gt;
+
+This sets the ownership and group-ownership for the Docker server certificate key file to root.</fixtext>
+            <fix id="F-101431r1_fix" />
+            <check system="C-94593r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker server certificate key file ownership is set to root:root.
 
 Execute the below command to verify that the Docker server certificate key file is owned and group-owned by root:
 
 stat -c %U:%G &lt;path to Docker server certificate key file&gt; 
 
-If the certificate file is not owned by root:root, this is a finding.</check-content></check></Rule></Group><Group id="V-95765"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104903r1_rule" severity="high" weight="10.0"><version>DKER-EE-005300</version><title>Docker Enterprise server certificate key file permissions must be set to 400.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate key file (the file that is passed along with --TLSkey parameter) has permissions of 400.
+If the certificate file is not owned by root:root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95765">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104903r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005300</version>
+            <title>Docker Enterprise server certificate key file permissions must be set to 400.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker server certificate key file (the file that is passed along with --TLSkey parameter) has permissions of 400.
 
 The Docker server certificate key file should be protected from any tampering or unneeded reads. It holds the private key for the Docker server certificate. Hence, it must have permissions of 400 to maintain the integrity of the Docker server certificate.
 
-By default, the permissions for Docker server certificate key file might not be 400. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101433r1_fix">Set the Docker server certificate key file permissions to 400.
+By default, the permissions for Docker server certificate key file might not be 400. The default file permissions are governed by the system or user specific umask values.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101433r1_fix">Set the Docker server certificate key file permissions to 400.
 
 Run the following command:
-chmod 400 &lt;path to Docker server certificate key file&gt;</fixtext><fix id="F-101433r1_fix" /><check system="C-94595r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker server certificate key file permissions are set to 400.
+chmod 400 &lt;path to Docker server certificate key file&gt;</fixtext>
+            <fix id="F-101433r1_fix" />
+            <check system="C-94595r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker server certificate key file permissions are set to 400.
 
 Execute the below command to verify that the Docker server certificate key file has permissions of 400:
 
 stat -c %a &lt;path to Docker server certificate key file&gt;
 
-If the permissions are not set to 400, this is a finding.</check-content></check></Rule></Group><Group id="V-95767"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104905r1_rule" severity="high" weight="10.0"><version>DKER-EE-005310</version><title>Docker Enterprise socket file ownership must be set to root:docker.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker socket file is owned by root and group-owned by docker.
+If the permissions are not set to 400, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95767">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104905r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005310</version>
+            <title>Docker Enterprise socket file ownership must be set to root:docker.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker socket file is owned by root and group-owned by docker.
 
 Docker daemon runs as root. The default UNIX socket hence must be owned by root. If any other user or process owns this socket, then it might be possible for that non-privileged user or process to interact with Docker daemon. Also, such a non-privileged user or process might interact with containers. This is neither secure nor desired behavior.
 
@@ -2539,47 +5590,129 @@ Additionally, the Docker installer creates a UNIX group called docker. Users can
 
 Hence, the default Docker UNIX socket file must be owned by root and group-owned by docker to maintain the integrity of the socket file.
 
-By default, the ownership and group-ownership for Docker socket file is correctly set to root:docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101435r1_fix">chown root:docker /var/run/docker.sock
-
-This sets the ownership to root and group-ownership to docker for default Docker socket file.</fixtext><fix id="F-101435r1_fix" /><check system="C-94597r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker socket file ownership is set to root:docker.
+By default, the ownership and group-ownership for Docker socket file is correctly set to root:docker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101435r1_fix">chown root:docker /var/run/docker.sock
+
+This sets the ownership to root and group-ownership to docker for default Docker socket file.</fixtext>
+            <fix id="F-101435r1_fix" />
+            <check system="C-94597r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker socket file ownership is set to root:docker.
 
 Execute the below command to verify that the Docker socket file is owned by root and group-owned by docker:
 
 stat -c %U:%G /var/run/docker.sock 
 
-If docker.sock file ownership is not set to root:docker, this is a finding.</check-content></check></Rule></Group><Group id="V-95769"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104907r1_rule" severity="high" weight="10.0"><version>DKER-EE-005320</version><title>Docker Enterprise socket file permissions must be set to 660 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the Docker socket file has permissions of 660 or more restrictive.
+If docker.sock file ownership is not set to root:docker, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95769">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104907r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005320</version>
+            <title>Docker Enterprise socket file permissions must be set to 660 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the Docker socket file has permissions of 660 or more restrictive.
 
 Only root and members of docker group should be allowed to read and write to default Docker UNIX socket. Hence, the Docket socket file must have permissions of 660 or more restrictive.
 
-By default, the permissions for Docker socket file is correctly set to 660.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101437r1_fix">chmod 660 /var/run/docker.sock
-
-This sets the file permissions of the Docker socket file to 660.</fixtext><fix id="F-101437r1_fix" /><check system="C-94599r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure that Docker socket file permissions are set to 660 or more restrictive.
+By default, the permissions for Docker socket file is correctly set to 660.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101437r1_fix">chmod 660 /var/run/docker.sock
+
+This sets the file permissions of the Docker socket file to 660.</fixtext>
+            <fix id="F-101437r1_fix" />
+            <check system="C-94599r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure that Docker socket file permissions are set to 660 or more restrictive.
 
 Execute the below command to verify that the Docker socket file has permissions of 660 or more restrictive:
 
 stat -c %a /var/run/docker.sock
 
-If the permissions are not set to 660, this is a finding.</check-content></check></Rule></Group><Group id="V-95771"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104909r1_rule" severity="high" weight="10.0"><version>DKER-EE-005330</version><title>Docker Enterprise daemon.json file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the daemon.json file ownership and group-ownership is correctly set to root.
+If the permissions are not set to 660, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95771">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104909r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005330</version>
+            <title>Docker Enterprise daemon.json file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the daemon.json file ownership and group-ownership is correctly set to root.
 
 daemon.json file contains sensitive parameters that may alter the behavior of docker daemon. Hence, it should be owned and group-owned by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101439r1_fix">If docker.daemon does not exist, create the file and set the ownership and group-ownership for the file to root.
+This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101439r1_fix">If docker.daemon does not exist, create the file and set the ownership and group-ownership for the file to root.
 
 Run the following command:
-chown root:root /etc/docker/daemon.json</fixtext><fix id="F-101439r1_fix" /><check system="C-94601r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>The docker.daemon file is not created on installation and must be created. Ensure that daemon.json file ownership is set to root:root.
+chown root:root /etc/docker/daemon.json</fixtext>
+            <fix id="F-101439r1_fix" />
+            <check system="C-94601r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>The docker.daemon file is not created on installation and must be created. Ensure that daemon.json file ownership is set to root:root.
 
 Execute the below command to verify that the file is owned and group-owned by root:
 
 stat -c %U:%G /etc/docker/daemon.json 
 
-If the docker.daemon file doesn't exist or if the file permissions are not set to root:root, this is a finding.</check-content></check></Rule></Group><Group id="V-95773"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104911r1_rule" severity="high" weight="10.0"><version>DKER-EE-005340</version><title>Docker Enterprise daemon.json file permissions must be set to 644 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the daemon.json file permissions are correctly set to 644 or more restrictive.
+If the docker.daemon file doesn't exist or if the file permissions are not set to root:root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95773">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104911r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005340</version>
+            <title>Docker Enterprise daemon.json file permissions must be set to 644 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the daemon.json file permissions are correctly set to 644 or more restrictive.
 
 daemon.json file contains sensitive parameters that may alter the behavior of docker daemon. Hence, it should be writable only by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101441r1_fix">If docker.daemon does not exist, create the file and set the file permissions for this file to 644.
+This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101441r1_fix">If docker.daemon does not exist, create the file and set the file permissions for this file to 644.
 
 Run the following command;
-chmod 644 /etc/docker/daemon.json</fixtext><fix id="F-101441r1_fix" /><check system="C-94603r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>The docker.daemon file is not created on installation and must be created. Ensure that daemon.json file permissions are set to 644 or more restrictive.
+chmod 644 /etc/docker/daemon.json</fixtext>
+            <fix id="F-101441r1_fix" />
+            <check system="C-94603r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>The docker.daemon file is not created on installation and must be created. Ensure that daemon.json file permissions are set to 644 or more restrictive.
 
 Execute the below command to verify that the file permissions are correctly set to 644 or more restrictive:
 
@@ -2587,14 +5720,37 @@ stat -c %a /etc/docker/daemon.json
 
 If the permissions are not set to 644 or a more restrictive setting, this is a finding.
 
-If the permissions are not set to 644, this is a finding.</check-content></check></Rule></Group><Group id="V-95775"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104913r1_rule" severity="high" weight="10.0"><version>DKER-EE-005350</version><title>Docker Enterprise /etc/default/docker file ownership must be set to root:root.</title><description>&lt;VulnDiscussion&gt;Verify that the /etc/default/docker file ownership and group-ownership is correctly set to root.
+If the permissions are not set to 644, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95775">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104913r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005350</version>
+            <title>Docker Enterprise /etc/default/docker file ownership must be set to root:root.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the /etc/default/docker file ownership and group-ownership is correctly set to root.
 
 /etc/default/docker file contains sensitive parameters that may alter the behavior of docker daemon. Hence, it should be owned and group-owned by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101443r1_fix">Set the ownership and group-ownership for the file to root.
+This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101443r1_fix">Set the ownership and group-ownership for the file to root.
 
 Run the following command:
-chown root:root /etc/default/docker</fixtext><fix id="F-101443r1_fix" /><check system="C-94605r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This requirement applies to Ubuntu Linux systems only. 
+chown root:root /etc/default/docker</fixtext>
+            <fix id="F-101443r1_fix" />
+            <check system="C-94605r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This requirement applies to Ubuntu Linux systems only. 
 
 Ensure that /etc/default/docker file ownership is set to root:root.
 
@@ -2602,14 +5758,37 @@ Execute the below command to verify that the file is owned and group-owned by ro
 
 stat -c %U:%G /etc/default/docker 
 
-If file ownership it not set to root:root, this is a finding.</check-content></check></Rule></Group><Group id="V-95777"><title>SRG-APP-000516</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104915r1_rule" severity="high" weight="10.0"><version>DKER-EE-005360</version><title>Docker Enterprise /etc/default/docker file permissions must be set to 644 or more restrictive.</title><description>&lt;VulnDiscussion&gt;Verify that the /etc/default/docker file permissions are correctly set to 644 or more restrictive.
+If file ownership it not set to root:root, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95777">
+        <title>SRG-APP-000516</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104915r1_rule" severity="high" weight="10.0">
+            <version>DKER-EE-005360</version>
+            <title>Docker Enterprise /etc/default/docker file permissions must be set to 644 or more restrictive.</title>
+            <description>&lt;VulnDiscussion&gt;Verify that the /etc/default/docker file permissions are correctly set to 644 or more restrictive.
 
 /etc/default/docker file contains sensitive parameters that may alter the behavior of docker daemon. Hence, it should be writable only by root to maintain the integrity of the file.
 
-This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-101445r1_fix">Set the file permissions for this file to 644.
+This file may not be present on the system. In that case, this recommendation is not applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000366</ident>
+            <fixtext fixref="F-101445r1_fix">Set the file permissions for this file to 644.
 
 Run the following command:
-chmod 644 /etc/default/docker</fixtext><fix id="F-101445r1_fix" /><check system="C-94607r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This requirement applies to Ubuntu Linux systems only. 
+chmod 644 /etc/default/docker</fixtext>
+            <fix id="F-101445r1_fix" />
+            <check system="C-94607r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This requirement applies to Ubuntu Linux systems only. 
 
 Ensure that /etc/default/docker file permissions are set to 644 or more restrictive.
 
@@ -2617,11 +5796,30 @@ Execute the below command to verify that the file permissions are correctly set
 
 stat -c %a /etc/default/docker
 
-If the permissions are not set to 644, this is a finding.</check-content></check></Rule></Group><Group id="V-95779"><title>SRG-APP-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104917r1_rule" severity="medium" weight="10.0"><version>DKER-EE-006190</version><title>Docker Enterprise Universal Control Plane (UCP) must be integrated with a trusted certificate authority (CA).</title><description>&lt;VulnDiscussion&gt;When integrating the UCP and Docker Trusted Registry (DTR) management consoles with an external, trusted certificate authority (CA), both UCP and DTR will validate these certificate chains per the requirements set forth by the System Security Plan (SSP).
+If the permissions are not set to 644, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95779">
+        <title>SRG-APP-000175</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104917r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-006190</version>
+            <title>Docker Enterprise Universal Control Plane (UCP) must be integrated with a trusted certificate authority (CA).</title>
+            <description>&lt;VulnDiscussion&gt;When integrating the UCP and Docker Trusted Registry (DTR) management consoles with an external, trusted certificate authority (CA), both UCP and DTR will validate these certificate chains per the requirements set forth by the System Security Plan (SSP).
 
 UCP establishes mutual TLS authentication for all Engine - Enterprise nodes in a cluster using a built-in certificate authority which inherently meets the requirements of this control. This is described below.
 
-The UCP component of Docker Enterprise includes a built-in public key infrastructure (PKI) system. When a UCP cluster is initialized, the first node designates itself as a manager node. That node subsequently generates a new root CA along with a key pair, which are used to secure communications with other UCP manager and worker nodes that are joined to the cluster. One can also specify his/her own externally-generated root CA upon initialization of a UCP cluster. The manager node also generates two tokens to use when joining additional nodes to the cluster: one worker token and one manager token. Each token includes the digest of the root CA’s certificate and a randomly generated secret. When a node joins the cluster, the joining node uses the digest to validate the root CA certificate from the remote manager. The remote manager uses the secret to ensure the joining node is an approved node. Each time a new node joins the cluster, the manager issues a certificate to the node. The certificate contains a randomly generated node ID to identify the node under the certificate common name (CN) and the role under the organizational unit (OU). The node ID serves as the cryptographically secure node identity for the lifetime of the node in the current UCP cluster. In this mutual TLS architecture, all nodes encrypt communications using a minimum of TLS 1.2. This information can also be referenced at https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000185</ident><fixtext fixref="F-101447r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+The UCP component of Docker Enterprise includes a built-in public key infrastructure (PKI) system. When a UCP cluster is initialized, the first node designates itself as a manager node. That node subsequently generates a new root CA along with a key pair, which are used to secure communications with other UCP manager and worker nodes that are joined to the cluster. One can also specify his/her own externally-generated root CA upon initialization of a UCP cluster. The manager node also generates two tokens to use when joining additional nodes to the cluster: one worker token and one manager token. Each token includes the digest of the root CA’s certificate and a randomly generated secret. When a node joins the cluster, the joining node uses the digest to validate the root CA certificate from the remote manager. The remote manager uses the secret to ensure the joining node is an approved node. Each time a new node joins the cluster, the manager issues a certificate to the node. The certificate contains a randomly generated node ID to identify the node under the certificate common name (CN) and the role under the organizational unit (OU). The node ID serves as the cryptographically secure node identity for the lifetime of the node in the current UCP cluster. In this mutual TLS architecture, all nodes encrypt communications using a minimum of TLS 1.2. This information can also be referenced at https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000185</ident>
+            <fixtext fixref="F-101447r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 Integrate UCP with a trusted CA.
 
@@ -2652,7 +5850,11 @@ Restart the ucp-controller container:
 
 docker restart ucp-controller
 
-If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext><fix id="F-101447r1_fix" /><check system="C-94609r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+If DTR was previously integrated with this UCP cluster, execute a "dtr reconfigure" command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.</fixtext>
+            <fix id="F-101447r1_fix" />
+            <check system="C-94609r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Check that UCP has been integrated with a trusted CA.
 
@@ -2668,12 +5870,35 @@ Linux: Execute the following command and verify the certificate chain in the out
 
 echo "" | openssl s_client -connect [ucp_url]:443 | openssl x509 -noout -text
 
-If the UCP certificate is not signed by a trusted DoD CA this is a finding.</check-content></check></Rule></Group><Group id="V-95781"><title>SRG-APP-000416</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104919r1_rule" severity="medium" weight="10.0"><version>DKER-EE-006240</version><title>Docker Enterprise data exchanged between Linux containers on different nodes must be encrypted on the overlay network.</title><description>&lt;VulnDiscussion&gt;Encrypt data exchanged between containers on different nodes on the overlay network.
-
-By default, data exchanged between containers on different nodes on the overlay network is not encrypted. This could potentially expose traffic between the container nodes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002450</ident><fixtext fixref="F-101449r1_fix">Create overlay network with --opt encrypted flag. 
+If the UCP certificate is not signed by a trusted DoD CA this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95781">
+        <title>SRG-APP-000416</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104919r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-006240</version>
+            <title>Docker Enterprise data exchanged between Linux containers on different nodes must be encrypted on the overlay network.</title>
+            <description>&lt;VulnDiscussion&gt;Encrypt data exchanged between containers on different nodes on the overlay network.
+
+By default, data exchanged between containers on different nodes on the overlay network is not encrypted. This could potentially expose traffic between the container nodes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-002450</ident>
+            <fixtext fixref="F-101449r1_fix">Create overlay network with --opt encrypted flag. 
 
 Example:
-docker network create --opt encrypted --driver overlay my-network</fixtext><fix id="F-101449r1_fix" /><check system="C-94611r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure data exchanged between containers are encrypted on different nodes on the overlay network.
+docker network create --opt encrypted --driver overlay my-network</fixtext>
+            <fix id="F-101449r1_fix" />
+            <check system="C-94611r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure data exchanged between containers are encrypted on different nodes on the overlay network.
 
 via CLI:
 
@@ -2683,23 +5908,63 @@ Run the below command and ensure that each overlay network has been encrypted.
 
 docker network ls --filter driver=overlay --quiet | xargs docker network inspect --format '{{.Name}} {{ .Options }}' | grep -v "dtr\|interlock map\|ingress map"
 
-If the network overlay drivers do not show [com.docker.network.driver.overlay"encrypted:" ask for evidence that encryption is being handled at the application layer, if no evidence of encryption at the network or application layer is provided, this is a finding.</check-content></check></Rule></Group><Group id="V-95783"><title>SRG-APP-000142</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104921r1_rule" severity="medium" weight="10.0"><version>DKER-EE-006270</version><title>Docker Enterprise Swarm services must be bound to a specific host interface.</title><description>&lt;VulnDiscussion&gt;By default, the docker swarm services will listen to all interfaces on the host, which may not be necessary for the operation of the swarm where the host has multiple network interfaces.
+If the network overlay drivers do not show [com.docker.network.driver.overlay"encrypted:" ask for evidence that encryption is being handled at the application layer, if no evidence of encryption at the network or application layer is provided, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95783">
+        <title>SRG-APP-000142</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104921r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-006270</version>
+            <title>Docker Enterprise Swarm services must be bound to a specific host interface.</title>
+            <description>&lt;VulnDiscussion&gt;By default, the docker swarm services will listen to all interfaces on the host, which may not be necessary for the operation of the swarm where the host has multiple network interfaces.
 
 When a swarm is initialized the default value for the --listen-addr flag is 0.0.0.0:2377 which means that the swarm services will listen on all interfaces on the host. If a host has multiple network interfaces this may be undesirable as it may expose the docker swarm services to networks which are not involved in the operation of the swarm.
 
-By passing a specific IP address to the --listen-addr, a specific network interface can be specified limiting this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-101451r1_fix">Rebuild the cluster and utilize the --listen-addr parameter.</fixtext><fix id="F-101451r1_fix" /><check system="C-94613r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure swarm services are bound to a specific host interface.
+By passing a specific IP address to the --listen-addr, a specific network interface can be specified limiting this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000382</ident>
+            <fixtext fixref="F-101451r1_fix">Rebuild the cluster and utilize the --listen-addr parameter.</fixtext>
+            <fix id="F-101451r1_fix" />
+            <check system="C-94613r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure swarm services are bound to a specific host interface.
 
 Linux: List the network listener on port 2377/TCP (the default for docker swarm) and confirm that it is only listening on specific interfaces. For example, using ubuntu this could be done with the following command:
 
 netstat -lt | grep -i 2377
 
-If the swarm service is not bound to a specific host interface address, this is a finding.</check-content></check></Rule></Group><Group id="V-95785"><title>SRG-APP-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104923r1_rule" severity="medium" weight="10.0"><version>DKER-EE-006280</version><title>Docker Enterprise Universal Control Plane (UCP) must be configured to use TLS 1.2.</title><description>&lt;VulnDiscussion&gt;By default docker UCP is configured to use TLS v1.2, if this setting is misconfigured, older protocols containing security weaknesses could be utilized. TLS requires a handshake between client and server which is where the TLS version utilized in the connection is negotiated. For DoD use cases, all TLS must be at version 1.2.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001453</ident><fixtext fixref="F-101453r1_fix">This fix only applies to the UCP component of Docker Enterprise.
+If the swarm service is not bound to a specific host interface address, this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-95785">
+        <title>SRG-APP-000560</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-104923r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-006280</version>
+            <title>Docker Enterprise Universal Control Plane (UCP) must be configured to use TLS 1.2.</title>
+            <description>&lt;VulnDiscussion&gt;By default docker UCP is configured to use TLS v1.2, if this setting is misconfigured, older protocols containing security weaknesses could be utilized. TLS requires a handshake between client and server which is where the TLS version utilized in the connection is negotiated. For DoD use cases, all TLS must be at version 1.2.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-001453</ident>
+            <fixtext fixref="F-101453r1_fix">This fix only applies to the UCP component of Docker Enterprise.
 
 via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml &gt; ucp-config.toml
 
 Open the "ucp-config.toml" file under the "[cluster_config]" section set "min_TLS_version = TLSv1.2". 
@@ -2707,27 +5972,52 @@ Save the file.
 
 Execute the following commands to update UCP with the new configuration:
 
-curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext><fix id="F-101453r1_fix" /><check system="C-94615r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>This check only applies to the UCP component of Docker Enterprise.
+curl -sk -H "Authorization: Bearer $AUTHTOKEN" --upload-file ucp-config.toml https://[ucp_url]/api/ucp/config-toml</fixtext>
+            <fix id="F-101453r1_fix" />
+            <check system="C-94615r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>This check only applies to the UCP component of Docker Enterprise.
 
 Via CLI:
 
-Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator.
-
-AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
+Linux (requires curl and jq): As a Docker EE Admin, execute the following commands from a machine that can communicate with the UCP management console. Replace [ucp_url] with the UCP URL, [ucp_username] with the username of a UCP administrator and [ucp_password] with the password of a UCP administrator. AUTHTOKEN=$(curl -sk -d '{"username":"[ucp_username]","password":"[ucp_password]"}' https://[ucp_url]/auth/login | jq -r .auth_token)
 curl -sk -H "Authorization: Bearer $AUTHTOKEN" https://[ucp_url]/api/ucp/config-toml
 
 Look for the "min_TLS_version =" entry under the "[cluster_config]" section in the output, and verify that it is set to "TLSv1.2".
 
-If the "min_TLS_version" entry under the "[cluster_config]" section in the output is not set to "TLSv1.2", then this is a finding.</check-content></check></Rule></Group><Group id="V-96003"><title>SRG-APP-000176</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-105141r1_rule" severity="medium" weight="10.0"><version>DKER-EE-002400</version><title>Docker Enterprise Swarm manager must be run in auto-lock mode.</title><description>&lt;VulnDiscussion&gt;Run Docker swarm manager in auto-lock mode.
+If the "min_TLS_version" entry under the "[cluster_config]" section in the output is not set to "TLSv1.2", then this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+    <Group id="V-96003">
+        <title>SRG-APP-000176</title>
+        <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
+        <Rule id="SV-105141r1_rule" severity="medium" weight="10.0">
+            <version>DKER-EE-002400</version>
+            <title>Docker Enterprise Swarm manager must be run in auto-lock mode.</title>
+            <description>&lt;VulnDiscussion&gt;Run Docker swarm manager in auto-lock mode.
 
 When Docker restarts, both the TLS key used to encrypt communication among swarm nodes, and the key used to encrypt and decrypt Raft logs on disk, are loaded into each manager node's memory. Protect the mutual TLS encryption key and the key used to encrypt and decrypt Raft logs at rest. This protection could be enabled by initializing swarm with --autolock flag.
 
-With --autolock enabled, when Docker restarts, unlock the swarm first, using a key encryption key generated by Docker when the swarm was initialized.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Docker Enterprise Edition 2.0</dc:subject><dc:identifier>3425</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-101679r1_fix">If initializing swarm, use the below command.
+With --autolock enabled, when Docker restarts, unlock the swarm first, using a key encryption key generated by Docker when the swarm was initialized.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>
+            <reference>
+                <dc:title>DPMS Target Docker Enterprise Edition 2.0</dc:title>
+                <dc:publisher>DISA</dc:publisher>
+                <dc:type>DPMS Target</dc:type>
+                <dc:subject>Docker Enterprise Edition 2.0</dc:subject>
+                <dc:identifier>3425</dc:identifier>
+            </reference>
+            <ident system="http://iase.disa.mil/cci">CCI-000186</ident>
+            <fixtext fixref="F-101679r1_fix">If initializing swarm, use the below command.
 
 docker swarm init --autolock
 If setting --autolock on an existing swarm manager node, use the below command.
 
-docker swarm update --autolock</fixtext><fix id="F-101679r1_fix" /><check system="C-94835r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" /><check-content>Ensure swarm manager is run in auto-lock mode.
+docker swarm update --autolock</fixtext>
+            <fix id="F-101679r1_fix" />
+            <check system="C-94835r1_chk">
+                <check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Docker_Enterprise_2-x_Linux-UNIX_STIG.xml" />
+                <check-content>Ensure swarm manager is run in auto-lock mode.
 
 via CLI:
 
@@ -2737,4 +6027,8 @@ Run the below command. If it outputs the key, it means swarm was initialized wit
 
 docker swarm unlock-key
 
-If the output is no unlock key is set, it means that swarm was NOT initialized with the --autolock flag and this is a finding.</check-content></check></Rule></Group></Benchmark>
\ No newline at end of file
+If the output is no unlock key is set, it means that swarm was NOT initialized with the --autolock flag and this is a finding.</check-content>
+            </check>
+        </Rule>
+    </Group>
+</Benchmark>
\ No newline at end of file
diff --git a/examples/exampleChecklist-2.ckl b/docs/examples/exampleChecklist-2.ckl
similarity index 100%
rename from examples/exampleChecklist-2.ckl
rename to docs/examples/exampleChecklist-2.ckl
diff --git a/examples/exampleChecklist.ckl b/docs/examples/exampleChecklist.ckl
similarity index 100%
rename from examples/exampleChecklist.ckl
rename to docs/examples/exampleChecklist.ckl
diff --git a/examples/exampleSTIG.xml b/docs/examples/exampleSTIG.xml
similarity index 100%
rename from examples/exampleSTIG.xml
rename to docs/examples/exampleSTIG.xml
diff --git a/docs/images/STIG_Parser.png b/docs/images/STIG_Parser.png
new file mode 100644
index 0000000..a8d6b3b
Binary files /dev/null and b/docs/images/STIG_Parser.png differ
diff --git a/setup.py b/setup.py
index 6a9caa6..b866e6e 100644
--- a/setup.py
+++ b/setup.py
@@ -5,7 +5,7 @@
 
 setuptools.setup(
     name='stig_parser',  
-    version='1.0.1',
+    version='1.0.2',
     author="Peter Keech",
     author_email="peter.a.keech@gmail.com",
     description="A Python module to parse DISA STIG (XCCDF) Files",
@@ -21,5 +21,6 @@
          "License :: OSI Approved :: MIT License",
          "Operating System :: OS Independent",
     ],
+    package_dir={"": "src"},
     python_requires='>=3.6',
 )
\ No newline at end of file
diff --git a/dev/temp.py b/src/stig_parser/__init__.py
similarity index 65%
rename from dev/temp.py
rename to src/stig_parser/__init__.py
index 9ae737f..f711380 100644
--- a/dev/temp.py
+++ b/src/stig_parser/__init__.py
@@ -1,11 +1,20 @@
-##########################
-##  STIG PARSER MODULE  ##
-##########################
+##  ==============================
+##  ===== STIG PARSER MODULE =====
+##  ==============================
+
+##  Created By  : Peter Keech
+##  Email       : peter.a.keech@gmail.com
+##  Version     : 1.0.2
+##  Description : STIG-Parser v1.0.2 Module
+##  Requirements: xmltodict
+##  Build       : docker run -it --rm -v $(PWD):/stig-parser python /bin/bash
+##                cd stig-parser
+##                python3 -m pip install --upgrade build
+##                python3 -m build
+##                
 
 ## IMPORT REQUIRED EXTERNAL MODULES
 import os, xmltodict, json
-#from pkg_resources import resource_filename
-
 
 ## FUNCTION: CONVERT RAW XCCDF (XML) TO JSON
 def convert_xccdf(raw):
@@ -38,7 +47,7 @@ def convert_xccdf(raw):
 
 
     ## CONVERT XML TO PYTHON DICTIONARY
-    content_dict = xmltodict.parse(raw)
+    content_dict = xmltodict.parse(raw, dict_constructor=dict)
 
     ## HANDLE NEW VS. OLD VERSION OF STIG SCHEMA (ISSUE #3)
     if isinstance(content_dict['Benchmark']['plain-text'], list):
@@ -48,8 +57,10 @@ def convert_xccdf(raw):
         ## OLD VERSION
         raw_version = content_dict['Benchmark']['plain-text']['#text']        
 
-    ## PARSE DATE AND RELEASE DATA
+    ## SAVE RELEASE INFO
     release_info = raw_version
+
+    ## FORMAT RELEASE INFO FOR SPECIFIC DATA FIELDS
     raw_version = raw_version.split('Benchmark Date: ')
     BENCH_DATE = raw_version[1]
     REL = raw_version[0].replace('Release: ','')
@@ -60,11 +71,10 @@ def convert_xccdf(raw):
         "description": content_dict['Benchmark']['description'],
         "version": content_dict['Benchmark']['version'],
         "release": REL,
-        "release_info": release_info,
         "benchmark_date": BENCH_DATE,
-        "source": '', 
-        "notice": '',
-        "classification": ''
+        "release_info": release_info,
+        "source": content_dict['Benchmark']['reference']['dc:source'],
+        "notice": content_dict['Benchmark']['notice']['@id']
     }
 
     ## GENERATE EMPTY ARRAY
@@ -73,6 +83,23 @@ def convert_xccdf(raw):
     ## LOOP THROUGH STIGS
     for STIG in content_dict['Benchmark']['Group']:
 
+        ## PARSE IDENT 
+        IDENT = STIG['Rule']['ident']
+
+        ## HANDLE MULTIPLE IDENT ENTRIES
+        if len(IDENT) == 2:
+            IDENT = IDENT['#text']
+        else:
+            ## DEFINE EMPTY RESULTS
+            RESULTS = ""
+        
+            ## LOOP THROUGH ALL CCI NUMBERS
+            for result in IDENT:
+                RESULTS += result['#text'] + ","
+
+            ## REMOVE LAST ','
+            IDENT = RESULTS.rstrip(RESULTS[-1])
+         
         ## DEFINE STIG
         oSTIG = {
             'id': STIG['@id'],
@@ -81,14 +108,12 @@ def convert_xccdf(raw):
             'title': STIG['Rule']['title'],
             'description': STIG['Rule']['description'],
             'fixtext': STIG['Rule']['fixtext']['#text'],
-            'check': STIG['Rule']['check']['check-content']
-
-            ## Rule ID
-            ## STIG ID
-            ## Classification
-            ## CCI #
+            'check': STIG['Rule']['check']['check-content'],
+            'cci': IDENT,
+            'stig_id': STIG['Rule']['version'],
+            'rule_id': STIG['Rule']['@id']
         }
-      
+              
         ## ADD TO ARRAY
         STIGS.append(oSTIG)
 
diff --git a/stig_parser/xccdf-1.1.4.xsd b/src/stig_parser/xccdf-1.1.4.xsd
similarity index 100%
rename from stig_parser/xccdf-1.1.4.xsd
rename to src/stig_parser/xccdf-1.1.4.xsd
diff --git a/stig_parser/__init__.py b/stig_parser/__init__.py
deleted file mode 100644
index 2887a24..0000000
--- a/stig_parser/__init__.py
+++ /dev/null
@@ -1,94 +0,0 @@
-##########################
-##  STIG PARSER MODULE  ##
-##########################
-
-## IMPORT REQUIRED EXTERNAL MODULES
-import os, xmltodict, json
-#from pkg_resources import resource_filename
-
-
-## FUNCTION: CONVERT RAW XCCDF (XML) TO JSON
-def convert_xccdf(raw):
-    
-    ## ----------------
-    ## ----- TEST -----
-    ## ----------------
-    # docker run -it python /bin/bash
-    # pip install stig-parser
-    # mkdir docker && cd docker
-    # curl https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip --output docker_stig.zip
-    # unzip docker_stig.zip
-    # python
-    # 
-    # from stig_parser import convert_xccdf
-    # import json
-    # f = open('/docker/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_Manual_STIG/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml', 'r')
-    # temp = convert_xccdf(f.read())
-    # print(json.dumps(temp, indent=4, sort_keys=True))
-    #
-    # f = open('/docker/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_Manual_STIG/U_Docker_Enterprise_2-x_Linux-UNIX_STIG_V1R1_Manual-xccdf.xml', 'r')
-    # content_dict = xmltodict.parse(f.read())
-    # print(json.dumps(content_dict, indent=4, sort_keys=True))
-    #
-    #
-    # output = open('/docker/output.txt', 'w')
-    # print(json.dumps(content_dict, indent=4, sort_keys=True), file = output)
-    # output.close()
-
-
-
-    ## CONVERT XML TO PYTHON DICTIONARY
-    content_dict = xmltodict.parse(raw)
-
-    ## HANDLE NEW VS. OLD VERSION OF STIG SCHEMA (ISSUE #3)
-    if isinstance(content_dict['Benchmark']['plain-text'], list):
-        ## NEW VERSION
-        raw_version = content_dict['Benchmark']['plain-text'][0]['#text']
-    else:
-        ## OLD VERSION
-        raw_version = content_dict['Benchmark']['plain-text']['#text']        
-
-    ## PARSE DATE AND RELEASE DATA
-    raw_version = raw_version.split('Benchmark Date: ')
-    BENCH_DATE = raw_version[1]
-    REL = raw_version[0].replace('Release: ','')
-
-    ## CREATE RETURNED JSON STRUCTURE
-    json_results = {
-        "title": content_dict['Benchmark']['title'],
-        "description": content_dict['Benchmark']['description'],
-        "version": content_dict['Benchmark']['version'],
-        "release": REL,
-        "benchmark_date": BENCH_DATE
-    }
-
-    ## GENERATE EMPTY ARRAY
-    STIGS = []
-
-    ## LOOP THROUGH STIGS
-    for STIG in content_dict['Benchmark']['Group']:
-
-        ## DEFINE STIG
-        oSTIG = {
-            'id': STIG['@id'],
-            'stig_id': STIG['title'],
-            'severity': STIG['Rule']['@severity'],
-            'title': STIG['Rule']['title'],
-            'description': STIG['Rule']['description'],
-            'fixtext': STIG['Rule']['fixtext']['#text'],
-            'check': STIG['Rule']['check']['check-content']
-
-            ## Rule ID
-            ## STIG ID
-            ## Classification
-            ## CCI #
-        }
-      
-        ## ADD TO ARRAY
-        STIGS.append(oSTIG)
-
-    ## ADD STIGS TO JSON OBJECT
-    json_results['rules'] = STIGS
-
-    ## RETURN RESULTS
-    return json_results


Test patch:
diff --git a/.github/workflows/pytest-package.yml b/.github/workflows/pytest-package.yml
new file mode 100644
index 0000000..11fa5d4
--- /dev/null
+++ b/.github/workflows/pytest-package.yml
@@ -0,0 +1,34 @@
+name: PyTest & Flake8
+
+on: 
+  push:
+  
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.6, 3.7, 3.8, 3.9]
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v2
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install flake8 pytest xmltodict
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+      - name: Lint with flake8
+        run: |
+          # stop the build if there are Python syntax errors or undefined names
+          flake8 ./src --count --select=E9,F63,F7,F82 --show-source --statistics
+          # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
+          flake8 ./src --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+      - name: Test with pytest
+        run: |
+          pytest
\ No newline at end of file
diff --git a/.github/workflows/test-pypi-publish.yml b/.github/workflows/test-pypi-publish.yml
new file mode 100644
index 0000000..0d029a4
--- /dev/null
+++ b/.github/workflows/test-pypi-publish.yml
@@ -0,0 +1,57 @@
+## NAME GITHUB ACTION WORKFLOW
+name: Test & Upload to TestPyPI
+
+## RUN WORKFLOW WHEN
+on:
+  push:
+    branches: [ dev ]
+  
+  ## ALLOW FOR MANUAL EXECUTION
+  workflow_dispatch:
+
+## DEFINE WORKFLOW
+jobs:
+  ## DEFINE JOB
+  build:
+    ## DEFINE WORKER
+    runs-on: ubuntu-latest
+
+    ## DEFINE STEPS
+    steps:
+      ## CLONE REPO CODE
+      - uses: actions/checkout@v2
+
+      ## SETUP PYTHON3
+      - uses: actions/setup-python@v2
+        with:
+          python-version: 3.8
+
+      ## CONFIGURE WORKER TO PUBLISH PACKAGE
+      - name: "Install Dependencies"
+        run: |
+          # Upgrade pip
+          python3 -m pip install --upgrade pip
+          # Install Dependencies
+          python3 -m pip install --upgrade build flake8 pytest xmltodict
+
+      ## RUN PYTEST TESTER
+      - name: "Run PYTest Tests"
+        run: |
+          pytest
+
+      ## RUN FLAKE8 LINTER
+      - name: "Run Flake8 Linter"
+        run: |
+          # stop the build if there are Python syntax errors or undefined names
+          flake8 ./src --count --select=E9,F63,F7,F82 --show-source --statistics
+          # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
+          flake8 ./src --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+
+      ## BUILD PACKAGE
+      - name: "Build Python Package"
+        run: |
+          # Build Python Package
+          python3 -m build
+
+      ## PUBLISH PACKAGE TO TESTPYPI
+      
diff --git a/tests/__init__.py b/tests/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/tests/resources/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip b/tests/resources/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip
new file mode 100644
index 0000000..e526777
Binary files /dev/null and b/tests/resources/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip differ
diff --git a/tests/stig_parser_test.py b/tests/stig_parser_test.py
new file mode 100644
index 0000000..5b874cc
--- /dev/null
+++ b/tests/stig_parser_test.py
@@ -0,0 +1,75 @@
+##  ===================================
+##  ===== STIG PARSER TEST SCRIPT =====
+##  ===================================
+
+##  Created By  : Peter Keech
+##  Email       : peter.a.keech@gmail.com
+##  Version     : 1.0.2
+##  Description : PyTest file for STIG-Parser v1.0.2
+##  Requirements: PyTest, XmltoDict
+##  Testing     : docker run -it --rm -v $(PWD):/stig-parser python /bin/bash
+##                cd stig-parser && pip install pytest xmltodict
+##                pytest -s
+
+## IMPORT REQUIRED MODULES
+import zipfile, os, pytest
+
+## IMPORT STIG-PARSER
+from src.stig_parser import convert_xccdf
+
+##  ----------------------------------------
+##  ---- STATICALLY SET TEST VARIABLES -----
+##  ----------------------------------------
+
+## STIG FILENAME
+FILENAME = "tests/resources/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip"
+
+##  -----------------------
+##  ---- PYTEST TESTS -----
+##  -----------------------
+
+## TEST: ENSURE STIG FILE EXISTS
+def test_requirements() -> None:
+    ## CHECK FILE EXISTS
+    assert os.path.isfile(FILENAME), 'File does not exist: %s' % FILENAME
+
+## TEST: ATTEMPT TO PARSE STIG FILE
+def test_parse_stig() -> None:
+    ## OPEN XML FILE FROM ZIP FILE AND OBTAIN LIST OF FILES
+    z = zipfile.ZipFile(FILENAME)
+    files = z.namelist()
+
+    ## FIND MANUAL STIG FILE
+    for file in files:
+        if file.endswith('_Manual-xccdf.xml'):
+            ## HANDLE MACOS
+            if not file.startswith('__MACOS'):
+                ## DETERMINE FILE NAME
+                STIG_FILENAME = file
+                break
+
+    ## ENSURE FILE IS FOUND
+    assert STIG_FILENAME is not None, 'Manual STIG File was NOT FOUND'
+
+    ## READ STIG FILE
+    RAW_FILE = z.read(STIG_FILENAME)
+
+    ## ENSURE FILE READ CORRECTLY
+    assert RAW_FILE is not None, 'Unable to Read STIG File (%s)' % STIG_FILENAME
+
+    ## CONVERT RAW STIG TO JSON OBJECT
+    STIG_JSON = convert_xccdf(RAW_FILE)
+
+    ## ENSURE STIG WAS PARSED
+    assert STIG_JSON is not None, 'Unable to Parse STIG File (%s)' % STIG_FILENAME
+
+    ## VALIDATE KNOWN ENTRIES
+    assert STIG_JSON['title'] == "Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide", "STIG Title Parsed Incorrectly"    ## STIG TITLE
+    assert STIG_JSON['benchmark_date'] == "19 Jul 2019"     ## BENCHMARK DATE
+    assert STIG_JSON['rules'][0]['id'] == "V-94863"     ## FIRST RULE ID
+    assert STIG_JSON['release_info'] == "Release: 1 Benchmark Date: 19 Jul 2019"    ## RELEASE INFO
+    assert STIG_JSON['source'] == "STIG.DOD.MIL"    ## SOURCE
+    assert STIG_JSON['notice'] == "terms-of-use"    ## NOTICE
+    assert STIG_JSON['rules'][0]['cci'] == "CCI-000054"    ## FIRST RULE CCI NUMBER
+    assert STIG_JSON['rules'][0]['stig_id'] == "DKER-EE-001000"     ## FIRST RULE STIG ID
+    assert STIG_JSON['rules'][0]['rule_id'] == "SV-104693r1_rule"   ## FIRST RULE ID
\ No newline at end of file