Would suggest any optional file mount types be made cat III (so recommended instead of required, at least at NASA) since the assumption is that they are unused. Just because they are used, however, does not mean they are insecure and the text even indicates something along these lines so cat II seems like overkill. They really should just be disable if not using. We are not specifically using cramfs, but did hit a different one for squashfs (which, interestingly enough, does not even seem to be in the RHEL STIG either so not sure where NASA got that from).
Would suggest any optional file mount types be made cat III (so recommended instead of required, at least at NASA) since the assumption is that they are unused. Just because they are used, however, does not mean they are insecure and the text even indicates something along these lines so cat II seems like overkill. They really should just be disable if not using. We are not specifically using cramfs, but did hit a different one for squashfs (which, interestingly enough, does not even seem to be in the RHEL STIG either so not sure where NASA got that from).