diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
index 1cb90f75c145..b4529c3c752a 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
@@ -50,3 +50,10 @@ references:
     nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
     pcidss: Req-10.2.3
     srg: SRG-APP-000505-CTR-001285
+
+ocil_clause: 'there is not output'
+
+ocil: |-
+    {{{ ocil_audit_rules_watch("/var/run/utmp", "session") }}}
+    {{{ ocil_audit_rules_watch("/var/log/btmp", "session") }}}
+    {{{ ocil_audit_rules_watch("/var/log/wtmp", "session") }}}
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
index dec1be4ebf29..20459bac9314 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
@@ -104,3 +104,18 @@ references:
     nist: CM-6(a),AU-8(1)(a),AU-8(2),AU-12(1)
     nist-csf: PR.PT-1
     pcidss: Req-10.4.3
+
+ocil_clause: 'fewer than two remote NTP servers are configured for the NTP daemon in use'
+
+ocil: |-
+    Verify that {{{ full_name }}} is configured with more than one remote NTP server.
+
+    If the system uses <tt>chronyd</tt> as the NTP daemon (the default), run the following command:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" {{{ chrony_conf_path }}}</pre>
+
+    Also check any drop-in configuration files the daemon includes.
+
+    If the system uses <tt>ntpd</tt> as the NTP daemon, run the following command instead:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" /etc/ntp.conf</pre>
+
+    Two or more <tt>server</tt> lines must be returned for the NTP daemon that is in use.
diff --git a/linux_os/guide/system/software/integrity/disable_prelink/rule.yml b/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
index c187957e630f..a62a0ccfbf94 100644
--- a/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
+++ b/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
@@ -37,3 +37,19 @@ references:
     nist: SC-13,CM-6(a)
     nist-csf: PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1
     pcidss: Req-11.5
+
+ocil_clause: 'the prelink package is installed and prelinking is not disabled'
+
+ocil: |-
+    Verify that prelinking is disabled on {{{ full_name }}}.
+
+    First determine whether the <tt>prelink</tt> package is installed:
+    <pre>$ rpm -q prelink</pre>
+
+    If the package is not installed, prelinking cannot be in use and the requirement is met.
+
+    If the package is installed, verify that prelinking is disabled:
+    <pre>$ grep -i PRELINKING /etc/sysconfig/prelink</pre>
+
+    The output must be:
+    <pre>PRELINKING=no</pre>