| 1.1.2.2.1 Ensure separate partition exists for /home | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.2.3.1 Ensure separate partition exists for /var | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.2.4.1 Ensure separate partition exists for /var/tmp | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.2.5.1 Ensure separate partition exists for /var/log | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.1.2.6.1 Ensure separate partition exists for /var/audit | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 3.2.1 Ensure sctp kernel module is not available | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 4.3.4 Ensure users must provide password for escalation | ACCESS CONTROL |
| 4.5.3.1 Ensure nologin is not listed in /etc/shells | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 5.2.1.1 Ensure auditd service is enabled | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.2.1 Ensure audit log storage size is configured | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | AUDIT AND ACCOUNTABILITY |
| 5.2.3.1 Ensure actions as another user are always logged | AUDIT AND ACCOUNTABILITY |
| 5.2.3.2 Ensure events that modify the sudo log file are collected | AUDIT AND ACCOUNTABILITY |
| 5.2.3.3 Ensure use of privileged commands are collected | AUDIT AND ACCOUNTABILITY |
| 5.2.3.4 Ensure discretionary access control permission modification events are collected | AUDIT AND ACCOUNTABILITY |
| 5.2.3.5 Ensure successful file system mounts are collected | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.6 Ensure login and logout events are collected | AUDIT AND ACCOUNTABILITY |
| 5.2.3.7 Ensure file deletion events by users are collected | AUDIT AND ACCOUNTABILITY |
| 5.2.3.8 Ensure successful and unsuccessful attempts to use the usermod command are recorded | AUDIT AND ACCOUNTABILITY |
| 5.2.4.1 Ensure the audit log directory is 0750 or more restrictive | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.2 Ensure audit log files are mode 0640 or less permissive | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.3 Ensure only authorized users own audit log files | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.4 Ensure only authorized groups are assigned ownership of audit log files | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.5 Ensure audit configuration files are restrictive | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.6 Ensure audit configuration files are owned by root | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.7 Ensure audit configuration files belong to group wheel | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.8 Ensure audit tools are 555 or more restrictive | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.9 Ensure audit tools are owned by root | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.10 Ensure audit tools belong to group wheel | ACCESS CONTROL, MEDIA PROTECTION |
| CIS_FreeBSD_14_v1.0.1_L2.audit from CIS FreeBSD 14 v1.0.1 | |
