| 4.1.1 Ensure the cluster-admin ClusterRole is only used when required | ACCESS CONTROL |
| 4.1.2 Ensure access to Secrets is minimized and granted only where required | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.1.3 Minimize wildcard use in Roles and ClusterRoles | IDENTIFICATION AND AUTHENTICATION |
| 4.1.4 Ensure that default service accounts are not actively used | ACCESS CONTROL |
| 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access | CONFIGURATION MANAGEMENT |
| 4.1.6 Avoid granting cluster admin level access through the system:masters group | ACCESS CONTROL |
| 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster | ACCESS CONTROL |
| 4.1.9 Avoid binding RBAC roles to all authenticated users | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 4.6.1 Use namespaces to separate workload administration and resource governance | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Enable VPC Flow Logs and Intranode Visibility | AUDIT AND ACCOUNTABILITY |
