| 1.1.2 Ensure 'Allow gnubby authentication for remote access hosts' is set to 'Disabled'. | CIS Google Chrome L1 v2.0.0 | Windows | ACCESS CONTROL |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | CIS Kubernetes Benchmark v1.9.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - certificate | CIS Kubernetes Benchmark v1.7.1 L1 Master | Unix | |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - certificate | CIS Kubernetes Benchmark v1.8.0 L1 Master | Unix | |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - certificate | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - certificate | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - certificate | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - key | CIS Kubernetes Benchmark v1.7.1 L1 Master | Unix | |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - key | CIS Kubernetes Benchmark v1.8.0 L1 Master | Unix | |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - key | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - key | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - key | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes Benchmark v1.8.0 L1 Master | Unix | |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes Benchmark v1.7.1 L1 Master | Unix | |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes Benchmark v1.9.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | CIS Kubernetes Benchmark v1.8.0 L2 Master | Unix | |
| 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | CIS Kubernetes Benchmark v1.7.1 L1 Master | Unix | |
| 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate - certfile | CIS Kubernetes Benchmark v1.6.1 L1 Master | Unix | |
| 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate - keyfile | CIS Kubernetes Benchmark v1.6.1 L1 Master | Unix | |
| 2.2 Ensure network traffic is restricted between containers on the default bridge | CIS Docker v1.5.0 L1 Docker Linux | Unix | |
| 2.2 Ensure network traffic is restricted between containers on the default bridge | CIS Docker v1.3.1 L1 Docker Linux | Unix | |
| 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled | CIS Palo Alto Firewall 9 v1.0.1 L1 | Palo_Alto | |
| 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled | CIS Palo Alto Firewall 10 v1.0.0 L1 | Palo_Alto | |
| 2.7 Ensure that a unique Certificate Authority is used for etcd | CIS Kubernetes Benchmark v1.5.1 L2 | Unix | |
| 2.7 Ensure that a unique Certificate Authority is used for etcd | CIS Kubernetes Benchmark v1.6.1 L2 Master | Unix | |
| 3.1 Ignore Erroneous or Unwanted Queries - Multicast addresses | CIS BIND DNS v1.0.0 L1 Authoritative Name Server | Unix | CONFIGURATION MANAGEMENT |
| 3.1 Ignore Erroneous or Unwanted Queries - RFC 1918 172.16/12; addresses | CIS BIND DNS v1.0.0 L1 Authoritative Name Server | Unix | CONFIGURATION MANAGEMENT |
| 3.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | CIS Google Kubernetes Engine (GKE) v1.1.0 L1 Worker | Unix | |
| 3.2.7 Ensure that the --make-iptables-util-chains argument is set to true | CIS Google Kubernetes Engine (GKE) v1.1.0 L1 Worker | Unix | |
| 3.5.2 Configure FCoE Zoning - interface vfc | CIS Cisco NX-OS L1 v1.0.0 | Cisco | CONFIGURATION MANAGEMENT |
| 3.5.2 Configure FCoE Zoning - interface vfc | CIS Cisco NX-OS L2 v1.0.0 | Cisco | CONFIGURATION MANAGEMENT |
| 3.5.2 Configure FCoE Zoning - vsan database | CIS Cisco NX-OS L2 v1.0.0 | Cisco | CONFIGURATION MANAGEMENT |
| 3.5.2 Configure FCoE Zoning - vsan database | CIS Cisco NX-OS L1 v1.0.0 | Cisco | CONFIGURATION MANAGEMENT |
| 3.10 Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses | CIS Google Cloud Platform v1.1.0 L2 | GCP | |
| 4.1.3 Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'. | CIS Google Chrome L1 v2.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.1.4 Ensure 'Configure the required domain names for remote access clients' is set to 'Enabled' with a domain defined | CIS Google Chrome L1 v2.0.0 | Windows | ACCESS CONTROL |
| 4.12.1 Ensure LLDP is Disabled if not Required | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | CONFIGURATION MANAGEMENT |
| 4.12.2 Ensure LLDP-MED is Disabled if not Required | CIS Juniper OS Benchmark v2.1.0 L2 | Juniper | CONFIGURATION MANAGEMENT |
| 7.3 Ensure that swarm services are bound to a specific host interface | CIS Docker v1.5.0 L1 Docker Linux | Unix | |
| 7.3 Ensure that swarm services are bound to a specific host interface | CIS Docker v1.3.1 L1 Docker Linux | Unix | |
| 7.5 Firewall Consideration | CIS Apple macOS 10.12 L2 v1.2.0 | Unix | CONFIGURATION MANAGEMENT |
| 7.5 Firewall Consideration | CIS Apple macOS 10.13 L2 v1.1.0 | Unix | CONFIGURATION MANAGEMENT |
| 9.1 Ensure the TimeOut Is Set to 10 or Less | CIS Apache HTTP Server 2.4 L1 v2.1.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.1 Ensure the TimeOut Is Set to 10 or Less | CIS Apache HTTP Server 2.4 L1 v2.1.0 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
