| 1.1.2 Ensure 'Maximum password age' is set to '365 or fewer days, but not 0' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL |
| 2.2.27 Ensure 'Log on as a batch job' is set to 'Administrators' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.6 Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.15 Ensure 'Peer Networking Identity Manager (p2pimsvc)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.24 Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.26 Ensure 'Server (LanmanServer)' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.34 Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 17.2.2 Ensure 'Audit Security Group Management' is set to include 'Success' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 17.3.2 Ensure 'Audit Process Creation' is set to include 'Success' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.2 Ensure 'Audit Group Membership' is set to include 'Success' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.4 Ensure 'Audit Logon' is set to 'Success and Failure' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.2 Ensure 'Audit Other System Events' is set to 'Success and Failure' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.1.1.1 Ensure 'Prevent enabling lock screen camera' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL |
| 18.4.3 Ensure 'Configure SMB v1 server' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.4.4 Ensure 'Enable Certificate Padding' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.5 Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.5.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.4 Ensure 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.5.7 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.6.4.1 Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.6.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication', 'Require Integrity', and 'Require Privacy' set for all NETLOGON and SYSVOL shares' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.7.14 Ensure 'Require IPPS for IPP printers' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.7.15 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority' is set to 'Enabled: Checked' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.7.16 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow non-server certificates' is set to 'Enabled: Checked' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.7.17 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name' is set to 'Enabled: Checked' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.20.1.11 Ensure 'Turn off the 'Publish to Web' task for files and folders' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.9.1.1 Ensure 'Configure enhanced anti-spoofing' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.13.1 Ensure 'Turn off cloud consumer account state content' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL |
| 18.10.16.3 Ensure 'Do not show feedback notifications' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.2 Ensure 'Enable App Installer Experimental Features' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.6 Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.26.1.2 Ensure 'Application: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.3.2 Ensure 'Setup: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.4.1 Ensure 'System: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.4.2 Ensure 'System: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.57.3.3.3 Ensure 'Do not allow drive redirection' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.1 Ensure 'Always prompt for password upon connection' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.4 Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.66.2 Ensure 'Turn off Automatic Download and Install of updates' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.83.2 Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL |
| 18.10.90.1.1 Ensure 'Allow Basic authentication' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.1 Ensure 'Allow Basic authentication' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.94.1.1 Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.2.1 Ensure 'Configure Automatic Updates' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
