| 1.1.1 Ensure default password of root is not allowed | CIS F5 Networks v1.0.0 L1 | F5 | IDENTIFICATION AND AUTHENTICATION |
| 1.2 Ensure Snowflake SCIM integration is configured to automatically provision and deprovision users and groups (i.e. roles) | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - groove.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - msaccess.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - mse7.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - powerpnt.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - pptview.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.1 Ensure 'Protection From Zone Elevation' is set to Enabled - winproj.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.10 Ensure 'Object Caching Protection' is set to Enabled - mse7.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.10 Ensure 'Object Caching Protection' is set to Enabled - visio.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.11 Ensure 'Consistent Mime Handling' is set to Enabled - msaccess.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.2.1.11 Ensure 'Consistent Mime Handling' is set to Enabled - pptview.exe | CIS Microsoft Office 2016 v1.1.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.8 (L2) Ensure 'Control SafeSites adult content filtering' is set to 'Enabled: Filter top level sites (but not embedded iframes) for adult content' | CIS Google Chrome L2 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.10 (L1) Ensure 'Disable Certificate Transparency enforcement for a list of Legacy Certificate Authorities' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.12 Ensure that no users have ACCOUNTADMIN or SECURITYADMIN as the default role | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.14 (L1) Ensure 'DNS interception checks enabled' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.17 Ensure Snowflake stored procedures do not run with ACCOUNTADMIN or SECURITYADMIN role privileges | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.18 (L1) Ensure 'Enable security warnings for command-line flags' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 1.20 Ensure an account-level authentication policy has been configured to restrict allowed provider accounts for Workload Identify Federation (WIF) | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | IDENTIFICATION AND AUTHENTICATION |
| 1.25 (L1) Ensure 'List of names that will bypass the HSTS policy check' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.28 (L1) Ensure 'Suppress the unsupported OS warning' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND SERVICES ACQUISITION |
| 2.1.1 (L1) Ensure 'Update policy override' is set to 'Enabled' with 'Always allow updates (recommended)' or 'Automatic silent updates' specified | CIS Google Chrome L1 v3.0.0 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.2 Ensure monitoring and alerting exist for MANAGE GRANTS privilege grants | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.2 Ensure redundant remote authentication servers are configured | CIS F5 Networks v1.0.0 L2 | F5 | ACCESS CONTROL |
| 2.3 Ensure monitoring and alerting exist for password sign-in without MFA | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.3 Ensure that "Fallback to local" option is disabled for Remote Authentication Settings | CIS F5 Networks v1.0.0 L2 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.6 (L2) Ensure 'Control Manifest v2 extension availability' Is Set to Forced Only | CIS Google Chrome L2 v3.0.0 | Windows | RISK ASSESSMENT |
| 2.4.1 (L2) Ensure 'Supported authentication schemes' is set to 'Enabled: ntlm, negotiate' | CIS Google Chrome L2 v3.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5 Ensure External Users' has access to needed Partitions only | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.8.7 (L1) Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'. | CIS Google Chrome L1 v3.0.0 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.13 (L1) Ensure 'Disable proceeding from the Safe Browsing warning page' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.14 (L1) Ensure 'Require Site Isolation for every site' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 2.20 (L1) Ensure 'Allow Web Authentication requests on sites with broken TLS certificates' Is Disabled | CIS Google Chrome L1 v3.0.0 | Windows | ACCESS CONTROL, AWARENESS AND TRAINING, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.26 (L1) Ensure 'Enable Google Search Side Panel' Is Disabled | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.28 (L1) Ensure 'Enable automatic HTTPS upgrades' Is Enabled | CIS Google Chrome L1 v3.0.0 | Windows | MEDIA PROTECTION |
| 2.29 (L1) Ensure 'Insecure Hashes in TLS Handshakes Enabled' Is Disabled | CIS Google Chrome L1 v3.0.0 | Windows | ACCESS CONTROL, AWARENESS AND TRAINING, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1 Ensure 'Idle timeout' is less than or equal to 10 minutes for Configuration utility sessions | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.4 (L1) Ensure 'Block third party cookies' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 3.5 (L2) Ensure 'Browser sign in settings' is set to 'Enabled: Disabled browser sign-in' | CIS Google Chrome L2 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.1 Ensure Prelogin 'Login Banner' is set | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.1.1 (L2) Ensure 'Allow or deny screen capture' is set to 'Disabled' | CIS Google Chrome L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 4.2.7 (L2) Ensure 'Allow Window Management permission on these sites' Is Configured | CIS Google Chrome L2 v3.0.0 | Windows | ACCESS CONTROL |
| 4.4 (L2) Ensure 'Allow or deny audio capture' is set to 'Disabled' | CIS Google Chrome L2 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.5 Ensure that the REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION account parameter is set to true | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 4.6 Ensure to set SSH MAC algorithm to hmac-sha2-256 | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.7 Ensure that all external stages have storage integrations | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 4.9 (L1) Ensure 'Enable AutoFill for credit cards' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.9 Ensure that Tri-Secret Secure is enabled for the Snowflake account | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1 Ensure redundant NTP servers are configured appropriately | CIS F5 Networks v1.0.0 L1 | F5 | AUDIT AND ACCOUNTABILITY |
| 5.2.4.1 Ensure the audit log directory is 0750 or more restrictive | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
