| 1.1 Create a separate partition for containers | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2 Ensure extraneous files and directories are removed | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.3 Do not use development tools in production | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 1.3 Ensure only defined users have access to the file system | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.4 Ensure that only one user ID has write access to the WebSphere Liberty configuration files | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 1.4 Only allow trusted users to control Docker daemon | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | ACCESS CONTROL |
| 1.5 Audit docker daemon | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.6 Audit Docker files and directories - /var/lib/docker | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.6 Ensure automated configuration updates are disabled | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.6 Keep Docker up to date | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.8 Ensure Websphere Liberty file system access is Restricted | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.9 Audit Docker files and directories - docker.socket | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.9 Ensure that the 'onConflict attribute' is set to 'IGNORE' to restrict config file overwrites | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.13 Audit Docker files and directories - /var/run/docker.sock | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.14 Audit Docker files and directories - /etc/sysconfig/docker | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.3 Ensure that the LDAP connection uses TLS | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Confirm default cgroup usage | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.10 Do not change base device size until needed | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | |
| 3.1 Ensure that automatic applications updates are disabled | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 3.1 Verify that docker.service file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.4 Verify that docker-registry.service file permissions are set to 644 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.7 Verify that Docker environment file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.10 Verify that docker-network environment file permissions are set to 644 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.11 Verify that docker-registry environment file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.16 Verify that /etc/docker directory permissions are set to 755 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 4.1.1.1 Ensure 'cookieSameSite' SameSite attribute is set to 'Strict' for session cookies | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.2 Ensure 'sslProtocol' is set to the latest versions of TLS (Transport Layer Security) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.5 Ensure that secure ciphers suites are configured | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.12 Ensure `httpPort` attribute set to `-1` | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.3 Ensure 'tokenReuse' is set to 'false' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.3.7 Ensure 'signatureAlgorithm' is set to a secure algorithm in OIDC Provider (OP) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.10 Ensure 'accessTokenEncoding' is set to a strong hash algorithm in OAuth 2.0 | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.13 Ensure 'httpsRequired' is set to 'true' in OAuth 2.0 | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.16 Enforce 'wantAssertionsSigned' to 'true' in SAML | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.4.4 Ensure 'hostNameExcludeList' is set to the hostnames to be excluded for web traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.17 Ensure uncovered http methods are denied | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.24 Ensure whitelisting of virtual hosts to validate access based on originating endpoint | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 5.2.1 Ensure 'sslEnabled' is set to 'true' within the CSIv2 TransportLayer - needsReview/Zech | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Ensure that all appropriate EJB methods are protected | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6 Do not run ssh within containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.8 Do not map privileged ports within containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.8 Open only needed ports on container | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.10 Do not use host network mode on container | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.11 Limit memory usage for container | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.15 Set the 'on-failure' container restart policy to 5 - RestartPolicyName=always | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 6.1 Perform regular security audits of your host system and containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 6.4 Ensure SOAP messages are Signed and encrypted with WS-Security policy | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5 Ensure that 2048 bit keys are used for signing and encrypting SOAP messages with WS-Security policy | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.1 Ensure the 'hostNameExcludeList' attribute is set to a whitelist of host names | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 10.5 Ensure 'security-role' is defined for role based authorization checks for Web and EJB applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
