| 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL |
| 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.2.1.6 Ensure cryptographic verification of vendor software packages | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | CONFIGURATION MANAGEMENT |
| 1.4.6 Ensure version 7.2 or newer booted with UEFI have a unique name for the grub superusers account | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | ACCESS CONTROL |
| 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.6.5 Apply Security Context to Your Pods and Containers | CIS Kubernetes 1.13 Benchmark v1.4.1 L2 | Unix | |
| 1.7.6 Do not admit root containers | CIS Kubernetes 1.13 Benchmark v1.4.1 L2 | Unix | CONFIGURATION MANAGEMENT |
| 1.7.6 Do not admit root containers | CIS Kubernetes 1.11 Benchmark v1.3.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.1 Ensure that the --allow-privileged argument is set to false | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | ACCESS CONTROL |
| 2.3.2 RedHat bind-chroot Rpm '/var/named/chroot/var/log' | CIS ISC BIND 9.0/9.5 v2.0.0 | Unix | |
| 4.2 Use trusted base images for containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.6 Add HEALTHCHECK instruction to the container image | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.6 Ensure HEALTHCHECK instructions have been added to the container image | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.1.2 Grant least privilege IAM access to Artifact Registry repositories | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.2 Grant least privilege IAM access to Artifact Registry repositories | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4 Ensure that Linux kernel capabilities are restricted within containers | CIS Docker v1.8.0 L1 OS Linux | Unix | CONFIGURATION MANAGEMENT |
| 5.5 Ensure that privileged containers are not used | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL |
| 5.5.1 Use COS_CONTAINERD node images for GKE node pools | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | CONFIGURATION MANAGEMENT |
| 5.6.3 Apply Security Context to Your Pods and Containers | CIS Kubernetes v2.0.1 L2 Master Node | Unix | CONFIGURATION MANAGEMENT |
| 5.12 Ensure that CPU priority is set appropriately on containers | CIS Docker v1.8.0 L1 OS Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.13 Bind incoming container traffic to a specific host interface | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.16 Ensure the host's IPC namespace is not shared | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.17 Ensure that the host's IPC namespace is not shared | CIS Docker v1.8.0 L1 OS Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.18 Override default ulimit at runtime only if needed | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.18 Override default ulimit at runtime only if needed | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.19 Override default ulimit at runtime only if needed | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.22 Do not docker exec commands with privileged option | CIS Docker 1.12.0 v1.0.0 L2 Docker | Unix | |
| 5.22 Do not docker exec commands with privileged option | CIS Docker 1.11.0 v1.0.0 L2 Docker | Unix | |
| 5.22 Do not docker exec commands with privileged option | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | |
| 5.22 Ensure docker exec commands are not used with privileged option | CIS Docker Community Edition v1.1.0 L2 Docker | Unix | |
| 5.25 Ensure that cgroup usage is confirmed | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.30 Do not share the host's user namespaces | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 23.1 Ensure 'Configure System Guard Launch' is set to 'Unmanaged Enables Secure Launch if supported by hardware' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 23.4 Ensure 'Require Platform Security Features' is set to 'Turns on VBS with Secure Boot' or higher | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| CNTR-R2-000940 - Rancher RKE2 runtime must isolate security functions from nonsecurity functions. | DISA Rancher Government Solutions RKE2 STIG v2r7 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| DKER-EE-002060 - The Docker Enterprise hosts UTS namespace must not be shared. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-002780 - PIDs cgroup limits must be used in Docker Enterprise. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| DKER-EE-003560 - Docker Enterprise network ports on all running containers must be limited to what is needed. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| KNOX-07-014300 - The Samsung Android 7 with Knox must implement the management setting: Container Account whitelist. | MobileIron - DISA Samsung Android 7 with Knox 2.x v1r1 | MDM | CONFIGURATION MANAGEMENT |
| KNOX-07-014300 - The Samsung Android 7 with Knox must implement the management setting: Container Account whitelist. | AirWatch - DISA Samsung Android 7 with Knox 2.x v1r1 | MDM | CONFIGURATION MANAGEMENT |
| KNOX-07-914400 - The Samsung Android 7 with Knox must implement the management setting: Container Account blacklist. | AirWatch - DISA Samsung Android 7 with Knox 2.x v1r1 | MDM | CONFIGURATION MANAGEMENT |
| PGS9-00-008000 - PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and validate cryptographic hashes. | DISA STIG PostgreSQL 9.x on RHEL OS v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
