| 1.1.2 Ensure that the API server pod specification file ownership is set to root:root | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL |
| 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL |
| 1.1.14 Ensure that the default administrative credential file ownership is set to root:root | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL |
| 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL |
| 3.5 Ensure the SQL Server's MSSQL Service Account is Not an Administrator | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine Windows | Windows | ACCESS CONTROL |
| 3.5 Ensure the SQL Server's MSSQL Service Account is Not an Administrator | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine Windows | Windows | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS Windows | Windows | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.7 Ensure the SQL Server's Full-Text Service Account is Not an Administrator | CIS Microsoft SQL Server 2019 v1.6.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 3.7 Ensure the SQL Server's Full-Text Service Account is Not an Administrator | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine Windows | Windows | ACCESS CONTROL |
| 3.14 Ensure 'Control Server' permission is not granted | CIS Microsoft SQL Server 2022 v1.3.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL |
| 4.1.1 Ensure the cluster-admin ClusterRole is only used when required | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | ACCESS CONTROL |
| 4.1.6 Avoid granting cluster admin level access through the system:masters group | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | ACCESS CONTROL |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL |
| 4.2 Ensure sudo is configured correctly | CIS PostgreSQL 17 v1.1.0 L1 OS Linux Unix | Unix | ACCESS CONTROL |
| 4.3.1 Ensure sudo is installed | CIS CentOS Linux 7 v4.0.0 L1 Server | Unix | ACCESS CONTROL |
| 4.3.2 Ensure sudo commands use pty | CIS Amazon Linux 2023 v1.0.0 L1 Server | Unix | ACCESS CONTROL |
| 4.8 Ensure the set_user extension is installed | CIS PostgreSQL 13 v1.3.0 L1 Database PostgreSQLDB | PostgreSQLDB | ACCESS CONTROL |
| 5.2 Ensure Options for the Web Root Directory Are Restricted | CIS Apache HTTP Server 2.4 v2.3.0 L2 | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS Red Hat Enterprise Linux 10 v1.0.1 L1 Server | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS Oracle Linux 10 v1.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS Rocky Linux 8 v3.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS Rocky Linux 9 v2.0.0 L1 Workstation | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.1 Ensure sudo is installed | CIS AlmaLinux OS 8 v4.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.1 Privilege escalation: sudo | CIS IBM AIX 7.1 L2 v2.1.0 | Unix | ACCESS CONTROL |
| 5.2.6 Ensure sudo authentication timeout is configured correctly | CIS Oracle Linux 9 v2.0.0 L1 Workstation | Unix | ACCESS CONTROL |
| 5.2.6 Ensure sudo authentication timeout is configured correctly | CIS Red Hat Enterprise Linux 9 v2.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.6 Ensure sudo timestamp_timeout is configured | CIS SUSE Linux Enterprise 16 v1.0.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL |
| 5.3 Ensure 'PROCESS' is Not Granted to Non-Administrative Users | CIS Oracle MySQL Community Server 9.7 v1.0.0 L2 MySQL RDBMS MySQLDB | MySQLDB | ACCESS CONTROL |
| 5.3.1 Ensure that Azure Admin Accounts Are Not Used for Daily Operations | CIS Microsoft Azure Foundations v6.0.0 L1 | microsoft_azure | ACCESS CONTROL |
| 5.3.2 Ensure sudo commands use pty | CIS CentOS Linux 8 Workstation L1 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.4 Ensure users must provide password for escalation | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.5 Ensure re-authentication for privilege escalation is not disabled globally | CIS CentOS Linux 8 Server L1 v2.0.0 | Unix | ACCESS CONTROL |
| 5.3.6 Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed | CIS Microsoft Azure Foundations v6.0.0 L1 | microsoft_azure | ACCESS CONTROL |
| 5.5 Ensure the 'root' Account Is Disabled | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL |
| 5.5 Ensure the "root" Account Is Disabled | CIS Apple macOS 12.0 Monterey v4.0.0 L1 | Unix | ACCESS CONTROL |
| 5.6 Adding authorised users in cron.allow | CIS IBM AIX 7.1 L1 v2.1.0 | Unix | ACCESS CONTROL |
| 9.7 Verify No UID 0 Accounts Exist Other than root | CIS Oracle Solaris 11.4 L1 v1.1.0 | Unix | ACCESS CONTROL |
| 10.2 Restrict access to the web administration application | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 10.2 Restrict access to the web administration application | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | ACCESS CONTROL |
| 10.3 Restrict manager application | CIS Apache Tomcat 11 v1.0.0 L2 | Unix | ACCESS CONTROL |
| 10.3 Restrict manager application | CIS Apache Tomcat 9 L2 v1.2.0 | Unix | ACCESS CONTROL |
| 10.13 Do not run applications as privileged | CIS Apache Tomcat 9 L1 v1.2.0 | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for config component | CIS Apache Tomcat 9 L1 v1.2.0 | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for config component | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for umask uncommented in startup | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | ACCESS CONTROL |
| 18.9.90.2 (L1) Ensure 'Always install with elevated privileges' is set to 'Disabled' | CIS Azure Compute Microsoft Windows Server 2019 v1.0.0 L1 DC | Windows | ACCESS CONTROL |
