| 1.1.2 Ensure that the --anonymous-auth argument is set to false | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.8 Ensure that the --secure-port argument is not set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.17 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.23 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - kubelet-client-key | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.26 Ensure that the --service-account-key-file argument is set as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.29 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - tls-cert-file | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.30 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.33 Ensure that the admission control policy is set to NodeRestriction | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 1.1.35 Ensure that the encryption provider is set to aescbc | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | |
| 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.3.3 Ensure that the --use-service-account-credentials argument is set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.4.8 Ensure that the etcd.conf file ownership is set to root:root | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.9 Ensure that the flanneld file permissions are set to 644 or more restrictive | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.5.8 Ensure that the --max-wals argument is set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.6.3 Create administrative boundaries between resources using namespaces | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 2.1.1 Backup Policy in Place | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | CONTINGENCY PLANNING |
| 2.1.1 Ensure that the --allow-privileged argument is set to false | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 2.1.3 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 2.1.4 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.5 Ensure that the --read-only-port argument is set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.6 Disaster Recovery (DR) Plan | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | CONTINGENCY PLANNING |
| 2.1.14 Ensure that the RotateKubeletClientCertificate argument is set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.2 Enable message integrity | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 2.2.2 Ensure that the config file ownership is set to root:root | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Do Not Reuse Usernames | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL |
| 2.5.1 Enable password encryption | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | IDENTIFICATION AND AUTHENTICATION |
| 3.1.3 Ensure that the --insecure-allow-any-token argument is not set | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 3.1.4 Ensure that the --insecure-bind-address argument is not set | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 3.1.9 Ensure that the admission control policy is set to NamespaceLifecycle | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 3.1.12 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.5 Ensure updates to system tables are not permitted | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 3.6.1 Ensure a strong system encryption password is set | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 4.3 Enable auditing - sp_configure 'auditing' | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | AUDIT AND ACCOUNTABILITY |
| 4.4 Harden Usage for 'local_infile' on MariaDB Clients | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | CONFIGURATION MANAGEMENT |
| 4.8 Log successful and failed login attempt - success | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 5.8 Ensure 'REPLICATION SLAVE' is Not Granted to Non-Administrative Users | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1 Ensure 'log_error' is configured correctly | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | AUDIT AND ACCOUNTABILITY |
| 6.2 Ensure Log Files are Stored on a Non-System Partition | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | AUDIT AND ACCOUNTABILITY |
| 6.5 Ensure the Audit Plugin Can't be Unloaded | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | AUDIT AND ACCOUNTABILITY |
| 6.6 Remove sample databases if installed | CIS Sybase 15.0 L1 DB v1.1.0 | SybaseDB | |
| 7.1 Disable use of the mysql_old_password plugin | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.4 Ensure Password Complexity Policies are in Place | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | IDENTIFICATION AND AUTHENTICATION |
| 7.6 Ensure No Anonymous Accounts Exist | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL |
| 9.1 Ensure Replication Traffic is Secured | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| TCAT-AS-001430 - Certificates in the trust store must be issued/signed by an approved CA. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN22-MS-000040 - Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN22-MS-000060 - Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | ACCESS CONTROL |
| WN22-MS-000120 - Windows Server 2022 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | ACCESS CONTROL |
| WN22-MS-000130 - Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems. | DISA Microsoft Windows Server 2022 STIG v2r11 | Windows | ACCESS CONTROL |
