| 2.3.4.1 Ensure 'Devices: Prevent users from installing printer drivers' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.4 Ensure 'Downloaded Maps Manager (MapsBroker)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.16 Ensure 'Peer Networking Identity Manager (p2pimsvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.17 Ensure 'PNRP Machine Name Publication Service (PNRPAutoReg)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.20 Ensure 'Remote Access Auto Connection Manager (RasAuto)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.23 Ensure 'Remote Desktop Services UserMode Port Redirector (UmRdpService)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.39 Ensure 'Windows PushToInstall Service (PushToInstall)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.44 Ensure 'Xbox Live Networking Service (XboxNetApiSvc)' is set to 'Disabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.9.1 Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.6.9.2 Ensure 'Turn on Responder (RSPNDR) driver' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.6.19.2.1 (L1) Disable IPv6 (Ensure TCPIP6 Parameter 'DisabledComponents' is set to '0xff (255)') | CIS Microsoft Windows 10 EMS Gateway v3.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.11.2.5 (BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password' | CIS Microsoft Windows 8.1 v2.4.1 L2 Bitlocker | Windows | ACCESS CONTROL, CONTINGENCY PLANNING |
| 18.9.20.1.9 Ensure 'Turn off Search Companion content file updates' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - 7zFM.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - Foxit Reader.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - iTunes.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - mirc.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - QuickTimePlayer.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - Safari.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - SkyDrive.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - Skype.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' - wmplayer.exe | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.4 Ensure 'Default Protections for Popular Software' is set to 'Enabled' - Firefox plugin-container.exe | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.4 Ensure 'Default Protections for Popular Software' is set to 'Enabled' - pidgin.exe | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.4 Ensure 'Default Protections for Popular Software' is set to 'Enabled' - vlc.exe | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.4 Ensure 'Default Protections for Popular Software' is set to 'Enabled' - WindowsLiveWriter.exe | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.4 Ensure 'Default Protections for Popular Software' is set to 'Enabled' - WLXPhotoGallery.exe | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.28.1 Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | ACCESS CONTROL |
| 18.9.35.6.3 Ensure 'Allow standby states (S1-S3) when sleeping (on battery)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.4 Ensure 'Allow standby states (S1-S3) when sleeping (plugged in)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.49.5.1 Ensure 'Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.49.11.1 Ensure 'Enable/Disable PerfTrack' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.10.1.2 Ensure 'Choose how BitLocker-protected fixed drives can be recovered' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.4 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Password' is set to 'Enabled: Allow 48-digit recovery password' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.5 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Key' is set to 'Enabled: Allow 256-bit recovery key' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.7 Ensure 'Configure use of hardware-based encryption for fixed data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | ACCESS CONTROL |
| 18.10.10.2.2 Ensure 'Allow Secure Boot for integrity validation' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.10.2.6 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Key' is set to 'Enabled: Do not allow 256-bit recovery key' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.3.1 Ensure 'Allow access to BitLocker-protected removable data drives from earlier versions of Windows' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | ACCESS CONTROL |
| 18.10.10.3.6 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | MEDIA PROTECTION |
| 18.10.10.3.8 Ensure 'Configure use of passwords for removable data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.10.3.11 Ensure 'Deny write access to removable drives not protected by BitLocker' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | MEDIA PROTECTION |
| 18.10.10.3.12 Ensure 'Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization' is set to 'Enabled: False' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | MEDIA PROTECTION |
| 18.10.16.4 Ensure 'Enable OneSettings Auditing' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.24.4 (L1) Ensure 'Default Protections for Popular Software' is set to 'Enabled' | CIS Windows Server 2012 MS L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.57.3.3.5 Ensure 'Do not allow LPT port redirection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.6 Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.91.1 Ensure 'Allow Remote Shell Access' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL NG | Windows | CONFIGURATION MANAGEMENT |
| WN11-UR-000070 - The 'Deny access to this computer from the network' user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN12-UR-000020-MS - The Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | ACCESS CONTROL |
