| 1.2 Use the updated Linux Kernel | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.6 Set 'Apply macro security settings to macros, add- ins and additional actions' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.8 Set 'Automatically download content for e- mail from people in Safe Senders and Safe Recipients Lists' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.9 Audit Docker files and directories - /var/lib/docker | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.13 Set 'Display pictures and external content in HTML e- mail' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.15 Audit Docker files and directories - /etc/sysconfig/docker-network | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.16 Audit Docker files and directories - /etc/sysconfig/docker-registry | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.16 Set 'Do not allow Outlook object model scripts to run for shared folders' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.26 Set 'Remove file extensions blocked as Level 1' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.30 Set 'Synchronize Outlook RSS Feeds with Common Feed List' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.33 Set 'Use this format:' to 'Enabled:Convert to Plain Text format' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 1.35 Set 'When executing a custom action:' to 'Enabled:Automatically Deny' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.2 Ensure Basic Registry and Quick Start security Registry are Removed | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.6 Set 'Do not display 'Publish to GAL' button' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.11 Set 'Indicate a missing CRL as a(n):' to 'Enabled:Error' | CIS MS Office Outlook 2010 v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.15 Set 'Send all signed messages as clear signed messages' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1 Set 'Automatically configure profile based on Active Directory Primary SMTP address' to 'Enabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 3.2 Ensure JDK Security Manager is Enabled | CIS IBM WebSphere Liberty v1.0.0 L2 | Unix | ACCESS CONTROL |
| 3.8 Verify that Docker environment file permissions are set to 644 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.23 Verify that Docker server certificate key file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.25 Verify that Docker socket file ownership is set to root:docker - /var/run/docker.sock | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.26 Verify that Docker socket file permissions are set to 660 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.1.1.3 Ensure 'cookieDomain' cookie domain name attribute is set for the session cookies. | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.5 Ensure 'ssoCookieName' LTPA cookie name is set | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.6 Ensure 'httpOnlyCookies' HttpOnly attribute is set to 'True' for the authentication cookies | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.8 Ensure 'cookieName' JWT (JSON Web Token) cookie name is set | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.2 Set 'Prevent users from changing permissions on rights managed content' to 'Disabled' | CIS MS Office Outlook 2010 v1.0.0 | Windows | ACCESS CONTROL |
| 4.2.3 Ensure HSTS (HTTP Strict Transport Security) is enabled | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.6 Ensure 'transport-guarantee' is set to 'CONFIDENTIAL' for all web applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.9 Ensure 'ocsp.enable' certificate revocation is set to 'true' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.14 Ensure SP800-131a recommendation is used for stronger cryptographic keys and more robust algorithms. | CIS IBM WebSphere Liberty v1.0.0 L2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.5 Ensure 'hostNameVerificationEnabled' is set to 'true' in OIDC Relying Party (RP) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.11 Ensure 'allowPublicClients' is set to 'false' in OAuth 2.0 | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.4 Rebuild the images to include security patches | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.4.3 Ensure 'logoutPageRedirectDomainNames' is set to relevant domain names for logout page redirects | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.4.8 Ensure 'addressExcludeList' is set to the IP addresses to be excluded for web traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.9 Ensure ''trustedSensitiveHeaderOrigin'' is set to trusted host names and IP addresses for sensitive data | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 4.4.10 Ensure 'trustedHeaderOrigin' is set to trusted host names and IP addresses | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 4.4.23 Ensure virtual hosts are Defined to isolate JMX communication and application traffic | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.14 Set 'Configure Outlook object model prompt when executing Save As: Guard behavior:' to 'Enabled:Automatically Deny' | CIS MS Office Outlook 2010 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 5.7 Do not run ssh within containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.14 Bind incoming container traffic to a specific host interface | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.15 Set the 'on-failure' container restart policy to 5 - RestartPolicyName=on-failure | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2 Ensured 'HashPassword' is set in UsernameToken WS-Security policy | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3 Ensure CallbackHandler is used to access private keys in keystore files | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5 Use a centralized and remote log collection service | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | AUDIT AND ACCOUNTABILITY |
| 6.6 Avoid image sprawl | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 7.2 Ensure the 'hostNameIncludeList attribute' is set to a whitelist of host names | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 Ensure the 'addressExcludeList' attribute is set to a whitelist of hostnames | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 10.4 Ensure 'keysPassword' is set to a custom password for ltpa keys | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
