| 1.1 Ensure Apple-provided Software Updates Are Installed | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.1.2.6.4 Ensure noexec option set on /var/log partition | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.2 Ensure Download New Updates When Available Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.1.10 Ensure repositories are set to https in /etc/apt/sources.list | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.3.1.1 Ensure apparmor packages are installed | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.6.11 Ensure update-notifier-motd.service is not in use | CIS Debian Linux 13 v1.1.0 L1 Server | Unix | CONFIGURATION MANAGEMENT |
| 1.7 Verify that the 'PGPASSWORD' Environment Variable is not in use | CIS PostgreSQL 17 v1.1.0 L1 Database Unix | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.2 Ensure Firewall Stealth Mode Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.1.1 Ensure AirDrop Is Disabled When Not Actively Transferring Files | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.1.2 Ensure AirPlay Receiver Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.3 (L1) Ensure 'Default clipboard setting' Is 'Enabled' to 'Deny Permissions' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.3.3.2 Ensure File Sharing Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.3.4 Ensure Remote Login Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.6 (L1) Ensure 'Default geolocation setting' is set to 'Enabled: Do not allow any site to track the users' physical location' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 2.5.2.1 Ensure Siri Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.4 Ensure 'Tab compare settings' Is Set to 'Enabled: Allow Tab Compare without improving AI models.' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.5.5 (L1) Ensure 'Configure GenAI local foundational model settings' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6.2 (L1) Ensure 'Allow Google Cast to connect to Cast devices on all IP addresses' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 2.6.3.2 Ensure Improve Siri & Dictation Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.10.3 Ensure Wake for Network Access Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.11.3 Ensure a Custom Message for the Login Screen Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.13.2 Ensure Guest Access to Shared Folders Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.13.3 Ensure Automatic Login Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.14.2 (L1) Ensure 'Enable the use of relay servers by the remote access host' is set to 'Disabled'. | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.14.6 (L1) Ensure 'Enable firewall traversal from remote access host' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.19 (L1) Ensure 'Enable deleting browser and download history' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.21 (L1) Ensure 'Allow Web Authentication requests on sites with broken TLS certificates' Is Disabled | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, AWARENESS AND TRAINING, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.30 (L1) Ensure 'Allow queries to a Google time service' is set to 'Enabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 2.41 (L1) Ensure 'Allow reporting of domain reliability related data' Is Disabled | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.53 (L1) Ensure 'List of names that will bypass the HSTS policy check' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.56 (L1) Ensure 'Import autofill form data from default browser on first run' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.66 (L1) Ensure 'Proxy settings' is set to 'Enabled' and does not contain 'ProxyMode': 'auto_detect' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.67 (L1) Ensure 'Notify a user that a browser relaunch or device restart is recommended or required' is set to 'Enabled: Show a recurring prompt to the user indication that a relaunch is required' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.77 (L1) Ensure 'Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 2.79 (L1) Ensure 'Enable or disable spell checking web service' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.95 (L1) Ensure 'Allow pages to use the built-in AI APIs' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1 Ensure Interactive Login is Disabled | CIS PostgreSQL 17 v1.1.0 L1 Database Unix | Unix | ACCESS CONTROL |
| 4.3 Ensure NFS Server Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.1.1 Ensure Home Folders Are Secure | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.2 Ensure System Integrity Protection Status (SIP) Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.1.3 Ensure Apple Mobile File Integrity (AMFI) Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 5.2.2 Ensure Password Minimum Length Is Configured | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.7 Ensure Password Age Is Configured | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL |
| 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL |
| 6.3.1 Ensure Automatic Opening of Safe Files in Safari Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 6.3.9 Audit Pop-up Windows | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.10 Ensure Show Status Bar Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.6 Ensure 'User' Runtime Parameters are Configured | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | CONFIGURATION MANAGEMENT |
| 6.8 Ensure TLS is enabled and configured correctly | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2 Ensure logging of replication commands is configured | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | ACCESS CONTROL |
