| 1.3 Keep Docker up to date | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Remove all non-essential services from the host - running processes | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 1.5 Remove all non-essential services from the host - sockets | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | CONFIGURATION MANAGEMENT |
| 1.7 Audit Docker files and directories - /etc/docker | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.7 Ensure the WebSphere Liberty Installation is Validated | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.8 Audit Docker files and directories - docker.service | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.18 Audit Docker files and directories - /etc/default/docker | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1 Restrict network traffic between containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3 Set the logging level | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | AUDIT AND ACCOUNTABILITY |
| 2.4 Allow Docker to make changes to iptables | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5 Do not use insecure registries | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.6 Configure TLS authentication for Docker daemon --tlscert | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Configure TLS authentication for Docker daemon --tlsverify | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Setup a local registry mirror | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.7 Set default ulimit as appropriate | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Configure TLS authentication for Docker daemon '--tlscacert' | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.9 Configure TLS authentication for Docker daemon '--tlscert' | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.11 Use authorization plugin | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.17 Bind swarm services to a specific host interface | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.23 Run swarm manager in auto-lock mode | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.24 Rotate swarm manager auto-lock key periodically | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 3.3 Verify that docker-registry.service file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.3 Verify that docker.socket file ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.5 Verify that docker.socket file ownership is set to root:root | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.8 Verify that registry certificate file permissions are set to 444 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.15 Verify that Docker socket file ownership is set to root:docker | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.1.1.4 Ensure 'cookieSecure' secure attribute is set to 'true' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.3 Ensure 'setCookieSecureFlag' secure attribute is set to 'true' for the `JWT` cookie. | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2.7 Ensure 'trackLoggedOutSSOCookies' is set to 'true' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.1 Ensure 'signatureAlgorithm' asymmetric key algorithm is set for encrypting the JSON Web Tokens | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.7 Do not use update instructions alone in the Dockerfile | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.9 Use COPY instead of ADD in Dockerfile | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.2 Verify SELinux security options, if applicable | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | ACCESS CONTROL |
| 5.3 Verify that containers are running only a single main process | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.5 Do not mount sensitive host system directories on containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.5 Do not use privileged containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.9 Do not share the host's network namespace | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9 Open only needed ports on container | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.11 Set container CPU priority appropriately | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.12 Set container CPU priority appropriately | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.13 Mount container's root filesystem as read only | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.16 Do not share the host's process namespace | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.18 Override default ulimit at runtime only if needed | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.22 Do not docker exec commands with privileged option | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | |
| 5.26 Check container health at runtime | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 6.1 Perform regular security audits of your host system and containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 6.2 Monitor Docker containers usage, performance and metering | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 6.2 Monitor Docker containers usage, performance and metering | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 6.3 Endpoint protection platform (EPP) tools for containers (Not Scored) | CIS Docker 1.6 v1.0.0 L2 Docker | Unix | |
| 10.2 Ensure Passwords are Encrypted | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | MEDIA PROTECTION |
