| 1.2 Ensure only required packages are installed | CIS PostgreSQL 17 v1.1.0 L1 Database Unix | Unix | CONFIGURATION MANAGEMENT |
| 1.5 Ensure Install Security Responses and System Files Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.3.4.2 Ensure Time Machine Volumes Are Encrypted If Time Machine Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONTINGENCY PLANNING, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.7 (L1) Ensure 'Control use of insecure content exceptions' is set to 'Enabled: Do not allow any site to load mixed content' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4.2 (L1) Ensure 'Configure allowed app/extension types' is set to 'Enabled: extension, hosted_app, platform_app, theme' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.5.1.1 Ensure External Intelligence Extensions Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.1.2 Ensure Writing Tools Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.1.3 Ensure Mail Summarization Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.1.4 Ensure Notes Summarization Is Disabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.3 Ensure 'Settings for AI-powered History Search' Is Set to 'Enabled: Allow AI history search without improving AI models.' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 2.11.2 Ensure Require Password After Screen Saver Begins or Display Is Turned Off Is Enabled for 5 Seconds or Immediately | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.14.5 (L1) Ensure 'Configure the required domain names for remote access clients' is set to 'Enabled' with a domain defined | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.15.1 (L1) Ensure 'Configure the list of domains on which Safe Browsing will not trigger warnings' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.15.2 (L1) Ensure 'Safe Browsing Protection Level' is set to 'Enabled: Safe Browsing is active in the standard mode.' or higher | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.15.3 (L1) Ensure 'Disable proceeding from the Safe Browsing warning page' is set to 'Enabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.22 (L1) Ensure 'Enable alternate error pages' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.43 (L1) Ensure 'Enable online OCSP/CRL checks' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.57 (L1) Ensure 'Import of homepage from default browser on first run' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.58 (L1) Ensure 'Import saved passwords from default browser on first run' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.59 (L1) Ensure 'Import search engines from default browser on first run' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 3.1.8 Ensure the maximum log file lifetime is set correctly | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.10 Ensure the correct Syslog facility is selected | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.11 Ensure Syslog messages are not suppressed | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.16 Ensure 'debug_print_parse' is disabled | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.1 Restrict access to $CATALINA_HOME | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 4.3 Ensure excessive administrative privileges are revoked | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.5 Restrict access to Tomcat temp directory | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.5 Restrict access to Tomcat temp directory | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 4.8 Restrict access to Tomcat catalina.properties | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.9 Restrict access to Tomcat catalina.properties | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 4.11 Restrict access to Tomcat logging.properties | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 5.2.1 Ensure Password Account Lockout Threshold Is Configured | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | ACCESS CONTROL |
| 5.10 Ensure XProtect Is Running and Updated | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 6.3.3 Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3.7 Ensure Show Full Website Address in Safari Is Enabled | CIS Apple macOS 26 Tahoe v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.4 Ensure secure is set to true only for SSL-enabled Connectors | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.4 Ensure secure is set to true only for SSL-enabled Connectors - verify secure is set to true | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.2 Specify file handler in logging.properties (check if java.util.logging.ConsoleHandler exists in web application) | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.2 Specify file handler in logging.properties (check if org.apache.juli.FileHandler exists in default) | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.2 Specify file handler in logging.properties files - check if org.apache.juli.FileHandler exists in default | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.2 Specify file handler in logging.properties files - check if org.apache.juli.FileHandler exists in web application | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.2 Specify file handler in logging.properties files - check if org.apache.juli.FileHandler logging is enabled in web application | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.6 Ensure directory in logging.properties is a secure location - check log directory location | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 8.1 Ensure PostgreSQL subdirectory locations are outside the data cluster | CIS PostgreSQL 17 v1.1.0 L1 Database PostgreSQLDB | PostgreSQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 9.1 Starting Tomcat with Security Manager | CIS Apache Tomcat 10 L1 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.7 Turn off session facade recycling | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.15 Do not run applications as privileged | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 10.16 Do not allow cross context requests | CIS Apache Tomcat 7 L1 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.18 Setting Security Lifecycle Listener - check for umask uncommented in startup | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.19 Use the logEffectiveWebXml and metadata-complete settings for deploying applications in production - context.xml | CIS Apache Tomcat 8 L1 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
