| 1.1 Ensure device firmware is up to date | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | |
| 1.1.2 Ensure that the API server pod specification file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.3 - AirWatch - Enable 'Require alphanumeric value' | AirWatch - CIS Google Android 4 v1.0.0 L1 | MDM | IDENTIFICATION AND AUTHENTICATION |
| 1.1.5 - AirWatch - Remove Entries in 'Wi-Fi' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.5 - MobileIron - Remove Entries in 'Wi-Fi' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.7 - MobileIron - Disable 'Wi-Fi' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.8 - MobileIron - Disable 'Bluetooth' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.9 - AirWatch - Disable 'Location Services' - WiFi Location Services | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.9 - MobileIron - Disable 'Location Services' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.10 - AirWatch - Enable 'Airplane Mode' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.10 - MobileIron - Enable 'Airplane Mode' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.1.13 Ensure that the admin.conf file permissions are set to 600 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.15 - MobileIron - Enable 'Encrypt phone' | MobileIron - CIS Google Android 4 v1.0.0 L1 | MDM | ACCESS CONTROL |
| 1.1.17 - MobileIron - Disable 'Unknown sources' - Samsung SAFE | MobileIron - CIS Google Android 4 v1.0.0 L1 | MDM | ACCESS CONTROL |
| 1.2 Ensure 'Screen Lock' is set to Enabled | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | ACCESS CONTROL |
| 1.2.2 - MobileIron - Enable 'Show security warnings' - 'Samsung SAFE' | MobileIron - CIS Google Android 4 v1.0.0 L1 | MDM | ACCESS CONTROL |
| 1.2.5 - AirWatch - Enable 'Block pop-ups' | AirWatch - CIS Google Android 4 v1.0.0 L1 | MDM | ACCESS CONTROL |
| 1.2.6 - MobileIron - Disable 'plug-ins' - 'Samsung SAFE' | MobileIron - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 1.4 Host hardware must enable and configure a TPM 2.0 | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.5 Host integrated hardware management controller must be secure | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.7 Host integrated hardware management controller must enable remote logging of events | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | AUDIT AND ACCOUNTABILITY |
| 1.13 Ensure 'Smart Lock' is set to Disabled | MobileIron - CIS Google Android 7 v1.0.0 L2 | MDM | CONFIGURATION MANAGEMENT |
| 1.17 Ensure 'Automatic date & time' and 'Automatic time zone' are set to Enabled | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | |
| 1.17 Ensure 'Automatic date & time' and 'Automatic time zone' are set to Enabled | MobileIron - CIS Google Android 7 v1.0.0 L1 | MDM | |
| 1.19 Ensure 'Allow remote lock and erase' is set to Enabled | MobileIron - CIS Google Android 7 v1.0.0 L1 | MDM | |
| 1.22 Ensure 'Ask for unlock pattern/PIN/password before unpinning' is set to Enabled | MobileIron - CIS Google Android 7 v1.0.0 L1 | MDM | |
| 1.24 Ensure 'Wi-Fi assistant' is set to Disabled | MobileIron - CIS Google Android 7 v1.0.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.1.4 - AirWatch - Set the 'minimum number of character sets' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | ACCESS CONTROL |
| 2.1.7 - AirWatch - Set the 'number of days' for 'maximum password age' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | IDENTIFICATION AND AUTHENTICATION |
| 2.1.8 - AirWatch - Set the 'number of passwords' for 'password history' | AirWatch - CIS Google Android 4 v1.0.0 L2 | MDM | IDENTIFICATION AND AUTHENTICATION |
| 2.7 Ensure 'Voice & Audio Activity' is set to Disabled | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.7 Ensure 'Voice & Audio Activity' is set to Disabled | MobileIron - CIS Google Android 7 v1.0.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.8 Ensure 'YouTube Search History' is set to Disabled | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 2.10 Ensure 'Google Location History' is set to Disabled | AirWatch - CIS Google Android 7 v1.0.0 L1 | MDM | CONFIGURATION MANAGEMENT |
| 3.2 Host must deactivate the ESXi shell | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 3.14 Host must configure the password history setting to restrict the reuse of passwords | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | IDENTIFICATION AND AUTHENTICATION |
| 3.15 Host must be configured with an appropriate maximum password age | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | IDENTIFICATION AND AUTHENTICATION |
| 3.16 Host must configure a session timeout for the API | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6 Host should reject forged transmits on standard virtual switches and port groups | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.9 Host must restrict access to a default or native VLAN on standard virtual switches | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10 Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.5.4 Host SSH daemon, if enabled, must not allow host-based authentication | CIS VMware ESXi 9.0 v1.0.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 6.5.12 Host SSH daemon, if enabled, must not permit user environment settings | CIS VMware ESXi 9.0 v1.0.0 L1 Unix | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 7.13 Virtual machines must remove unnecessary serial port devices | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.15 Virtual machines must remove unnecessary CD/DVD devices | CIS VMware ESXi 9.0 v1.0.0 L2 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.18 Virtual machines must deactivate console copy operations | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
| 7.20 Virtual machines must limit access through the "dvfilter" network API | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.22 Virtual machines must deactivate virtual disk wiping operations | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 7.24 Virtual machines must not be able to obtain host information from the hypervisor | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 8.12 VMware Tools must limit the use of MSI transforms when reconfiguring VMware Tools | CIS VMware ESXi 9.0 v1.0.0 L1 VMware | VMware | CONFIGURATION MANAGEMENT |
