| 1.1.1.3 Ensure mounting of udf filesystems is disabled | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.6 Ensure mounting of squashfs filesystems is disabled | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 1.1.7 Ensure separate partition exists for /var/tmp | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.7.1 Ensure separate partition exists for /home | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.11 Ensure separate partition exists for /var/log | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.12 Ensure separate partition exists for /var/log/audit | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.6.2.1 Ensure SELinux is not disabled in bootloader configuration - enforcing=0 | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | ACCESS CONTROL |
| 1.6.2.2 Ensure the SELinux state is enforcing | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | ACCESS CONTROL |
| 1.6.2.6 Ensure no unconfined daemons exist | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.8.6 Ensure GDM automatic mounting of removable media is disabled | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION |
| 1.8.7 Ensure GDM disabling automatic mounting of removable media is not overridden | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.1.6 Ensure RDS is disabled | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 4.1.1.1 Ensure auditd is installed | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.2 Ensure auditd service is enabled | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.2 Ensure system is disabled when audit logs are full - 'action_mail_acct = root' | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.4 Ensure audit_backlog_limit is sufficient | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2 Ensure auditd is installed | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.7 Ensure unsuccessful file access attempts are collected | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.5 Ensure events that modify date and time information are collected - 'auditctl adjtimex' | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.6 Ensure events that modify user/group information are collected - /etc/passwd | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - auditctl /etc/group | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - auditctl /etc/passwd | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure session initiation information is collected - utmp | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 4.1.11 Ensure discretionary access control permission modification events are collected - auditctl b32 chmod fchmod | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.11 Ensure discretionary access control permission modification events are collected - auditctl b32 chown fchown | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.11 Ensure discretionary access control permission modification events are collected - auditctl b32 setxattr | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.11 Ensure discretionary access control permission modification events are collected - b32 chmod fchmod | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.11 Ensure discretionary access control permission modification events are collected - b32 setxattr | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.11 Ensure discretionary access control permission modification events are collected - b64 chown fchown | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.12 Ensure unsuccessful unauthorized file access attempts are collected - auditctl b64 EACCES | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.18 Ensure kernel module loading and unloading is collected - rmmod | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.3.4 Ensure users must provide password for privilege escalation | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL |
| 4.5.6 Ensure nologin is not listed in /etc/shells | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.6.4 Avoid deploying workloads in the default namespace | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.2 Grant least privilege IAM access to Artifact Registry repositories | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.1.2 Ensure auditd service is enabled and active | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.1.3 Ensure auditing for processes that start prior to auditd is enabled | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.1.4 Ensure audit_backlog_limit is sufficient | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.13 Ensure file deletion events by users are collected | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.4.2 Ensure only authorized users own audit log files | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.7 Ensure audit configuration files belong to group root | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.3.4 Ensure users must provide password for escalation | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | ACCESS CONTROL |
| 5.6.1 Enable VPC Flow Logs and Intranode Visibility | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | AUDIT AND ACCOUNTABILITY, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.6.3 Restrict GKE control plane access with authorized networks | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6.7 Use Google managed SSL certificates for GKE Ingress TLS | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.4.3.3 Ensure events that modify the sudo log file are collected | CIS Debian Linux 11 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.4.2 Ensure audit log files owner is configured | CIS Debian Linux 11 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
