| 1.1.1.2 Ensure mounting of squashfs filesystems is disabled | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.10 Ensure usb-storage kernel module is not available | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.2.5.1 Ensure separate partition exists for /var/tmp | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.5.1 Ensure separate partition exists for /var/log | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.7.1 Ensure separate partition exists for /home | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.24 Disable USB Storage - lsmod | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.3 Disable MySQL Command History | CIS MySQL 5.7 Community Windows OS L2 v2.0.0 | Windows | MEDIA PROTECTION |
| 1.5 Ensure Interactive Login is Disabled | CIS MySQL 5.7 Community Windows OS L2 v2.0.0 | Windows | ACCESS CONTROL |
| 1.5 Ensure Interactive Login is Disabled | CIS MySQL 5.7 Enterprise Linux OS L2 v2.0.0 | Unix | ACCESS CONTROL |
| 1.6.1.4 Ensure all AppArmor Profiles are enforcing - unconfined | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | ACCESS CONTROL |
| 1.7.4 Ensure GDM automount is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.4 Ensure CUPS is not installed | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.2.1.13 Ensure 'Allow users to accept untrusted TLS certificates' is set to 'Disabled' | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 3.4.2 Ensure 'Require alphanumeric value' is set to 'Enabled' | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | IDENTIFICATION AND AUTHENTICATION |
| 3.4.2 Ensure SCTP is disabled - lsmod | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.3 Ensure RDS is disabled - lsmod | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.3 Ensure RDS is disabled - modprobe | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.4 Ensure TIPC is disabled - lsmod | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.4 Ensure TIPC is disabled - modprobe | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.1.1.2 Ensure auditd service is enabled | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.2 Ensure audit logs are not automatically deleted | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure 'App Privacy Report' is enabled | MobileIron - CIS Apple 18 v2.0.0 L2 Institutionally Owned | MDM | CONFIGURATION MANAGEMENT |
| 4.1.8 Avoid binding RBAC roles to unauthenticated users and groups | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM | CIS Ubuntu Linux 16.04 LTS Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.3 Ensure 'allow-suspicious-udfs' Is Set to 'OFF' - /etc/my.cnf | CIS MySQL 5.6 Enterprise Linux OS L2 v2.0.0 | Unix | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'allow-suspicious-udfs' Is Set to 'OFF' - %PROGRAMDATA%\MySQL\MySQL Server 5.6\my.ini | CIS MySQL 5.6 Enterprise Windows OS L2 v2.0.0 | Windows | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'allow-suspicious-udfs' Is Set to 'OFF' - %WINDIR%\my.ini | CIS MySQL 5.6 Community Windows OS L2 v2.0.0 | Windows | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'allow-suspicious-udfs' Is Set to 'OFF' - C:\my.ini | CIS MySQL 5.7 Enterprise Windows OS L2 v2.0.0 | Windows | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'allow-suspicious-udfs' Is Set to 'OFF' - config files not found | CIS MySQL 5.6 Community Linux OS L2 v2.0.0 | Unix | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 4.3.1 Use NetworkPolicy with built in GKE Dataplane V2 enforcement | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.3 Require hardened security contexts for all workload Pods and containers | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 5.2.13 Ensure SSH AllowTcpForwarding is disabled | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.4.3 Use DNS based access or private GKE control plane endpoints | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6.1 Use CMEK protected StorageClasses for GKE Persistent Disk volumes | CIS Google Kubernetes Engine GKE Autopilot v2.0.0 L2 | GCP | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.1.2 Ensure auditd service is enabled and active | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.4 Ensure system warns when audit logs are low on space | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.6 Ensure events that modify /etc/issue and /etc/issue.net are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.9 Ensure events that modify /etc/netplan are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.18 Ensure discretionary access control permission modification events are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.30 Ensure the running and on disk configuration is the same | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.4.1 Ensure the audit log file directory mode is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.4 Ensure audit log files group owner is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.7 Ensure audit configuration files group owner is configured | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 8.4.10 (L2) Ensure Drag and Drop Version Set is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 8.4.19 (L2) Ensure Guest Host Interaction Launch Menu is disabled | CIS VMware ESXi 7.0 v1.5.0 L2 | VMware | CONFIGURATION MANAGEMENT |
| 18.10.43.12.1 (L2) Ensure 'Configure Watson events' is set to 'Disabled' | CIS Microsoft Windows Server 2016 v4.0.0 L2 MS | Windows | SECURITY ASSESSMENT AND AUTHORIZATION |
| 18.10.59.4 (L2) Ensure 'Allow search highlights' is set to 'Disabled' | CIS Microsoft Windows Server 2016 v4.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
