| 1.3.3 Ensure that the --use-service-account-credentials argument is set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 1.11 SQLD-22-001700 | CIS Microsoft SQL Server 2022 Database STIG v1.0.0 CAT II | MS_SQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1.7 Ensure that the --protect-kernel-defaults argument is set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.11 Ensure that the --event-qps argument is set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.11 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - tls-private-key-file | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.12 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - tls-cert-file | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.13 Ensure that the --cadvisor-port argument is set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 3.1.1 Ensure that the kubeconfig file permissions are set to 644 or more restrictive | CIS Google Kubernetes Engine GKE v2.0.0 L1 Unix | Unix | ACCESS CONTROL, SECURITY ASSESSMENT AND AUTHORIZATION, MEDIA PROTECTION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 3.2.2 Ensure that the audit policy covers key security concerns | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | AUDIT AND ACCOUNTABILITY |
| 3.2.2 Ensure that the audit policy covers key security concerns | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1 Create CIS Audit Class | CIS Solaris 11.2 L1 v1.1.0 | Unix | ACCESS CONTROL |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.8 Ensure that the --hostname-override argument is not set | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | CONFIGURATION MANAGEMENT |
| 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique keys | CIS BIND DNS v3.0.1 Caching Only Name Server | Unix | CONFIGURATION MANAGEMENT |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique keys | CIS BIND DNS v3.0.1 Authoritative Name Server | Unix | CONFIGURATION MANAGEMENT |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique keys | CIS BIND DNS v1.0.0 L1 Authoritative Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique keys | CIS BIND DNS v1.0.0 L1 Caching Only Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique secret | CIS BIND DNS v1.0.0 L1 Caching Only Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique secret | CIS BIND DNS v3.0.1 Caching Only Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique secret | CIS BIND DNS v3.0.1 Authoritative Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3 Use Unique Keys for Each Pair of Hosts - unique secret | CIS BIND DNS v1.0.0 L1 Authoritative Name Server | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1 Inter-node Encryption | CIS Apache Cassandra 3.11 L2 Unix Audit v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.1 Use custom least privilege service accounts for GKE node pools | CIS Google Kubernetes Engine GKE v2.0.0 L1 GCP | GCP | IDENTIFICATION AND AUTHENTICATION |
| 5.2.10 Minimize the admission of containers with capabilities assigned | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.3.2 Ensure that all Namespaces have Network Policies defined | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Prefer using secrets as files over secrets as environment variables | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.1 Prefer using secrets as files over secrets as environment variables | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.4.2 Consider external secret storage | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.5.2 Verify node auto-repair is enabled for GKE node pools | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | RISK ASSESSMENT |
| 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.7.4 The default namespace should not be used | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.4 The default namespace should not be used | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.2.9 Rotate the Master Key | CIS IBM DB2 12.1 v1.0.0 Database Level 2 | IBM_DB2DB | IDENTIFICATION AND AUTHENTICATION |
| 8.2.9 Rotate the Master Key | CIS IBM DB2 11 v1.2.0 Database Level 2 | IBM_DB2DB | IDENTIFICATION AND AUTHENTICATION |
| 8.2.12 Retain All Master Keys | CIS IBM DB2 12.1 v1.0.0 Database Level 2 | IBM_DB2DB | CONTINGENCY PLANNING |
| 8.2.12 Retain All Master Keys | CIS IBM DB2 11 v1.2.0 Database Level 2 | IBM_DB2DB | CONTINGENCY PLANNING |
| CIS_Google_Kubernetes_Engine_GKE_v2.0.0_L1_Unix.audit from CIS Google Kubernetes Engine GKE v2.0.0 | CIS Google Kubernetes Engine GKE v2.0.0 L1 Unix | Unix | |
| CNTR-K8-000440 - The Kubernetes kubelet staticPodPath must not enable static pods. | DISA Kubernetes STIG v2r6 | Unix | ACCESS CONTROL |
| CNTR-K8-002001 - Kubernetes must enable PodSecurity admission controller on static pods and Kubelets. | DISA Kubernetes STIG v2r6 | Unix | ACCESS CONTROL |
| DKER-EE-001900 - The Create repository on push option in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise. | DISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-001920 - Periodic data usage and analytics reporting in Docker Trusted Registry (DTR) must be disabled in Docker Enterprise. | DISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r2 | Unix | CONFIGURATION MANAGEMENT |
