| 1.1 Ensure All Apple-provided Software Is Current | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 1.3 Ensure Download New Updates When Available Is Enabled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Ensure Install Application Updates from the App Store Is Enabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.6 Ensure auditing is configured for Docker files and directories - /var/lib/docker | CIS Docker Community Edition v1.1.0 L1 Linux Host OS | Unix | AUDIT AND ACCOUNTABILITY |
| 1.13 Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc | CIS Docker Community Edition v1.1.0 L1 Linux Host OS | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1.2 Ensure the Time Service Is Enabled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.4.1 Ensure an Inactivity Interval of 20 Minutes Or Less for the Screen Saver Is Enabled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL |
| 2.4.4 Ensure Login Window Displays as Name and Password Is Enabled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.5.1 Ensure Users' Accounts Do Not Have a Password Hint | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 3.4 Ensure Security Auditing Retention Is Enabled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.5 Ensure Access to Audit Records Is Controlled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3 Ensure NFS Server Is Disabled | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure NFS Server Is Disabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.1.3 Ensure Signed System Volume (SSV) Is Enabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.4 Ensure Appropriate Permissions Are Enabled for System Wide Applications | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.5 Ensure No World Writable Folders Exist in the System Folder | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.3 Ensure the Sudo Timeout Period Is Set to Zero | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL |
| 5.6 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session | CIS Apple macOS 14.0 Sonoma Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL |
| 5.7 Ensure an Administrator Account Cannot Log In to Another User's Active and Locked Session | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL |
| 17.5.3 Ensure 'Audit Logoff' is set to include 'Success' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.4 Ensure 'Audit MPSSVC Rule-Level Policy Change' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.5 Ensure 'Audit Other Policy Change Events' is set to include 'Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.3 Ensure 'Audit Security State Change' is set to include 'Success' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.1.1.2 Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.4.2 Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.4.5 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.6 Ensure 'NetBT NodeType configuration' is set to 'Enabled: P-node (recommended)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.11.2 Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.11.4 Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.6.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication', 'Require Integrity', and 'Require Privacy' set for all NETLOGON and SYSVOL shares' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.7.6 Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.7.9 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.7.12 Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.19.2 Ensure 'Configure security policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.19.4 Ensure 'Continue experiences on this device' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.6.1 Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.13.1 Ensure 'Turn off cloud consumer account state content' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.57.3.9.4 Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.10.1 Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.58.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.59.3 Ensure 'Allow indexing of encrypted files' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.82.1 Ensure 'Allow user control over installs' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.90.1.3 Ensure 'Disallow Digest authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| SQL2-00-003900 - SQL Server must not grant users direct access to the Unsafe assembly permission. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
| SQL2-00-006400 - SQL Server must not grant users direct access to the Authenticate server permission. | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | ACCESS CONTROL |
