| 4.2 Ensure device enrollment for personally owned devices is blocked by default | CIS Microsoft 365 Foundations v7.0.0 L1 E5 | microsoft_azure | CONFIGURATION MANAGEMENT |
| 4.6.8.1 Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.6.8.2 Ensure 'Turn on Responder (RSPNDR) driver' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.20.1.1 Ensure 'Turn off access to the Store' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.20.1.4 Ensure 'Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.40.5.1 Ensure 'Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.3.2 Ensure 'Block launching Universal Windows apps with Windows Runtime API access from hosted content.' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.7.1.4 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.7 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.2 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Key' is set to 'Enabled: Do not allow 256-bit recovery key' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.3 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.5 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS:' is set to 'Enabled: Store recovery passwords and key packages' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.7 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.3.2 Ensure 'Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 4.11.7.4 Ensure 'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives' is set to 'XTS-AES 128-bit (default)' or 'XTS-AES 256-bit' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.35.4.3.4 Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.41.2 Ensure 'Turn off the Store application' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.48.1 Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.53.1 Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.55.1 Ensure 'Allow Remote Shell Access' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 8.1 Ensure 'Require Device Encryption' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.2 Ensure 'Allow Warning For Other Disk Encryption' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.3 Ensure 'Allow Warning For Other Disk Encryption: Allow Standard User Encryption' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.24.1 Ensure 'EMET 5.52' or higher is installed | CIS Windows 7 Workstation Level 1 v3.2.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.24.1 Ensure 'EMET 5.52' or higher is installed | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.25.1 (L1) Ensure 'EMET 5.52' or higher is installed | CIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.3.1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.25.1 (L1) Ensure 'EMET 5.52' or higher is installed | CIS Microsoft Windows Server 2008 Member Server Level 1 v3.3.1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 23.1 Ensure 'Configure System Guard Launch' is set to 'Unmanaged Enables Secure Launch if supported by hardware' | CIS Microsoft Intune for Windows 10 v5.0.0 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 23.3 Ensure 'Enable Virtualization Based Security' is set to 'Enable virtualization based security' | CIS Microsoft Intune for Windows 10 v5.0.0 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 23.4 Ensure 'Require Platform Security Features' is set to 'Turns on VBS with Secure Boot' or higher | CIS Microsoft Intune for Windows 10 v5.0.0 NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 47.1 Ensure 'Disallow KMS Client Online AVS Validation' is set to 'Allow' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 49.5 Ensure 'Devices: Prevent users from installing printer drivers when connecting to shared printers' is set to 'Enable' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 81.2 Ensure 'Allow Location' is set to 'Force Location Off...' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.1 Ensure 'Bluetooth Audio Gateway Service (BTAGService)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.10 Ensure 'Link-Layer Topology Discovery Mapper (lltdsvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.16 Ensure 'Peer Networking Grouping (p2psvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.22 Ensure 'Remote Desktop Configuration (SessionEnv)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.35 Ensure 'Windows Error Reporting Service (WerSvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.36 Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| DKER-EE-001800 - The insecure registry capability in the Docker Engine - Enterprise component of Docker Enterprise must be disabled. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-001870 - The Docker Enterprise self-signed certificates in Universal Control Plane (UCP) must be replaced with DoD trusted, signed certificates. | DISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2 | Unix | CONFIGURATION MANAGEMENT |
| MSFT-11-002300 - Microsoft Android 11 must be configured to disable trust agents. | AirWatch - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-002300 - Microsoft Android 11 must be configured to disable trust agents. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-002800 - Microsoft Android 11 must be configured to disable developer modes. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
