| 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2 Ensure that the API server pod specification file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.6 Ensure that the --insecure-bind-address argument is not set | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.7 Ensure that the --secure-port argument is not set to 0 | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.8 Ensure that the --repair-malformed-updates argument is set to false | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.9 Ensure that the --repair-malformed-updates argument is set to false | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.14 Ensure that the admin.conf file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.14 Ensure that the admin.conf file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.15 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.20 Ensure that the --kubelet-https argument is set to true | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.34 Ensure that the encryption provider is set to aescbc | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | |
| 1.1.35 Ensure that the encryption provider is set to aescbc | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | |
| 1.2.7 Ensure that the --authorization-mode argument includes Node | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.18 Ensure that the --insecure-port argument is set to 0 | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 1.2.25 Ensure that the --request-timeout argument is set as appropriate | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | |
| 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | |
| 1.5.2 Ensure that the --client-cert-auth argument is set to true | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.5.2 Ensure that the --client-cert-auth argument is set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.5.3 Ensure that the --auto-tls argument is not set to true | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.5.3 Ensure that the --auto-tls argument is not set to true | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - peer-cert-file | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.7.2 Do not admit containers wishing to share the host process ID namespace | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.7.3 Do not admit containers wishing to share the host IPC namespace | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.7.5 Do not admit containers with allowPrivilegeEscalation | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.7.7 Do not admit containers with dangerous capabilities | CIS Kubernetes 1.11 Benchmark v1.3.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.6.2 Ensure that the seccomp profile is set to RuntimeDefault in the pod definitions | CIS Google Kubernetes Engine GKE v1.9.0 L2 GCP | GCP | CONFIGURATION MANAGEMENT |
| 5.3.1 Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS | CIS Google Kubernetes Engine GKE v1.9.0 L2 GCP | GCP | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions | CIS Red Hat OpenShift Container Platform v1.9.0 L2 OpenShift | OpenShift | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 5.9.2 Enable Customer-Managed Encryption Keys (CMEK) for Boot Disks | CIS Google Kubernetes Engine GKE v1.9.0 L2 GCP | GCP | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| CNTR-R2-000110 - The Kubernetes Kubelet must have anonymous authentication disabled. | DISA Rancher Government Solutions RKE2 STIG v2r7 | Unix | ACCESS CONTROL |
| MD4X-00-006600 - MongoDB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs. | DISA STIG MongoDB Enterprise Advanced 4.x v1r4 OS | Unix | CONFIGURATION MANAGEMENT |
| OH12-1X-000233 - OHS hosted web sites must utilize ports, protocols, and services according to PPSM guidelines. | DISA STIG Oracle HTTP Server 12.1.3 v2r3 | Unix | CONFIGURATION MANAGEMENT |
| SHPT-00-000600 - SharePoint managed service accounts must be set to enable automatic password change. | DISA STIG SharePoint 2010 v1r9 | Windows | IDENTIFICATION AND AUTHENTICATION |
| TCAT-AS-000470 - Stack tracing must be disabled. | DISA STIG Apache Tomcat Application Server 9 v3r4 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG610 W22 - Web sites must utilize ports, protocols, and services according to PPSM guidelines. | DISA STIG Apache Site 2.2 Windows v1r13 | Windows | |
