| 1.3.2 Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices | CIS Microsoft 365 Foundations v7.0.0 L2 E5 | microsoft_azure | ACCESS CONTROL |
| 4.5.4 Ensure 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.5.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.17.1 Ensure 'Configuration of wireless settings using Windows Connect Now' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.6.17.2 Ensure 'Prohibit access of the Windows Connect Now wizards' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.9 Enable Kernel Level Auditing, Check if 'minfree:20' is set in /etc/security/audit_control. | CIS Solaris 10 L1 v5.2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.9 Enable Kernel Level Auditing, Check if 'naflags:lo,ad,ex' is set in /etc/security/audit_control. | CIS Solaris 10 L1 v5.2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.9 Enable Kernel Level Auditing, Check if 'root:lo,ad:no' is set in /etc/security/audit_user. | CIS Solaris 10 L1 v5.2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.10.9.1.3 Ensure 'Prevent installation of devices that match any of these device IDs: Prevent installation of devices that match any of these device IDs' is set to 'PCI\CC_0C0A' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 4.10.20.1.6 Ensure 'Turn off printing over HTTP' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.23.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.11.7.1.1 Ensure 'Choose how BitLocker-protected fixed drives can be recovered' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.3 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Password' is set to 'Enabled: Allow 48-digit recovery password' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.6 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.8 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.1 Ensure 'Choose how BitLocker-protected operating system drives can be recovered' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.4 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.6 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.8 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.3.1 Ensure 'Deny write access to removable drives not protected by BitLocker' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 4.11.34.1 Ensure 'Turn off Push To Install service' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.51.2.1 Ensure 'Prevent Codec Download (User)' is set to 'Enabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2019 Stand-alone v4.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 NG | Windows | CONFIGURATION MANAGEMENT |
| 27.1 Ensure 'Device Enumeration Policy' is set to 'Block all (most restrictive)' | CIS Microsoft Intune for Windows 10 v5.0.0 BL | Windows | CONFIGURATION MANAGEMENT |
| 82.6 Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.13 Ensure 'Microsoft iSCSI Initiator Service (MSiSCSI)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.18 Ensure 'PNRP Machine Name Publication Service (PNRPAutoReg)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.21 Ensure 'Remote Access Auto Connection Manager (RasAuto)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.24 Ensure 'Remote Desktop Services UserMode Port Redirector (UmRdpService)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.28 Ensure 'Server (LanmanServer)' is set to 'Disabled' | CIS Microsoft Intune for Windows 10 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| CIS Internet Explorer 11 Benchmark Version 1.0.0 | CIS IE 11 v1.0.0 | Windows | |
| CIS_Debian_Linux_11_v2.0.0_L1_Server.audit from CIS Debian Linux 11 v2.0.0 | CIS Debian Linux 11 v2.0.0 L1 Server | Unix | |
| CIS_Debian_Linux_11_v2.0.0_L2_Server.audit from CIS Debian Linux 11 v2.0.0 | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | |
| CIS_Debian_Linux_11_v2.0.0_L2_Workstation.audit from CIS Debian Linux 11 v2.0.0 | CIS Debian Linux 11 v2.0.0 L2 Workstation | Unix | |
| DKER-EE-001810 - On Linux, a non-AUFS storage driver in the Docker Engine - Enterprise component of Docker Enterprise must be used. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| ESXI-80-000223 - The ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities. | DISA VMware vSphere 8.0 ESXi STIG v2r5 VMware | VMware | CONFIGURATION MANAGEMENT |
| MSFT-11-004700 - Microsoft Android 11 must be configured to disable multi-user modes. | MobileIron - DISA Microsoft Android 11 COPE v1r2 | MDM | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| MSFT-11-006100 - Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations. | MobileIron - DISA Microsoft Android 11 COPE v1r2 | MDM | AUDIT AND ACCOUNTABILITY |
| MSFT-11-006100 - Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations. | AirWatch - DISA Microsoft Android 11 COBO v1r2 | MDM | AUDIT AND ACCOUNTABILITY |
| MSFT-11-006100 - Microsoft Android 11 must be configured to generate audit records for the following auditable events: Detected integrity violations. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | AUDIT AND ACCOUNTABILITY |
| MSFT-11-010200 - Microsoft Android 11 must be configured to disallow configuration of date and time. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | CONFIGURATION MANAGEMENT |
| MSFT-11-010200 - Microsoft Android 11 must be configured to disallow configuration of date and time. | MobileIron - DISA Microsoft Android 11 COPE v1r2 | MDM | CONFIGURATION MANAGEMENT |
| Turn on Windows Defender protection against Potentially Unwanted Applications | MSCT Windows 10 1803 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
