| 1.1.2 Ensure that the --basic-auth-file argument is not set | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.6 Ensure that the --insecure-port argument is set to 0 | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.27 Ensure that the admission control plugin ServiceAccount is set | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | ACCESS CONTROL |
| 1.1.27 Ensure that the admission control policy is set to ServiceAccount | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | ACCESS CONTROL |
| 1.2.2 Ensure that the --token-auth-file parameter is not set | CIS Kubernetes v2.0.1 L1 Master Node | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 1.2.8 Ensure that the --authorization-mode argument includes RBAC | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.2.15 Ensure that the admission control plugin PodSecurityPolicy is set | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.22 Ensure that the --service-account-key-file argument is set as appropriate | CIS Kubernetes v2.0.1 L1 Master Node | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.4 APPL-14-000005 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | ACCESS CONTROL |
| 1.6.1 Ensure that the cluster-admin role is only used where required | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.191 WN19-MS-000010 | CIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT I | Windows | ACCESS CONTROL |
| 1.191 WN22-MS-000010 | CIS Microsoft Windows Server 2022 STIG v3.0.0 MS CAT I | Windows | ACCESS CONTROL |
| 2.1.3 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | ACCESS CONTROL |
| 2.1.4 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.1.5 Ensure that the --read-only-port argument is set to 0 | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.10 Ensure that the --hostname-override argument is not set | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.2.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.6 Ensure that the --peer-auto-tls argument is not set to true | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.6 Ensure that the --peer-auto-tls argument is not set to true | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.6 Ensure that the --peer-auto-tls argument is not set to true | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION |
| 3.1.6 Ensure that the --secure-port argument is not set to 0 | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.6 Ensure that the --secure-port argument is not set to 0 | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1.7 Ensure that the --profiling argument is set to false | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 3.1.9 Ensure that the admission control policy is set to NamespaceLifecycle | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | ACCESS CONTROL |
| 3.1.11 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.1.14 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | ACCESS CONTROL |
| 3.1.15 Ensure that the --token-auth-file parameter is not set | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 3.1.15 Ensure that the --token-auth-file parameter is not set | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 3.2.2 Ensure that the audit policy covers key security concerns | CIS Kubernetes v2.0.1 L2 Master Node | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.10 Ensure that the --rotate-certificates argument is not set to false | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.13 Ensure that a limit is set on pod PIDs | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | SYSTEM AND SERVICES ACQUISITION |
| 4.3.2 Ensure that all Namespaces have Network Policies defined | CIS Google Kubernetes Engine GKE v1.9.0 L2 GCP | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.5.4 When creating New Clusters - Automate GKE version management using Release Channels | CIS Google Kubernetes Engine GKE v1.9.0 L1 GCP | GCP | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| APPL-14-000005 - The macOS system must configure user session lock when a smart token is removed. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | ACCESS CONTROL |
| DISA_STIG_SharePoint_2010_v1r9.audit from DISA SharePoint 2010 v1r9 | DISA STIG SharePoint 2010 v1r9 | Windows | |
| PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - PIV credentials | DISA Palo Alto Networks NDM STIG v3r4 | Palo_Alto | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| SQL6-D0-013400 - SQL Server must generate audit records when successful and unsuccessful attempts to add privileges/permissions occur. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL6-D0-013600 - SQL Server must generate audit records when successful and unsuccessful attempts to modify privileges/permissions occur. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL6-D0-014200 - SQL Server must generate audit records when successful and unsuccessful attempts to delete privileges/permissions occur. | DISA MS SQL Server 2016 Instance STIG v3r6 MS_SQLDB | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| VCRP-67-000009 - The rhttpproxy log files must be moved to a permanent repository in accordance with site policy. | DISA STIG VMware vSphere 6.7 RhttpProxy v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| WN10-00-000070 - Only accounts responsible for the administration of a system must have Administrator rights on the system. | DISA Microsoft Windows 10 STIG v3r6 | Windows | ACCESS CONTROL |
| WN11-00-000070 - Only accounts responsible for the administration of a system must have Administrator rights on the system. | DISA Microsoft Windows 11 STIG v2r8 | Windows | ACCESS CONTROL |
| WN12-GE-000004-MS - Only administrators responsible for the member server must have Administrator rights on the system. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | ACCESS CONTROL |
