| 1.1.29 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 1.1.29 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.2 Ensure access to sensitive site features is restricted to authenticated principals only | CIS IIS 8.0 v1.5.1 Level 1 | Windows | ACCESS CONTROL |
| 3.1.1 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.2 Ensure that the proxy kubeconfig file ownership is set to root:root | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.2 Ensure the log destinations are set correctly | CIS PostgreSQL 12 DB v1.1.0 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.2 Ensure the log destinations are set correctly | CIS PostgreSQL 15 DB v1.1.0 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| 3.1.3 Ensure that the kubelet configuration file has permissions set to 644 | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.3 Ensure that a Client CA File is Configured | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.6 Ensure that the --make-iptables-util-chains argument is set to true | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.2.9 Ensure that the RotateKubeletServerCertificate argument is set to true | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1 Ensure that the cluster-admin role is only used where required | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | ACCESS CONTROL |
| 4.1.2 Minimize access to secrets | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.1.5 Ensure that Service Account Tokens are only mounted where necessary | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | CONFIGURATION MANAGEMENT |
| 4.1.6 Avoid use of system:masters group | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | ACCESS CONTROL |
| 4.1.8 Avoid bindings to system:anonymous | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | ACCESS CONTROL |
| 4.1.10 Avoid non-default bindings to system:authenticated | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | ACCESS CONTROL |
| 4.2.1 Ensure that the cluster enforces Pod Security Standard Baseline profile or stricter for all namespaces. | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | CONFIGURATION MANAGEMENT |
| 4.4.1 Prefer using secrets as files over secrets as environment variables | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.2 Consider external secret storage | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.2 Ensure that the seccomp profile is set to RuntimeDefault in the pod definitions | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 4.6.3 Apply Security Context to Pods and Containers | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 4.6.4 The default namespace should not be used | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.1 Ensure Image Vulnerability Scanning is enabled | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | RISK ASSESSMENT |
| 5.1.3 Minimize cluster access to read-only for Container Image repositories | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.4 Ensure only trusted container images are used | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 5.5.1 Ensure Container-Optimized OS (cos_containerd) is used for GKE node images | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | CONFIGURATION MANAGEMENT |
| 5.5.4 When creating New Clusters - Automate GKE version management using Release Channels | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 5.5.7 Ensure Secure Boot for Shielded GKE Nodes is Enabled | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | RISK ASSESSMENT |
| 5.6.3 Ensure Control Plane Authorized Networks is Enabled | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.6.5 Ensure clusters are created with Private Nodes | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.8.2 Manage Kubernetes RBAC users with Google Groups for GKE | CIS Google Kubernetes Engine (GKE) v1.7.0 L2 | GCP | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.10.1 Ensure Kubernetes Web UI is Disabled | CIS Google Kubernetes Engine (GKE) v1.7.0 L1 | GCP | CONFIGURATION MANAGEMENT |
| 18.9.66.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Azure Compute Microsoft Windows Server 2019 v1.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.66.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.3.1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.66.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2008 Domain Controller Level 1 v3.3.1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.66.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Azure Compute Microsoft Windows Server 2019 v1.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.66.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.66.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Azure Compute Microsoft Windows Server 2022 v1.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2016 STIG v3.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2016 STIG v3.0.0 STIG DC | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Windows Server 2016 STIG v3.0.0 STIG MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| Allow unencrypted traffic - Service - AllowUnencryptedTraffic | MSCT Windows Server 2025 DC v1.0.0 | Windows | ACCESS CONTROL |
| Allow unencrypted traffic - Service - AllowUnencryptedTraffic | MSCT Windows 11 v24H2 v1.0.0 | Windows | ACCESS CONTROL |
| Allow unencrypted traffic - Service - AllowUnencryptedTraffic | MSCT Windows Server v1909 DC v1.0.0 | Windows | ACCESS CONTROL |
| Allow unencrypted traffic - Service - AllowUnencryptedTraffic | MSCT Windows Server v2004 MS v1.0.0 | Windows | ACCESS CONTROL |
| Allow unencrypted traffic - WinRM Service | MSCT Windows Server 2019 DC v1.0.0 | Windows | ACCESS CONTROL |
| Configure Controlled folder access | MSCT Windows 11 v23H2 v1.0.0 | Windows | |
| Firewall Filter - Rate-limit authorized protocols using policers | Juniper Hardening JunOS 12 Devices Checklist | Juniper | SYSTEM AND COMMUNICATIONS PROTECTION |
| SRG-OS-000266-ESXI5 - The system must require that passwords contain at least one special character. | DISA STIG VMWare ESXi Server 5 STIG v2r1 | VMware | IDENTIFICATION AND AUTHENTICATION |
