| 1.1.2 Ensure only trusted users are allowed to control Docker daemon | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 1.3 Ensure Docker is up to date | CIS Docker Community Edition v1.1.0 L1 Linux Host OS | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Keep Docker up to date | CIS Docker 1.11.0 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.5 Keep Docker up to date | CIS Docker 1.12.0 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.6 Only allow trusted users to control Docker daemon | CIS Docker 1.11.0 v1.0.0 L1 Linux | Unix | ACCESS CONTROL |
| 1.6 Only allow trusted users to control Docker daemon | CIS Docker 1.12.0 v1.0.0 L1 Linux | Unix | ACCESS CONTROL |
| 2.1 Do not use lxc execution driver | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.3 Allow Docker to make changes to iptables | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Do not use insecure registries | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.4 Do not use insecure registries | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.4 Ensure insecure registries are not used | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.6 Configure TLS authentication for Docker daemon --tlskey | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Ensure TLS authentication for Docker daemon is configured --tlscacert | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Ensure TLS authentication for Docker daemon is configured --tlscert | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.6 Ensure TLS authentication for Docker daemon is configured --tlsverify | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.8 Ensure TLS authentication for Docker daemon is configured | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.11 Use authorization plugin | CIS Docker 1.11.0 v1.0.0 L2 Docker | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.11 Use authorization plugin | CIS Docker 1.12.0 v1.0.0 L2 Docker | Unix | IDENTIFICATION AND AUTHENTICATION |
| 2.14 Enable live restore | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.14 Ensure live restore is Enabled | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.13 Ensure that Docker server certificate key file ownership is set to root:root | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.13 Verify that Docker server certificate key file ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.14 Ensure that Docker server certificate key file permissions are set to 400 | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.14 Verify that Docker server certificate key file permissions are set to 400 | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.16 Ensure that Docker socket file permissions are set to 660 or more restrictive | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.16 Ensure that the Docker socket file permissions are set to 660 or more restrictively | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.16 Verify that Docker socket file permissions are set to 660 or more restrictive | CIS Docker 1.11.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.20 Ensure that /etc/default/docker file permissions are set to 644 or more restrictive | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.20 Verify that /etc/default/docker file permissions are set to 644 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.24 Verify that Docker server certificate key file permissions are set to 400 | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.6 Add HEALTHCHECK instruction to the container image | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.1 Do not disable AppArmor Profile | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | ACCESS CONTROL |
| 5.1 Verify AppArmor | CIS Docker 1.11.0 v1.0.0 L2 Docker | Unix | ACCESS CONTROL |
| 5.2 Ensure that, if applicable, an AppArmor Profile is enabled | CIS Docker v1.8.0 L1 OS Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 5.6.3 Apply Security Context to Your Pods and Containers | CIS Kubernetes v2.0.1 L2 Master Node | Unix | CONFIGURATION MANAGEMENT |
| 5.7 Do not map privileged ports within containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.7 Ensure privileged ports are not mapped within containers | CIS Docker Community Edition v1.1.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.7.3 Apply Security Context to Your Pods and Containers | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.7.3 Apply Security Context to Your Pods and Containers | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.7.3 Apply Security Context to Your Pods and Containers | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.8 Ensure privileged ports are not mapped within containers | CIS Docker v1.8.0 L1 OS Linux | Unix | CONFIGURATION MANAGEMENT |
| 5.9 Do not share the host's network namespace | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10 Do not use host network mode on container | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.27 Ensure docker commands always get the latest version of the image | CIS Docker 1.12.0 v1.0.0 L1 Docker | Unix | |
| 5.32 Ensure that the Docker socket is not mounted inside any containers | CIS Docker v1.8.0 L1 OS Linux | Unix | ACCESS CONTROL |
| CIS_Docker_v1.8.0_L1_OS_Linux.audit from CIS Docker Benchmark v1.8.0 | CIS Docker v1.8.0 L1 OS Linux | Unix | |
| CIS_Docker_v1.8.0_L2_OS_Linux.audit from CIS Docker Benchmark v1.8.0 | CIS Docker v1.8.0 L2 OS Linux | Unix | |
| DKER-EE-001190 - Docker Enterprise sensitive host system directories must not be mounted on containers. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | ACCESS CONTROL |
| DKER-EE-002150 - Docker Enterprise privileged ports must not be mapped within containers. | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | CONFIGURATION MANAGEMENT |
| DKER-EE-004040 - The Docker Enterprise default ulimit must not be overwritten at runtime unless approved in the System Security Plan (SSP). | DISA STIG Docker Enterprise 2.x Linux/Unix v2r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
