| 1.1.15 Ensure that the Scheduler kubeconfig file permissions are set to 600 or more restrictive | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.9 Ensure that the admission control plugin AlwaysPullImages is not set | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, MEDIA PROTECTION |
| 2.1 Prevent Database Users from Logging into the Operating System | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.1 Ensure NGINX directories and files are owned by root | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.2 Ensure access to NGINX directories and files is restricted | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.3 Ensure the NGINX process ID (PID) file is secured | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.3.3 Ensure the NGINX process ID (PID) file is secured | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.9 Ensure 'Trustworthy' Database Property is set to 'Off' | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 2.18 Ensure that IAM External Access Analyzer is enabled for all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1 Ensure 'datadir' Has Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.1 Ensure 'Allow screenshots and screen recording' is set to 'Disabled' | MobileIron - CIS Apple 26 v1.0.0 L2 Institutionally Owned | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.3.5 MSDP Authentication & SA Filtering | CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations | ArubaOS | ACCESS CONTROL, MEDIA PROTECTION |
| 3.3.7 Multicast Boundary ACL | CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations | ArubaOS | ACCESS CONTROL, MEDIA PROTECTION |
| 3.5 Ensure Access to Audit Records Is Controlled | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.5 Ensure Access to Audit Records Is Controlled | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.8 Ensure only the default permissions specified by Microsoft are granted to the public server role | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.9 Ensure 'server_audit_file_path' Has Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L1 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.9 Ensure 'server_audit_file_path' Has Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.10 Ensure File Key Management Encryption Plugin files have appropriate permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.10 Ensure Windows local groups are not SQL Logins | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.14 Ensure 'Control Server' permission is not granted | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 Ensure private key permissions are restricted | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.3 Ensure private key permissions are restricted | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.1 Restrict Access to SYSCAT.AUDITPOLICIES | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.8 Restrict Access to SYSCAT.CONTEXTS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.13 Restrict Access to SYSCAT.EVENTTABLES | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.15 Restrict Access to SYSCAT.INDEXAUTH | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.21 Restrict Access to SYSCAT.ROLES | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.24 Restrict Access to SYSCAT.SECURITYLABELACCESS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.25 Restrict Access to SYSCAT.SECURITYLABELCOMPONENTELEMENTS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.28 Restrict Access to SYSCAT.SECURITYPOLICIES | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.37 Restrict Access to SYSCAT.SURROGATEAUTHIDS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.43 Restrict Access to SYSCAT.WORKLOADAUTH | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.10 Restrict Access to SYSIBM.SYSCONTROLS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.18 Restrict Access to SYSIBM.SYSPLANAUTH | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.21 Restrict Access to SYSIBM.SYSROLES | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.3.28 Restrict Access to SYSIBM.SYSSECURITYLABELCOMPONENTELEMENTS | CIS IBM DB2 12.1 v1.0.0 Database Level 1 | IBM_DB2DB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.5 Ensure mariadb is Not Started With 'skip-grant-tables' | CIS MariaDB 10.11 v1.0.0 L1 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.5 Ensure mariadb is Not Started With 'skip-grant-tables' | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.1 Ensure Home Folders Are Secure | CIS Apple macOS 10.14 v2.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.1 Ensure Home Folders Are Secure | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.4 Ensure Appropriate Permissions Are Enabled for System Wide Applications | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.5 Ensure Appropriate Permissions Are Enabled for System Wide Applications | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.6 Ensure No World Writable Files Exist in the Library Folder | CIS Apple macOS 12.0 Monterey Cloud-tailored v1.1.0 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.6 Ensure No World Writable Files Exist in the System Folder | CIS Apple macOS 11.0 Big Sur v4.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.6 Ensure No World Writable Folders Exist in the Library Folder | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.7 Ensure No World Writable Files Exist in the Library Folder | CIS Apple macOS 10.14 v2.0.0 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.9 Ensure DML/DDL Grants are Limited to Specific Databases and Users | CIS MariaDB 10.11 v1.0.0 L1 MariaDB RDBMS MySQLDB | MySQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1.4 Ensure Guest Access to Shared Folders Is Disabled | CIS Apple macOS 12.0 Monterey v4.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
