| 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.29 Ensure that encryption providers are appropriately configured | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.113 WN11-CC-000037 | CIS Microsoft Windows 11 STIG v1.2.0 CAT II | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.190 WN16-MS-000020 | CIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT II | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.2 Ensure that the kubelet service file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.2 Ensure that the kubelet service file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.2 Ensure that the kubelet service file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.3 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.3 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.4 Verify that the --read-only-port argument is set to 0 | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | CONFIGURATION MANAGEMENT |
| 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - cert | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - key | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - key | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.2 Define default deny NetworkPolicies for each workload namespace | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.1 Enforce image provenance using Binary Authorization for GKE | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 5.1.4 Minimize access to create pods | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.1.6 Ensure that Service Account Tokens are only mounted where necessary - serviceaccounts | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.7 Avoid use of system:masters group | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 5.1.7 Avoid use of system:masters group | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 5.2.2 Minimize the admission of privileged containers | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.5 Minimize the admission of containers wishing to share the host network namespace | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.5 Minimize the admission of containers wishing to share the host network namespace | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.7 Minimize the admission of root containers | CIS Kubernetes v1.23 Benchmark v1.0.1 L2 Master | Unix | ACCESS CONTROL |
| 5.2.7 Minimize the admission of root containers | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | ACCESS CONTROL |
| 5.2.8 Minimize the admission of containers with the NET_RAW capability | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.9 Minimize the admission of containers with added capabilities | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.12 Minimize the admission of HostPath volumes | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.12 Minimize the admission of HostPath volumes | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.13 Minimize the admission of containers which use HostPorts | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.3.2 Ensure that all Namespaces have Network Policies defined | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| SOL-11.1-020080 - System packages must be configured with the vendor-provided files, permissions, and ownerships. | DISA Solaris 11 X86 STIG v3r6 | Unix | AUDIT AND ACCOUNTABILITY |
| WN10-CC-000030 - The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes. | DISA Microsoft Windows 10 STIG v3r6 | Windows | CONFIGURATION MANAGEMENT |
| WN11-CC-000037 - Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems. | DISA Microsoft Windows 11 STIG v2r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN19-MS-000020 - Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers. | DISA Microsoft Windows Server 2019 STIG v3r8 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN22-MS-000020 - Windows Server 2022 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers. | DISA Microsoft Windows Server 2022 STIG v2r10 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-00-000390 - Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server. | DISA Microsoft Windows Server 2025 STIG v1r3 | Windows | CONFIGURATION MANAGEMENT |
| WN25-MS-000020 - Windows Server 2025 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers. | DISA Microsoft Windows Server 2025 STIG v1r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
