| 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.16 WN10-00-000070 | CIS Microsoft Windows 10 STIG v1.0.0 CAT I | Windows | ACCESS CONTROL |
| 1.37 SOL-11.1-020050 | CIS Solaris 11 X86 STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 1.39 SOL-11.1-020080 | CIS Solaris 11 SPARC STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 1.103 WN10-CC-000030 | CIS Microsoft Windows 10 STIG v1.0.0 CAT III | Windows | CONFIGURATION MANAGEMENT |
| 4.1.3 If proxy kube proxy configuration file exists ensure permissions are set to 644 or more restrictive | CIS Red Hat OpenShift Container Platform v1.9.0 L1 | OpenShift | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.8 Ensure that the --hostname-override argument is not set | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | CONFIGURATION MANAGEMENT |
| 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Worker | Unix | AUDIT AND ACCOUNTABILITY |
| 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.1 Prefer using secrets as files over secrets as environment variables | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.6.2 Require RuntimeDefault seccomp or approved custom profiles for workload pods | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 4.6.3 Require hardened security contexts for all workload Pods and containers | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT |
| 4.6.4 Avoid deploying workloads in the default namespace | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.1 Ensure that the cluster-admin role is only used where required | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.1.2 Grant least privilege IAM access to Artifact Registry repositories | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.6 Ensure that Service Account Tokens are only mounted where necessary - pods | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.6 Ensure that Service Account Tokens are only mounted where necessary - serviceaccounts | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.2 Minimize the admission of privileged containers | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.8 Minimize the admission of containers with added capabilities | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.8 Minimize the admission of containers with the NET_RAW capability | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.2.9 Minimize the admission of containers with added capabilities | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | CONFIGURATION MANAGEMENT |
| 5.5.2 Verify node auto-repair is enabled for GKE node pools | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | RISK ASSESSMENT |
| 5.6.1 Enable VPC Flow Logs and Intranode Visibility | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | AUDIT AND ACCOUNTABILITY, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.6.6 Apply least privilege firewall rules to GKE worker nodes | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.6.7 Use Google managed SSL certificates for GKE Ingress TLS | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.10.2 Use GKE Sandbox for untrusted or high risk workloads | CIS Google Kubernetes Engine GKE v2.0.0 L2 | GCP | SYSTEM AND COMMUNICATIONS PROTECTION |
| BIND-9X-001500 - A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC. | DISA BIND 9.x STIG v3r3 | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.4.1_Level_1.audit from CIS Kubernetes Benchmark v1.4.1 | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.20_v1.0.1_Level_2_Master.audit from CIS Kubernetes v1.20 Benchmark v1.0.1 | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.23_v1.0.1_Level_1_Worker.audit from CIS Kubernetes v1.23 Benchmark v1.0.1 | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.24_v1.0.0_Level_1_Worker.audit from CIS Kubernetes v1.24 Benchmark v1.0.0 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | CONFIGURATION MANAGEMENT |
| CIS_Kubernetes_v1.24_v1.0.0_Level_2_Master.audit from CIS Kubernetes v1.24 Benchmark v1.0.0 | CIS Kubernetes v1.24 Benchmark v1.0.0 L2 Master | Unix | CONFIGURATION MANAGEMENT |
| DO6748-ORACLE11 - Case sensitivity for passwords should be enabled - 'sec_case_sensitive_logon = true' | DISA STIG Oracle 11 Instance v9r1 Database | OracleDB | |
| MYS8-00-002500 - The MySQL Database Server 8.0 must generate audit records when unsuccessful attempts to add privileges/permissions occur. | DISA Oracle MySQL 8.0 v2r2 DB | MySQLDB | AUDIT AND ACCOUNTABILITY |
| SOL-11.1-020080 - System packages must be configured with the vendor-provided files, permissions, and ownerships. | DISA Solaris 11 SPARC STIG v3r6 | Unix | AUDIT AND ACCOUNTABILITY |
| VCPG-67-000022 - Rsyslog must be configured to monitor VMware Postgres logs - log | DISA STIG VMware vSphere 6.7 PostgreSQL v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| WN10-00-000150 - Structured Exception Handling Overwrite Protection (SEHOP) must be enabled. | DISA Microsoft Windows 10 STIG v3r6 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| WN10-CC-000039 - Run as different user must be removed from context menus. | DISA Microsoft Windows 10 STIG v3r6 | Windows | CONFIGURATION MANAGEMENT |
| WN12-SO-000038 - The system must be configured to prevent IP source routing. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-SO-000042 - IPSec Exemptions must be limited. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-SO-000043 - The system must be configured to ignore NetBIOS name release requests except from WINS servers. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN12-SO-000043 - The system must be configured to ignore NetBIOS name release requests except from WINS servers. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN12-SO-000048 - The system must limit how many times unacknowledged TCP data is retransmitted. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN12-SO-000049 - The system must generate an audit event when the audit log reaches a percentage of full threshold. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | AUDIT AND ACCOUNTABILITY |
| WN22-CC-000050 - Windows Server 2022 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. | DISA Microsoft Windows Server 2022 STIG v2r10 | Windows | CONFIGURATION MANAGEMENT |
| WN22-MS-000020 - Windows Server 2022 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers. | DISA Microsoft Windows Server 2022 STIG v2r8 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-00-000390 - Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | CONFIGURATION MANAGEMENT |
