| 1.1 Ensure single sign-on (SSO) is configured for your account / organization | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.1.1.1 Ensure ext2fs kernel module is not available | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2 Ensure default password of admin is not used | CIS F5 Networks v1.0.0 L1 | F5 | IDENTIFICATION AND AUTHENTICATION |
| 1.1.2.5.3 Ensure noexec option set on /var/log partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3 Ensure that Snowflake password is unset for SCIM-managed users | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | IDENTIFICATION AND AUTHENTICATION |
| 1.3.1 Ensure bootloader password is set | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.3.2 Ensure permissions on bootloader config are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.4 Ensure that person users do not use password-only authentication | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | IDENTIFICATION AND AUTHENTICATION |
| 1.4.3 Ensure core dump storage is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.6.2 Ensure local login warning banner is configured properly | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.14 Ensure that Snowflake tasks are not owned by the ACCOUNTADMIN or SECURITYADMIN roles | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.18 Ensure that an account-level authentication policy has been configured to require network policies when using Programmatic Access Tokens (PATs) | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | IDENTIFICATION AND AUTHENTICATION |
| 2.1 Ensure monitoring and alerting exist for ACCOUNTADMIN and SECURITYADMIN role grants | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure autofs services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 2.2.7 Ensure snmp services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.2.8 Ensure telnet server services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.6 Ensure monitoring and alerting exist for SCIM token creation | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.7 Ensure monitoring and alerting exists for new share exposures | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.8 Ensure monitoring and alerting exists for sessions from unsupported and vulnerable driver versions | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 3.2 Ensure access to Configuration utility by clients using TLS version 1.2 or later | CIS F5 Networks v1.0.0 L1 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 3.2.1 Ensure sctp kernel module is not available | CIS FreeBSD 14 v1.0.1 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 3.3.1 Ensure ip forwarding is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.3 Ensure broadcast & multicast icmp requests are ignored | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.1 Ensure yearly rekeying is enabled for a Snowflake account | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1.2 Ensure permissions on /etc/cron.d are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2 Ensure AES encryption key size used to encrypt files stored in internal stages is set to 256 bits | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.3 Ensure permissions on SSH public host key files are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.5 Ensure sshd Banner is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.2.8 Ensure sshd DisableForwarding is enabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 4.2.9 Ensure sshd HostbasedAuthentication is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.2.11 Ensure sshd KexAlgorithms is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.16 Ensure sshd MaxSessions is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.2.19 Ensure sshd PermitRootLogin is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL |
| 4.2.21 Ensure sshd UsePAM is enabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.3.5 Ensure re-authentication for privilege escalation is not disabled globally | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL |
| 4.3.6 Ensure sudo authentication timeout is configured correctly | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL |
| 4.4.1.2.1 Ensure pam_unix does not include nullok | CIS FreeBSD 14 v1.0.1 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.5 Ensure minimum SSH Encryption algorithm is set to aes128-cbc | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.8 Ensure access SSH to CLI interface is restricted to needed IP addresses only | CIS F5 Networks v1.0.0 L1 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 5.1.2 Ensure newsyslog is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.3 Ensure use of privileged commands are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.4.2 Ensure audit log files are mode 0640 or less permissive | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.6 Ensure audit configuration files are owned by root | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.7 Ensure audit configuration files belong to group wheel | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.3.1 Ensure AIDE is installed | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.3.3 Ensure the Referrer Policy is enabled and configured properly | CIS NGINX v3.0.0 L2 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 6.1.4 Ensure permissions on /etc/shells are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1.7 Ensure SUID and SGID files are reviewed | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION |
| 6.2 Ensure minimum SNMP version is set to V3 for agent access | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.6 Ensure no duplicate user names exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
