| 2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.10 Ensure 'Create a token object' is set to 'No One' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.20 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.24 Ensure 'Increase scheduling priority' is set to 'Administrators, Window Manager\Window Manager Group' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.29 Ensure 'Manage auditing and security log' is set to 'Administrators' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.31 Ensure 'Modify firmware environment values' is set to 'Administrators' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.7.7 Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.9.1 Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.11.5 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.17.8 Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.12 Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.43 Ensure 'Xbox Live Game Save (XblGameSave)' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.4.3 Ensure 'Configure SMB v1 server' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.4.6 Ensure 'NetBT NodeType configuration' is set to 'Enabled: P-node (recommended)' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.5.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.7.3 Ensure 'Audit insecure guest logon' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.7.7 Ensure 'Set authentication rate limiter delay (milliseconds)' is set to 'Enabled: 2000' or more | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.6.8.3 Ensure 'Audit server does not support signing' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.8.5 Ensure 'Enable remote mailslots' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.7 Ensure 'Require Encryption' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.7.4 Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.7.5 Ensure 'Configure RPC listener settings: Protocols to allow for incoming RPC connections' is set to 'Enabled: RPC over TCP' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.7.6 Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.7.1.2 Ensure 'Prevent installation of devices using drivers that match these device setup classes: Prevent installation of devices using drivers for these device setup' is set to 'IEEE 1394 device setup classes' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.13.1 Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.17.1 Ensure 'Enable / disable CLFS logfile authentication' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' or higher | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.27.1 Ensure 'Allow Custom SSPs and APs to be loaded into LSASS' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.35.6.5 Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 18.9.41.1 Ensure 'Configure SAM change password RPC methods policy' is set to 'Enabled: Block all change password RPC methods' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.4.2 Ensure 'Not allow per-user unsigned packages to install by default (requires explicitly allow per install)' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.10.3.6 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.10.3.7 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives' is set to 'Enabled: False' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.10.3.9 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives' is set to 'Enabled: False' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.15.2 Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 18.10.18.3 Ensure 'Enable App Installer Hash Override' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.26.2.2 Ensure 'Security: Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.3.1 Ensure 'Setup: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.3.2 Ensure 'Setup: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.29.2 Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.57.3.3.3 Ensure 'Do not allow drive redirection' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.2 Ensure 'Require secure RPC communication' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.11.1 Ensure 'Do not delete temp folders upon exit' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.59.5 Ensure 'Allow indexing of encrypted files' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.77.1.1 Ensure 'Automatic Data Collection' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.83.2 Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 18.10.94.2.1 Ensure 'Configure Automatic Updates' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.2.2 Ensure 'Configure Automatic Updates: Scheduled install day' is set to '0 - Every day' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
