| 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2 Use Dedicated Least Privileged Account for MariaDB Daemon/Service | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.2.21 Ensure that the --service-account-lookup argument is set to true | CIS Kubernetes v2.0.1 L1 Master Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.6.4 Ensure access to /etc/motd is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.2.1.10 Ensure 'Treat AirDrop as unmanaged destination' is set to 'Enabled' | AirWatch - CIS Apple iPadOS 17 v1.1.0 End User Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 2.4 Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock | CIS Google Cloud Platform Foundation v5.0.0 L2 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
| 2.7.1 Ensure 'Allow user to move messages from this account' is set to 'Disabled' | AirWatch - CIS Apple iPadOS 17 v1.1.0 End User Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 2.7.2 Ensure 'Allow Mail Drop' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 v1.1.0 End User Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.4 Ensure that S3 is configured with 'Block Public Access' enabled | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.5 Secure Permissions for Alternate Diagnostic Log Path (ALT_DIAGPATH) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.5 Secure Permissions for Alternate Diagnostic Log Path (ALT_DIAGPATH) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.8 Secure the Java Development Kit Installation Path (JDK_PATH) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.8 Secure the Java Development Kit Installation Path (JDK_PATH) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.10 Secure the R Runtime Path (R_PATH) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.10 Secure the R Runtime Path (R_PATH) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 3.1.11 Secure the Communication Buffer Exit Library (COMM_EXIT_LIST) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2 Ensure 'log_bin_basename' Files Have Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.21 Ensure 'Allow documents from managed sources in unmanaged destinations' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.1.27 Ensure 'Force Apple Watch wrist detection' is set to 'Enabled' | AirWatch - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.3 Disable Grants During Restore (DB2_RESTORE_GRANT_ADMIN_AUTHORITIES) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 3.2.5 Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.4 Ensure 'slow_query_log' Has Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.5 Ensure there are no group staff writable files | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.7.1 Ensure 'Allow user to move messages from this account' is set to 'Disabled' | AirWatch - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.7.1 Ensure 'Allow user to move messages from this account' is set to 'Disabled' | MobileIron - CIS Apple iPadOS 17 Institutionally Owned L1 | MDM | ACCESS CONTROL, MEDIA PROTECTION |
| 3.8 Ensure Plugin Directory Has Appropriate Permissions | CIS MariaDB 10.11 v1.0.0 L2 MariaDB RDBMS on Linux Unix | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.9 Ensure Windows BUILTIN groups are not SQL Logins | CIS Microsoft SQL Server 2025 v1.0.0 L1 AWS RDS MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 3.11 Ensure Group Write Access for the Apache Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 3.11 Ensure the public role in the msdb database is not granted access to SQL Agent proxies | CIS Microsoft SQL Server 2025 v1.0.0 L1 Database Engine MS_SQLDB | MS_SQLDB | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.11 Ensure access on /var/adm/cron/cron.allow is configured | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.13 Ensure access on /var/ct/RMstart.log is configured | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.15 Ensure access on /var/tmp/hostmibd.log is configured | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.1.19 Ensure SUID and SGID files are reviewed | CIS IBM AIX 7 v1.2.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.2.1 Ensure at is restricted to authorized users | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.4 Secure Permissions for the Primary Archive Log Location (LOGARCHMETH1) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.6 Secure Permissions for the Tertiary Archive Log Location (FAILARCHPATH) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive | CIS Kubernetes v2.0.1 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.8 Secure Permissions for the Log Overflow Location (OVERFLOWLOGPATH) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.13 Specify a Secure Location for External Tables (EXTBL_LOCATION) | CIS IBM DB2 12.1 v1.0.0 Linux OS Level 1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.13 Specify a Secure Location for External Tables (EXTBL_LOCATION) | CIS IBM DB2 12.1 v1.0.0 Windows OS Level 1 | Windows | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.2 Ensure permissions on SSH private host key files are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.4 Ensure sshd access is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.1.3 Ensure all logfiles have appropriate access configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.5 Ensure audit configuration files are restrictive | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.10 Ensure audit tools belong to group wheel | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1.1 Ensure permissions on /etc/passwd are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1.6 Ensure no unowned or ungrouped files or directories exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.3.7 Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off' | CIS Google Cloud Platform Foundation v5.0.0 L1 | GCP | ACCESS CONTROL, MEDIA PROTECTION |
