| 1.1.1 Ensure NGINX is installed | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.2 Ensure the latest software package is installed | CIS NGINX v3.0.0 L1 Webserver | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL |
| 2.2.2 Ensure the NGINX service account is locked | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.4.2 Ensure requests for unknown host names are rejected | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.4.2 Ensure requests for unknown host names are rejected | CIS NGINX v3.0.0 L1 Proxy | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.4.3 Ensure keepalive_timeout is 10 seconds or less, but not 0 | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.4.3 Ensure keepalive_timeout is 10 seconds or less, but not 0 | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.4.4 Ensure send_timeout is set to 10 seconds or less, but not 0 | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.4.4 Ensure send_timeout is set to 10 seconds or less, but not 0 | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.1 Ensure server_tokens directive is set to `off` | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.3 Ensure hidden file serving is disabled | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 3.3 Ensure error logging is enabled and set to the info logging level | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | AUDIT AND ACCOUNTABILITY |
| 3.4 Ensure proxies pass source IP information | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1 Ensure HTTP is redirected to HTTPS | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1.1 Ensure audit log storage size is configured | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.3 Ensure audit logs are not automatically deleted | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2 Ensure auditd service is enabled | CIS Amazon Linux v2.1.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.4 Ensure events that modify date and time information are collected - adjtimex | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime b64 | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify date and time information are collected - auditctl time-change | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify date and time information are collected - localtime | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.5 Disable weak ciphers | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.5 Ensure events that modify user/group information are collected - '/etc/gshadow' | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify the system's network environment are collected - auditctl 32b sethostname | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.11 Ensure Secure Session Resumption is Enabled | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.12 Ensure use of privileged commands is collected | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.13 Ensure successful file system mounts are collected - b64 mounts | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.17 Ensure kernel module loading and unloading is collected - auditctl insmod | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.17 Ensure kernel module loading and unloading is collected - modprobe | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.2 Ensure only approved HTTP methods are allowed | CIS NGINX v3.0.0 L1 Webserver | Unix | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 5.2.1 Ensure timeout values for reading the client header and body are set correctly | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.2 Ensure the maximum request body size is set correctly | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.3 Ensure the maximum buffer size for URIs is defined | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.4 Ensure the number of connections per IP address is limited | CIS NGINX v3.0.0 L2 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.4.1.4 Ensure inactive password lock is 30 days or less - users | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 5.4.4 Ensure default user umask is 027 or more restrictive - /etc/bashrc | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 6.1.5 Ensure permissions on /etc/gshadow are configured | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.1.12 Ensure no ungrouped files or directories exist | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 6.2.4 Ensure no legacy '+' entries exist in /etc/group | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.6 Ensure root PATH Integrity | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.7 Ensure all users' home directories exist | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.12 Ensure no users have .netrc files | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.13 Ensure users' .netrc Files are not group or world accessible | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.16 Ensure no duplicate UIDs exist | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.17 Ensure no duplicate GIDs exist | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
