| 1.1.2.5.1 Ensure separate partition exists for /var/log | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.2.1 (L1) Ensure 'Configure the list of domains on which Safe Browsing will not trigger warnings' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.1 Ensure update server certificate key fingerprints are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.4.2 Ensure core dump backtraces are disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.6 Ensure that legacy service users are migrated to service users | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | CONFIGURATION MANAGEMENT |
| 1.6.4 Ensure access to /etc/motd is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.8 Ensure that users who did not log in for 90 days are disabled | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.9 Ensure that the idle session timeout is set to 15 minutes or less for users with the ACCOUNTADMIN and SECURITYADMIN roles | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.13 (L1) Ensure 'Disable saving browser history' is set to 'Disabled' | CIS Google Chrome L1 v3.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.13 Ensure that the ACCOUNTADMIN or SECURITYADMIN role is not granted to any custom role | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.15 (L1) Ensure 'Enable component updates in Google Chrome' is set to 'Enabled' | CIS Google Chrome L1 v3.0.0 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.19 Ensure that an account-level authentication policy has been configured to require Programmatic Access Tokens be rotated at least every 90 days | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | IDENTIFICATION AND AUTHENTICATION |
| 2.1 Ensure that Remote Radius is used for Authentication Only | CIS F5 Networks v1.0.0 L2 | F5 | ACCESS CONTROL |
| 2.2.2 Ensure ftp server services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.2.6 Ensure rpcbind services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 3.1 Ensure that all users are covered by a network policy to only allow access from trusted IP addresses | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.3.2 Ensure packet redirect sending is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.6 Ensure tcp syn cookies is enabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.1.2.1 Ensure at is restricted to authorized users | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.10 Ensure the upstream traffic server certificate is trusted | CIS NGINX v3.0.0 L2 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.2 Ensure permissions on SSH private host key files are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.4 Ensure sshd access is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.18 Ensure sshd PermitEmptyPasswords is disabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.3 Ensure that the DATA_RETENTION_TIME_IN_DAYS parameter is set to 90 for critical data | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | CONTINGENCY PLANNING |
| 4.4 Ensure 'Idle timeout' is less than or equal to 10 minutes for serial console sessions | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.5.2.1 Ensure default group for the root account is GID 0 | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND SERVICES ACQUISITION |
| 4.5.2.3 Ensure system accounts are secured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.5.3.1 Ensure nologin is not listed in /etc/shells | CIS FreeBSD 14 v1.0.1 L2 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.7 Ensure to set Strong SSH KEY Exchange algorithm | CIS F5 Networks v1.0.0 L1 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 5.1.1.1 Ensure syslog is installed | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 5.1.1.3 Ensure syslogd default file permissions are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.1.1.5 Ensure syslog is configured to send logs to a remote log host | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.3 Ensure all logfiles have appropriate access configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.3.1 Ensure actions as another user are always logged | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.7 Ensure file deletion events by users are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.8 Ensure successful and unsuccessful attempts to use the usermod command are recorded | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.4 Ensure the number of connections per IP address is limited | CIS NGINX v3.0.0 L2 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.4.5 Ensure audit configuration files are restrictive | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.2.4.10 Ensure audit tools belong to group wheel | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 5.3 Ensure port lockdown for self IP is set | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.3.2 Ensure filesystem integrity is regularly checked | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.4 Ensure to disable unused services in BIG-IP configuration | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1 Ensure that SNMP access is allowed to trusted agents IPs only | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.1.1 Ensure permissions on /etc/passwd are configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.1.6 Ensure no unowned or ungrouped files or directories exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 6.2.4 Ensure no duplicate UIDs exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 6.2.7 Ensure no duplicate group names exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 6.2.8 Ensure root path integrity | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 6.3 Ensure to lockdown access logs to "Administrator , Resource Administrator and Auditor " roles only | CIS F5 Networks v1.0.0 L1 | F5 | AUDIT AND ACCOUNTABILITY |
| 6.4 Ensure that audit logging for "MCP, tmsh and GUI" is set to enabled | CIS F5 Networks v1.0.0 L1 | F5 | AUDIT AND ACCOUNTABILITY |
