| 1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.7 Ensure 'Store passwords using reversible encryption' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 2.2.21 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account and member of Administrators group' (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.23 Ensure 'Deny log on as a service' to include 'Guests' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.33 Ensure 'Increase scheduling priority' is set to 'Administrators, Window Manager\Window Manager Group' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.40 Ensure 'Modify firmware environment values' is set to 'Administrators' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.42 Ensure 'Profile single process' is set to 'Administrators' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.7.2 Ensure 'Interactive logon: Don't display last signed-in' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.7.3 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.7.7 Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.8.1 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.9.1 Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.10.12 Ensure 'Network access: Shares that can be accessed anonymously' is set to 'None' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 9.1.2 Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.2 Ensure 'Windows Firewall: Private: Inbound connections' is set to 'Block (default)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.6 Ensure 'Windows Firewall: Private: Logging: Log dropped packets' is set to 'Yes' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.3.1 Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.3.5 Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 17.5.6 Ensure 'Audit Special Logon' is set to include 'Success' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.1 Ensure 'Audit Detailed File Share' is set to include 'Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.8.1 Ensure 'Audit Sensitive Privilege Use' is set to 'Success' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.3 Ensure 'Audit Security State Change' is set to include 'Success' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.5 Ensure 'Audit System Integrity' is set to 'Success and Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.1.1.2 Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.5.4 Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.4.1 Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.4.4 Ensure 'Turn off multicast name resolution' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.7.3 Ensure 'Audit insecure guest logon' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.7.6 Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.2 Ensure 'Audit server does not support encryption' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.11.2 Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.7.5 Ensure 'Configure RPC listener settings: Protocols to allow for incoming RPC connections' is set to 'Enabled: RPC over TCP' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.7.12 Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.7.13 Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.26.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' or higher (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.8 Ensure 'Post-authentication actions: Actions' is set to 'Enabled: Reset the password and logoff the managed account' or higher (MS only) | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.29.2 Ensure 'Do not display network selection UI' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.29.3 Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.35.6.3 Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.35.6.4 Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.37.1 Ensure 'Configure Offer Remote Assistance' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.13.1 Ensure 'Turn off cloud consumer account state content' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.29.2 Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.29.5 Ensure 'Turn off shell protocol protected mode' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.2.2 Ensure 'Do not allow passwords to be saved' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.2 Ensure 'Require secure RPC communication' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.10.1 Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.90.1.3 Ensure 'Disallow Digest authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.93.2.1 Ensure 'Prevent users from modifying settings' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
