| 1.6 Ensure 'SCL Quarantine' is 'Enabled' | CIS Microsoft Exchange Server 2019 L1 Edge v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.7 Set lockout thresholds | CIS Sybase 15.0 L2 DB v1.1.0 | SybaseDB | |
| 1.11 Ensure 'Exchange recipient filter' is set to 'True' | CIS Microsoft Exchange Server 2019 L1 Edge v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 1.12 Ensure 'Internet-facing receive connectors' is set to 'Tls, BasicAuth, BasicAuthRequireTLS' | CIS Microsoft Exchange Server 2019 L1 Edge v1.0.0 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.1 Ensure 'Transport Pickup Directory Path' is not set | CIS Microsoft Exchange Server 2019 L1 Mailbox v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.2.8 Ensure 'Allow log on locally' is set to 'Administrators' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.16 Ensure 'Create permanent shared objects' is set to 'No One' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.24 Ensure 'Deny log on locally' to include 'Guests' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.28 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.29 Ensure 'Force shutdown from a remote system' is set to 'Administrators' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.39 Ensure 'Manage auditing and security log' is set to 'Administrators' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.2.2 Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 2.3.4 Ensure 'Enable automatic forwards to remote domains' is set to 'False' | CIS Microsoft Exchange Server 2019 L1 Mailbox v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 2.3.8.2 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.9.2 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.10.8 Ensure 'Network access: Remotely accessible registry paths' is configured | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.10.13 Ensure 'Network access: Sharing and security model for local accounts' is set to 'Classic - local users authenticate as themselves' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.17.2 Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' or higher | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 3.4 Ensure 'Minimum password length' is set to '4' or more | CIS Microsoft Exchange Server 2019 L1 MDM v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 4.3 Ensure 'Turn on connectivity logging' is set to 'True' | CIS Microsoft Exchange Server 2019 L1 Edge v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.3 Ensure 'Turn on connectivity logging' is set to 'True' | CIS Microsoft Exchange Server 2019 L1 Mailbox v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.2.13 Ensure 'SQL_FIREWALL_ADMIN' Is Revoked From Unauthorized 'GRANTEE' | CIS Oracle Database 23ai v1.1.0 L1 RDBMS | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 9.1.5 Ensure 'Windows Firewall: Domain: Logging: Size limit (KB)' is set to '16,384 KB or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.1 Ensure 'Windows Firewall: Private: Firewall state' is set to 'On (recommended)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.5 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.7 Ensure 'Windows Firewall: Private: Logging: Log successful connections' is set to 'Yes' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.3.7 Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.2 Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.4.5 Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.6.4.4 Ensure 'Turn off multicast name resolution' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.11.4 Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 18.7.8 Ensure 'Configure RPC packet level privacy setting for incoming connections' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.7.10 Ensure 'Manage processing of Queue-specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.3.1 Ensure 'Include command line in process creation events' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.9.4.2 Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.7.2 Ensure 'Prevent automatic download of applications associated with device metadata' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.9.17.1 Ensure 'Enable / disable CLFS logfile authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.9.26.1 Ensure 'Configure password backup directory' is set to 'Enabled: Active Directory' or 'Enabled: Azure Active Directory' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONTINGENCY PLANNING |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.3 Ensure 'Enable password encryption' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.9.29.4 Ensure 'Enumerate local users on domain-joined computers' is set to 'Disabled' (MS only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.37.2 Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.53.1.1 Ensure 'Enable Windows NTP Client' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.8.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.94.4.2 Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 19.7.5.2 Ensure 'Notify antivirus programs when opening attachments' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
