| 1.1.2.1.1 Ensure /tmp is a separate partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2.2.1 Ensure separate partition exists for /home | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.2.2.2 Ensure nosuid option set on /home partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.3.2 Ensure nosuid option set on /var partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.4.2 Ensure nosuid option set on /var/tmp partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.5.2 Ensure nosuid option set on /var/log partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.2.6.2 Ensure nosuid option set on /var/audit partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.3 Configure Secure Password Policy | CIS F5 Networks v1.0.0 L1 | F5 | IDENTIFICATION AND AUTHENTICATION |
| 1.10 Limit the number of users with ACCOUNTADMIN and SECURITYADMIN | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 1.16 Ensure that Snowflake stored procedures are not owned by the ACCOUNTADMIN or SECURITYADMIN roles | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL |
| 2.2.2 Ensure the NGINX service account is locked | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.2.9 Ensure tftp server services are not in use | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.3.3 Ensure the NGINX process ID (PID) file is secured | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.4 Ensure monitoring and alerting exist for creation, update and deletion of security integrations | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.4.1 Ensure NGINX only listens for network connections on authorized ports | CIS NGINX v3.0.0 L1 Webserver | Unix | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 2.5 Ensure monitoring and alerting exist for changes to network policies and associated objects | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.3 Ensure hidden file serving is disabled | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.3 Ensure hidden file serving is disabled | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.9 Ensure monitoring and alerting exists for changes to authentication policies and associated objects | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | AUDIT AND ACCOUNTABILITY |
| 3.3.4 Ensure icmp redirects are not accepted | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.3.5 Ensure source routed packets are not accepted | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 3.4.1.1 Ensure ipfw is enabled and configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.7 Ensure Online Certificate Status Protocol (OCSP) stapling is enabled | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.8 Ensure HTTP Strict Transport Security (HSTS) is enabled | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.8 Ensure HTTP Strict Transport Security (HSTS) is enabled | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.10 Ensure the upstream traffic server certificate is trusted | CIS NGINX v3.0.0 L2 Loadbalancer | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.12 Ensure HTTP/3.0 is used | CIS NGINX v3.0.0 L2 Webserver | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.13 Ensure sshd LogLevel is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 4.2.17 Ensure sshd MaxStartups is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND SERVICES ACQUISITION |
| 4.3 Ensure 'Idle timeout' is less than or equal to 10 minutes for tmsh sessions | CIS F5 Networks v1.0.0 L1 | F5 | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.3.2 Ensure sudo commands use pty | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL |
| 4.3.3 Ensure sudo log file exists | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.3.4 Ensure users must provide password for escalation | CIS FreeBSD 14 v1.0.1 L2 | Unix | ACCESS CONTROL |
| 4.5.1.1 Ensure strong password hashing algorithm is configured | CIS FreeBSD 14 v1.0.1 L1 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.1.3 Ensure password expiration warning days is 7 or more | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.8 Ensure that the PREVENT_UNLOAD_TO_INLINE_URL account parameter is set to true | CIS Snowflake Foundations v2.0.0 L1 | Snowflake | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 4.10 Ensure that data masking is enabled for sensitive data | CIS Snowflake Foundations v2.0.0 L2 | Snowflake | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses | CIS NGINX v3.0.0 L2 Loadbalancer | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses | CIS NGINX v3.0.0 L2 Proxy | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.1.2 Ensure syslogd service is enabled | CIS FreeBSD 14 v1.0.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2 Ensure the maximum request body size is set correctly | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.2.1 Ensure audit log storage size is configured | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.2 Ensure events that modify the sudo log file are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.4 Ensure discretionary access control permission modification events are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.5 Ensure successful file system mounts are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.5 Ensure rate limits by IP address are set | CIS NGINX v3.0.0 L2 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.5 Ensure rate limits by IP address are set | CIS NGINX v3.0.0 L2 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 6.2.1 Ensure accounts in /etc/master.passwd use shadowed passwords | CIS FreeBSD 14 v1.0.1 L1 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.5 Ensure no duplicate GIDs exist | CIS FreeBSD 14 v1.0.1 L1 | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
