| 1.1.1.2 Ensure mounting of squashfs filesystems is disabled | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.7 Ensure mounting of udf filesystems is disabled | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.8 Ensure mounting of FAT filesystems is limited - modprobe | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2.5.1 Ensure separate partition exists for /var/tmp | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.3.1 Ensure separate partition exists for /var | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.4.1 Ensure separate partition exists for /var/tmp | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.7 Ensure separate partition exists for /var/tmp | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.13 Ensure separate partition exists for /home | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.6.2.1 Ensure SELinux is not disabled in bootloader configuration - enforcing=0 | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | ACCESS CONTROL |
| 2.2.1 Ensure X Window System is not installed | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 3.1.3 Ensure DCCP is disabled | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.1 Ensure dccp kernel module is not available | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 3.4.1 Ensure DCCP is disabled - lsmod | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.3 Ensure RDS is disabled - modprobe | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.4.4 Ensure TIPC is disabled - lsmod | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.1.1.2 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt' | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.1.4 Ensure audit_backlog_limit is sufficient | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.1 Ensure audit log storage size is configured | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.3 Ensure system is disabled when audit logs are full | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.1 Ensure changes to system administration scope (sudoers) is collected | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.4 Ensure events that modify date and time information are collected | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.6 Ensure use of privileged commands are collected | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.10 Ensure successful file system mounts are collected | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure session initiation information is collected - auditctl wtmp | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 4.1.11 Ensure discretionary access control permission modification events are collected - auditctl b64 chown fchown | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 4.3.4 Ensure users must provide password for privilege escalation | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL |
| 5.1.8 Ensure sshd DisableForwarding is enabled | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 5.2.1.2 Ensure auditd service is enabled and active | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.2.1 Ensure audit log storage size is configured | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.2 Ensure actions as another user are always logged | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.3 Ensure events that modify the sudo log file are collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.4 Ensure events that modify date and time information are collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.9 Ensure discretionary access control permission modification events are collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.11 Ensure session initiation information is collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are recorded | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.3.19 Ensure kernel module loading unloading and modification is collected | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.20 Ensure the audit configuration is immutable | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.3 Ensure only authorized groups are assigned ownership of audit log files | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.4 Ensure the audit log directory is 0750 or more restrictive | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.7 Ensure audit configuration files belong to group root | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.12 Ensure SSH X11 forwarding is disabled | CIS CentOS Linux 8 Server L2 v2.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 6.4.1.3 Ensure auditing for processes that start prior to auditd is enabled | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.2.1 Ensure audit log storage size is configured | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.3.8 Ensure events that modify user/group information are collected | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.3.12 Ensure login and logout events are collected | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.4.9 Ensure audit tools owner is configured | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.4.4.10 Ensure audit tools group owner is configured | CIS Debian Linux 11 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
