| 1.1 Remove extraneous files and directories - /webapps/balancer | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories - /webapps/examples | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (CONFIG_DIR/Catalina/localhost/manager.xml) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (WEBAPP_DIR/ROOT/admin) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1 Remove extraneous files and directories (WEBAPP_DIR/servlet-example) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.6 Ensure overlay kernel module is not available | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.7 Ensure squashfs kernel module is not available | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2.3.1 Ensure separate partition exists for /home | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION |
| 1.1.2.7.1 Ensure separate partition exists for /var/log/audit | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.2 Disable Unused Connectors | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.3.1.3 Ensure all AppArmor Profiles are enforcing | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.7.4 Ensure GDM automount is configured | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION |
| 1.7.7 Ensure Xwayland is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | CONFIGURATION MANAGEMENT |
| 2.3.3.11 Ensure Computer Name Does Not Contain PII or Protected Organizational Information | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, PROGRAM MANAGEMENT |
| 2.3.13 (L2) Ensure 'Control use of the WebHID API' is set to 'Enabled: Do not allow any site to request access to HID devices via the WebHID API' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.15 (L2) Ensure 'Default Window Management permissions setting' Is 'Enabled' to 'Deny Permission' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.19 (L2) Ensure 'Allow Window Management permission on these sites' Is Configured | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | ACCESS CONTROL |
| 2.3.20 (L2) Ensure 'Allow write access via the File System API on these sites' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 2.6.2.1 Audit Full Disk Access for Applications | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.6.7 Audit Lockdown Mode | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, MAINTENANCE |
| 2.7.2 Audit iPhone Mirroring | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 2.8.1 L2 - Ensure 'Allow Local Network Access (LNA) requests in subframes without explicit delegation' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.10.1.2 Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.23 (L2) Ensure 'Allow or deny audio capture' is set to 'Disabled' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.31 (L2) Ensure 'Browser sign in settings' is set to 'Enabled: Disabled browser sign-in' | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 2.92 (L2) Ensure 'Allow pages to use the built-in AI APIs' Is Disabled | CIS Google Chrome Group Policy v1.1.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 3.2 Disable the Shutdown port | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 3.2 Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.1 Use secure Realms | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | ACCESS CONTROL |
| 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.2.5 Ensure Complex Password Must Contain Special Character Is Configured | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.3.1 Ensure nologin is not listed in /etc/shells | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.1 Ensure audit log storage size is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.9 Ensure events that modify /etc/NetworkManager directory are collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.12 Ensure events that modify /etc/group information are collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.20 Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.21 Ensure successful file system mounts are collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.32 Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.33 Ensure kernel "delete_module" loading unloading and modification is collected | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.4.10 Ensure audit tools group owner is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.5 Audit Hide IP Address in Safari Setting | CIS Apple macOS 26 Tahoe v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.3 Ensure className is set correctly in context.xml | CIS Apache Tomcat 10 L2 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.3 Ensure className is set correctly in context.xml | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 7.7 Configure log file size limit (verify java.util.logging.FileHandler.limit is smaller than disk partition) | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| 9.2 Disabling auto deployment of applications | CIS Apache Tomcat 7 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 9.2 Disabling auto deployment of applications | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.8 Do not allow additional path delimiters - ALLOW_ENCODED_SLASH | CIS Apache Tomcat 10 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.8 Do not allow additional path delimiters - ALLOW_ENCODED_SLASH | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| 10.9 Do not allow custom header status messages | CIS Apache Tomcat 8 L2 v1.1.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
