| 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - modprobe | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.7 Ensure mounting of udf filesystems is disabled - lsmod | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.5 Ensure noexec option set on /tmp partition | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.10 Ensure noexec option set on /var/tmp partition | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.14 Ensure nodev option set on /home partition | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.10 Ensure updates, patches, and additional security software are installed | CIS Debian Family Workstation L1 v1.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.1.1.2 Ensure systemd-timesyncd is configured - systemctl | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1.1.3 Ensure chrony is configured - timesyncd masked | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1.1.4 Ensure ntp is configured - ntp server | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1.4 Ensure CUPS is not installed | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.8 Ensure DNS Server is not installed | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.10 Ensure HTTP server is not installed | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.13 Ensure HTTP Proxy Server is not installed | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.15 Ensure mail transfer agent is configured for local-only mode - /etc/exim4/update-exim4.conf.conf | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.2.3 Ensure talk client is not installed | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.1 Ensure packet redirect sending is disabled - all sysctl | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.1 Ensure packet redirect sending is disabled - default sysctl | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.2 Ensure IP forwarding is disabled - ipv4 /etc/sysctl.conf /etc/sysctl.d/* | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.2.2 Ensure IP forwarding is disabled - ipv6 /etc/sysctl.conf /etc/sysctl.d/* | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1 Ensure source routed packets are not accepted - net.ipv4.conf.default.accept_source_route = 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.1 Ensure source routed packets are not accepted - net.ipv6.conf.default.accept_source_route = 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2 Ensure ICMP redirects are not accepted - files net.ipv6.conf.all.accept_redirects= 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.2 Ensure ICMP redirects are not accepted - files net.ipv6.conf.default.accept_redirects= 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.3 Ensure secure ICMP redirects are not accepted - files net.ipv4.conf.default.secure_redirects = 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.6.1.3 Ensure ufw service is enabled - ufw | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.1.4 Ensure loopback traffic is configured - allow in v4 | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.1.6 Ensure firewall rules exist for all open ports | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.2.10 Ensure nftables rules are permanent | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.2.1 Ensure default deny firewall policy - INPUT | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.2.3 Ensure outbound and established connections are configured | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.2.4 Ensure firewall rules exist for all open ports | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.3.2 Ensure IPv6 loopback traffic is configured - INPUT | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.2.2 Ensure journald is configured to compress large log files | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.8 Ensure cron is restricted to authorized users - cron.deny | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.2.3 Ensure permissions on SSH public host key files are configured | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.2.6 Ensure SSH MaxAuthTries is set to 4 or less | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.2.11 Ensure SSH PermitUserEnvironment is disabled | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.2.19 Ensure SSH PAM is enabled | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.3.1 Ensure password creation requirements are configured - minlen | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.2 Ensure lockout for failed password attempts is configured - /etc/pam.d/common-auth | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.4.1.3 Ensure password expiration warning days is 7 or more - users | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1.4 Ensure inactive password lock is 30 days or less - useradd | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.4 Ensure default user umask is 027 or more restrictive - /etc/login.defs | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 6.1.4 Ensure permissions on /etc/group are configured | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.1.8 Ensure permissions on /etc/gshadow are configured | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.1 Ensure accounts in /etc/passwd use shadowed passwords | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.7 Ensure no users have .netrc files | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 6.2.8 Ensure no users have .forward files | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.14 Ensure no duplicate GIDs exist | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 6.2.17 Ensure shadow group is empty | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
