| 1.1 Create a separate partition for containers | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 1.1 Ensure root does not have ownership of Websphere Liberty binaries | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.5 Ensure Websphere Liberty Server Output is not set to the default value | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 1.7 Only allow trusted users to control Docker daemon | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | ACCESS CONTROL |
| 1.10 Audit Docker files and directories - /etc/docker | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.11 Audit Docker files and directories - /etc/docker/daemon.json | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.13 Audit Docker files and directories - /usr/bin/docker-runc | CIS Docker 1.13.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.17 Audit Docker files and directories - /etc/sysconfig/docker-storage | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 2.1 Ensure 'displayAuthenticationRealm' is set to 'false' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 2.7 Do not use the aufs storage driver | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 2.10 Set default ulimit as appropriate '--default-ulimit' | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.1 Verify that docker.service file ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.2 Verify that docker.service file permissions are set to 644 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.12 Verify that Docker server certificate file permissions are set to 444 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.19 Verify that /etc/default/docker file ownership is set to root:root | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.20 Verify that /etc/default/docker file permissions are set to 644 or more restrictive | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.22 Verify that Docker server certificate file permissions are set to 444 or more restrictive | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 3.24 Verify that Docker server certificate key file permissions are set to 400 | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.1.2.1 Ensure 'sameSiteCookie' attribute is set to 'Strict' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.3.1 Ensure 'samesite' SameSite attribute is set to 'Strict' for additional cookies | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 4.2 Use trusted base images for containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 4.2.11 Ensure that strong algorithms are used for TLS certificates. | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.6 Ensure 'signatureAlgorithm' is set to a secure algorithm in OIDC Relying Party (RP) | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.12 Ensure 'clientSecretEncoding' is set to a strong encoding type in OAuth 2.0 | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.3.14 Ensure 'skipResourceOwnerValidation' is set to 'false' in OAuth 2.0 | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.3.17 Ensure 'authnRequestsSigned' is set to 'true' in SAML | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 4.4.1 Ensure 'disableXPoweredBy' is set to 'true' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | MEDIA PROTECTION |
| 4.4.2 Ensure 'preserveFullyQualifiedReferrerUrl' is set to 'false' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.5 Ensure 'logoutOnHttpSessionExpire' is set to 'true' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.4.12 Ensure security constraints are specified to protect web applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | ACCESS CONTROL |
| 4.4.13 Ensure application security feature is enabled | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.14 Ensure 'invalidateOnUnauthorizedSessionRequestException' is set to 'false' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.15 Ensure Web Server Document Root does not contain information that should be private | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.4.16 Ensure HTTP session overflow is 'disabled' | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.4.19 Ensure server headers on requests are removed | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | MEDIA PROTECTION |
| 4.4.20 Ensure 'directoryBrowsingEnabled' is set to 'false' for web applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | MEDIA PROTECTION |
| 4.4.22 Ensure virtual hosts are defined to isolate applications | CIS IBM WebSphere Liberty v1.0.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.8 Remove setuid and setgid permissions in the images | CIS Docker 1.13.0 v1.0.0 L2 Docker | Unix | |
| 5.1 Verify AppArmor | CIS Docker 1.6 v1.0.0 L2 Docker | Unix | ACCESS CONTROL |
| 5.4 Do not use privileged containers | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | ACCESS CONTROL |
| 5.4 Restrict Linux Kernel Capabilities within containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | ACCESS CONTROL |
| 5.6 Do not mount sensitive host system directories on containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.14 Set the 'on-failure' container restart policy to 5 - 'MaximumRetryCount' | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.14 Set the 'on-failure' container restart policy to 5 - RestartPolicyName | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.18 Do not directly expose host devices to containers | CIS Docker 1.6 v1.0.0 L1 Docker | Unix | |
| 5.19 Do not set mount propagation mode to shared | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | CONFIGURATION MANAGEMENT |
| 5.27 Ensure docker commands always get the latest version of the image | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 5.28 Use PIDs cgroup limit | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.3 Backup container data | CIS Docker 1.13.0 v1.0.0 L1 Docker | Unix | |
| 6.7 Avoid container sprawl | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | SYSTEM AND INFORMATION INTEGRITY |
