| 1.1.1 Ensure Administrative accounts are separate and cloud-only | CIS Microsoft 365 Foundations E3 L1 v3.1.0 | microsoft_azure | ACCESS CONTROL |
| 1.1.2 Ensure that the API server pod specification file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.2 Ensure that the API server pod specification file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.7 Set 'aaa accounting' to log all privileged use commands using 'commands 15' | CIS Cisco IOS 15 L2 v4.1.1 | Cisco | ACCESS CONTROL |
| 1.2.1 Set 'privilege 1' for local users - 'No users with privileges 2-15' | CIS Cisco IOS 15 L1 v4.1.1 | Cisco | ACCESS CONTROL |
| 2.1.3 Ensure 'ADMIN_RESTRICTIONS_' Is Set to 'ON' | CIS Oracle Server 18c Windows v1.1.0 | Windows | ACCESS CONTROL |
| 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled | CIS Palo Alto Firewall 11 v1.1.0 L1 | Palo_Alto | ACCESS CONTROL |
| 3.1 Ensure least privilege for database accounts | CIS MongoDB 6 v1.2.0 L1 MongoDB | MongoDB | ACCESS CONTROL |
| 3.1.3 Require explicit authorization for cataloging - 'catalog_noauth = no' | CIS IBM DB2 OS L2 v1.2.0 | Unix | ACCESS CONTROL |
| 3.3 Ensure that MongoDB is run using a Least Privileges, dedicated service account | CIS MongoDB 3.6 L1 Windows Audit v1.1.0 | Windows | ACCESS CONTROL |
| 3.5 Ensure the SQL Server's MSSQL Service Account is Not an Administrator | CIS SQL Server 2022 Database L1 OS v1.1.0 | Windows | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS SQL Server 2016 Database L1 AWS RDS v1.4.0 | MS_SQLDB | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS SQL Server 2016 Database L1 OS v1.4.0 | Windows | ACCESS CONTROL |
| 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator | CIS SQL Server 2017 Database L1 AWS RDS v1.3.0 | MS_SQLDB | ACCESS CONTROL |
| 3.7 Ensure the SQL Server's Full-Text Service Account is Not an Administrator | CIS SQL Server 2016 Database L1 AWS RDS v1.4.0 | MS_SQLDB | ACCESS CONTROL |
| 4.1 (L1) Ensure a non-root user account exists for local admin access | CIS VMware ESXi 7.0 v1.4.0 L1 Bare Metal | Unix | ACCESS CONTROL |
| 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster | CIS Google Kubernetes Engine (GKE) Autopilot v1.1.0 L1 | GCP | ACCESS CONTROL |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Worker | Unix | ACCESS CONTROL |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS RedHat OpenShift Container Platform v1.6.0 L1 | OpenShift | ACCESS CONTROL |
| 4.07 init.ora - 'os_authent_prefix = NULL String' | CIS v1.1.0 Oracle 11g OS Windows Level 1 | Windows | ACCESS CONTROL |
| 4.8 Ensure the set_user extension is installed | CIS PostgreSQL 14 DB v 1.2.0 | PostgreSQLDB | ACCESS CONTROL |
| 5.1.10 Ensure SSH root login is disabled | CIS Google Container-Optimized OS v1.2.0 L1 Server | Unix | ACCESS CONTROL |
| 5.2.2 Minimize the admission of privileged containers | CIS Kubernetes v1.10.0 L1 Master | Unix | ACCESS CONTROL |
| 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 5.2.6 Minimize the admission of root containers | CIS Kubernetes v1.20 Benchmark v1.0.1 L2 Master | Unix | ACCESS CONTROL |
| 5.3 Ensure 'PROCESS' is Not Granted to Non-Administrative Users | CIS MariaDB 10.6 Database L2 v1.1.0 | MySQLDB | ACCESS CONTROL |
| 5.3 Ensure 'PROCESS' is Not Granted to Non-Administrative Users | CIS MySQL 5.6 Enterprise Database L2 v2.0.0 | MySQLDB | ACCESS CONTROL |
| 5.4 Adding authorized users in at.allow | CIS IBM AIX 7.1 L1 v2.1.0 | Unix | ACCESS CONTROL |
| 5.5 Ensure 'SHUTDOWN' is Not Granted to Non-Administrative Users | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL |
| 5.5 Ensure the "root" Account Is Disabled | CIS Apple macOS 13.0 Ventura Cloud-tailored v1.1.0 L1 | Unix | ACCESS CONTROL |
| 5.7 Ensure 'GRANT OPTION' is Not Granted to Non-Administrative Users | CIS MariaDB 10.6 Database L1 v1.1.0 | MySQLDB | ACCESS CONTROL |
| 5.7 Ensure 'GRANT OPTION' is Not Granted to Non-Administrative Users | CIS MySQL 5.6 Community Database L1 v2.0.0 | MySQLDB | ACCESS CONTROL |
| 5.7 Ensure 'GRANT OPTION' is Not Granted to Non-Administrative Users | CIS MySQL 5.7 Enterprise Database L1 v2.0.0 | MySQLDB | ACCESS CONTROL |
| 7.0.1 Establish an administrator group - 'sysadm_group value' | CIS IBM DB2 OS L2 v1.2.0 | Unix | ACCESS CONTROL |
| 7.0.2 Establish system control group - 'sysctrl_group value' | CIS IBM DB2 OS L2 v1.2.0 | Unix | ACCESS CONTROL |
| 7.0.3 Establish system maintenance group - 'sysmaint_group users' | CIS IBM DB2 OS L1 v1.2.0 | Unix | ACCESS CONTROL |
| 7.0.4 Establish system monitoring group - 'sysmon_group users' | CIS IBM DB2 OS L1 v1.2.0 | Unix | ACCESS CONTROL |
| 7.1 Ensure a replication-only user is created and used for streaming replication | CIS PostgreSQL 12 DB v1.1.0 | PostgreSQLDB | ACCESS CONTROL |
| 8.5 Remove the toor user. | CIS FreeBSD v1.0.5 | Unix | ACCESS CONTROL |
| 8.5 Verify that no UID 0 accounts exist other than root | CIS Solaris 9 v1.3 | Unix | ACCESS CONTROL |
| 10.13 Do not run applications as privileged | CIS Apache Tomcat 10 L1 v1.1.0 | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener | CIS Apache Tomcat 10.1 v1.0.0 L1 | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for umask present in startup | CIS Apache Tomcat 9 L1 v1.2.0 | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for umask present in startup | CIS Apache Tomcat 9 L1 v1.2.0 Middleware | Unix | ACCESS CONTROL |
| 10.17 Setting Security Lifecycle Listener - check for umask uncommented in startup | CIS Apache Tomcat 10 L1 v1.1.0 | Unix | ACCESS CONTROL |
